Edit tour

Windows Analysis Report
FW_ Olivia McGahen shared _GAIR LEGAL_ with you.msg

Overview

General Information

Sample name:	FW_ Olivia McGahen shared _GAIR LEGAL_ with you.msg
Analysis ID:	1523178
MD5:	b64d7dab50e885bdef5eed4eb6245b16
SHA1:	e40a0008ffaab573d052fbb0888d1d8c60a4cc42
SHA256:	52067b9e17aa0d260fcb3621c1bf11ed0ddff36914cefccb9669d1d3d05e4af8
Infos:

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

AI detected landing page (webpage, office document or email)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6964 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\FW_ Olivia McGahen shared _GAIR LEGAL_ with you.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6948 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "79625AB2-3F55-43F4-AEA8-7464C7AD372D" "23B7234E-28A4-494C-A9E0-8208AE73FF3B" "6964" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 3808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gairlegalau-my.sharepoint.com/:o:/g/personal/olivia_mcgahen_gairlegal_com_au/EkfOV5ZnIZ5ItaQU3XBTsdoBEDG3LMTuHFdlMyMfe6BABQ?e=5%3aSZddJa&at=9 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1956,i,17934364358737693093,15476248828699000145,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2012 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gairlegalau-my.sharepoint.com/:o:/g/personal/olivia_mcgahen_gairlegal_com_au/EkfOV5ZnIZ5ItaQU3XBTsdoBEDG3LMTuHFdlMyMfe6BABQ?e=5%3aSZddJa&at=9 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3168 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1888,i,14473249038870038208,18143631378080879912,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6964, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown

HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49761 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172

Source: global traffic	DNS traffic detected: DNS query: gairlegalau-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown

HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49761 version: TLS 1.2

Source: classification engine

Classification label: sus21.winMSG@29/31@14/120

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241001T0231060906-6964.etl

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\FW_ Olivia McGahen shared _GAIR LEGAL_ with you.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "79625AB2-3F55-43F4-AEA8-7464C7AD372D" "23B7234E-28A4-494C-A9E0-8208AE73FF3B" "6964" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "79625AB2-3F55-43F4-AEA8-7464C7AD372D" "23B7234E-28A4-494C-A9E0-8208AE73FF3B" "6964" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gairlegalau-my.sharepoint.com/:o:/g/personal/olivia_mcgahen_gairlegal_com_au/EkfOV5ZnIZ5ItaQU3XBTsdoBEDG3LMTuHFdlMyMfe6BABQ?e=5%3aSZddJa&at=9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1956,i,17934364358737693093,15476248828699000145,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gairlegalau-my.sharepoint.com/:o:/g/personal/olivia_mcgahen_gairlegal_com_au/EkfOV5ZnIZ5ItaQU3XBTsdoBEDG3LMTuHFdlMyMfe6BABQ?e=5%3aSZddJa&at=9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1956,i,17934364358737693093,15476248828699000145,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gairlegalau-my.sharepoint.com/:o:/g/personal/olivia_mcgahen_gairlegal_com_au/EkfOV5ZnIZ5ItaQU3XBTsdoBEDG3LMTuHFdlMyMfe6BABQ?e=5%3aSZddJa&at=9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1888,i,14473249038870038208,18143631378080879912,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gairlegalau-my.sharepoint.com/:o:/g/personal/olivia_mcgahen_gairlegal_com_au/EkfOV5ZnIZ5ItaQU3XBTsdoBEDG3LMTuHFdlMyMfe6BABQ?e=5%3aSZddJa&at=9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1888,i,14473249038870038208,18143631378080879912,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email

LLM: Email contains prominent button: 'open'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Link
www.google.com	0%	Virustotal	Browse
dual-spo-0005.spo-msedge.net	0%	Virustotal	Browse
spo.nel.measure.office.net	0%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
196385-ipv4v6.farm.dprodmgd106.aa-rt.sharepoint.com	52.105.235.25	true	false		unknown
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.186.36	true	false	0%, Virustotal, Browse	unknown
gairlegalau-my.sharepoint.com	unknown	unknown	false		unknown
spo.nel.measure.office.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://gairlegalau-my.sharepoint.com/:o:/g/personal/olivia_mcgahen_gairlegal_com_au/EkfOV5ZnIZ5ItaQU3XBTsdoBEDG3LMTuHFdlMyMfe6BABQ?e=5%3aSZddJa&at=9	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
52.105.235.25	196385-ipv4v6.farm.dprodmgd106.aa-rt.sharepoint.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
23.38.98.108	unknown	United States	16625	AKAMAI-ASUS	false
23.38.98.114	unknown	United States	16625	AKAMAI-ASUS	false
216.58.212.132	unknown	United States	15169	GOOGLEUS	false
2.16.202.85	unknown	European Union	16625	AKAMAI-ASUS	false
142.251.5.84	unknown	United States	15169	GOOGLEUS	false
20.42.65.94	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
52.109.32.39	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.168.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
2.19.126.160	unknown	European Union	16625	AKAMAI-ASUS	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
52.109.89.19	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
184.28.90.27	unknown	United States	16625	AKAMAI-ASUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523178
Start date and time:	2024-10-01 08:30:32 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	FW_ Olivia McGahen shared _GAIR LEGAL_ with you.msg
Detection:	SUS
Classification:	sus21.winMSG@29/31@14/120
Cookbook Comments:	Found application associated with file extension: .msg

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132
Excluded domains from analysis (whitelisted): ecs.office.com, s-0005.s-msedge.net, ctldl.windowsupdate.com, ecs.office.trafficmanager.net, s-0005-office.config.skype.com, ecs-office.s-0005.s-msedge.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

LLM Input / Output

Input	Output
URL: Email Model: jbxai	{ "brand":["icare"], "contains_trigger_text":true, "trigger_text":"Olivia McGahen shared a file with you", "prominent_button_name":"Open", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":true, "has_visible_qrcode":false}

Input

Output

URL: Email Model: jbxai

{
"brand":["icare"],
"contains_trigger_text":true,
"trigger_text":"Olivia McGahen shared a file with you",
"prominent_button_name":"Open",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":true,
"has_visible_qrcode":false}

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.388285221116293
Encrypted:	false
SSDEEP:
MD5:	BAF9DC22EB685B335D5DB95483505B8B
SHA1:	5BB2ED978CA7982E5C41BE10F64EB2B247032A95
SHA-256:	441AD9EC239EEFB2B6E54A8B93B1152B4D4385C2DB737898D580A9C9602B5F91
SHA-512:	A392471300AF75C98ED799B607381CCE5A5AE417411DDCB88B0A8B1ECC489BA1C0E3E9799C0ECEB0ED2361236AC8462BFF16818245769359392BC9B18DBDF9A9
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ..s........SM01X...,....:.s............IPM.Activity...........h...............h............H..ht..........x...h...........H..h\cal ...pDat...h....0.........h...............h........_`Pk...h....@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k;.1.....2.8...!h.............. hh.. ........#h....8.........$h.......8....."h.<......x:....'h..............1h....<.........0h....4....Uk../h....h.....UkH..h....p...t.....-h .............+h$.......h........... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
Category:	modified
Size (bytes):	1869
Entropy (8bit):	5.085812972973624
Encrypted:	false
SSDEEP:
MD5:	CD8B7F367D0E7B5AB677118028ACACF5
SHA1:	4B2C471B40FA5C9DE97024CA8E303823239B8447
SHA-256:	77D3698CAF7EEF55588CC6B6BCAE9118B4F3291B8AF5325F89D15CA6E00ED7AB
SHA-512:	DF70181EABF6857844D58AA98C1E8DE9841ADE03083B12B06219F015B61C6F7B7D04438F02E46DBE4523F8199EF04766868A7362ED3196CAC70423D448FA927A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-10-01T06:31:08Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2024-10-01T06:31:08Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-06T09:25:29Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:25:29Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:25:29Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Reputation:	unknown
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Reputation:	unknown
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	unknown
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.3219280948873626
Encrypted:	false
SSDEEP:
MD5:	1E58D357A4ED6B3F4E270C0B73707FA4
SHA1:	D76B353862E7CFB40ABAE85068943CEFEA61F0B2
SHA-256:	7E3B13A2066586C6D484852A74AC2350D97A159D9FBC9EC33520A341D85F8897
SHA-512:	3363EEF6AA6EF0B02202BF7956DE6799E69E0A6514839E35CB0AC5035A4339263E21F39A3FCBE249759E31C0357FD2A0C7A95F7FCFA70462C78D578F07E4E12E
Malicious:	false
Reputation:	unknown
Preview:	1727764270

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13758003262114013
Encrypted:	false
SSDEEP:
MD5:	11E26E39E25CEB654AFC26357EF27207
SHA1:	1E44D359E37227A2BABBA671A913CCA88B7BDA00
SHA-256:	DB69103667ADFFEDE4683FD11AA4374F529BC312608DB9A1B669F601C1161AF4
SHA-512:	2447736C9DD672B0D26E6D7A0D9074FD982874967F82F0064F892F3F12610674E953CB2B9B62C97ACC68528A10E7400FF91DBC26EA74F6473FF79D6EF16D4BF0
Malicious:	false
Reputation:	unknown
Preview:	.... .c......X.t....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1212F459.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 140 x 140, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2358
Entropy (8bit):	7.050677917005715
Encrypted:	false
SSDEEP:
MD5:	99CF32CF3F35F3C973D47F43C8ECD923
SHA1:	C1EBDF78F215AF30517560F246D9DE6A21CF7BC2
SHA-256:	83084D618BB17D710D70EBE403E1033D365F234C5448AFC9B10C83AC890CA2EF
SHA-512:	61A7B8AAEBAA052575BC15BBA6CCACD42187DEF3E35F02ED72837D8B0CBCC4E78CF6B4F1AC52A143136BDF7439812639BA6127D3BF5835824C85F6E0FA8E7CA7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmp:CreateDate="2018-01-31T11:48:19+11:00" xmp:ModifyDate="2020-02-11T13:51:54+11:00" xmp:MetadataDate="2020-02-11T13:51:54+11:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:4fe4c70a-7c74-429a-8a38-d32def99d1de" xmpMM:DocumentID="xmp.did:4fe4c70a-7c74-429a-8a38-d32def99d1de" xmpMM:OriginalDocumentID="xmp.did

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\130A90CA.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 80x75, components 3
Category:	dropped
Size (bytes):	3331
Entropy (8bit):	7.8556428306751735
Encrypted:	false
SSDEEP:
MD5:	93BF6847F002CAD08448AD7897DBE8CD
SHA1:	AB405D4B9BAD5204917497C0FDA4A878BA1CC4CA
SHA-256:	783C382A35788304EC3E8DD860ACF0DA4E846E0CD00471F6FAECB2E4A0F11CB0
SHA-512:	A7E3FAE9792C5EE313AD754BB6F36526D67EB06E753AB6BB423BFF3FBFB5CFA79A74A9102D4F956E3D49E863AA1FA9D00418192F804CE09943187D7C653CA31D
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.......................................................................K.P.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..S.Y......d.9...........G.z.....O.!..,...1.......{D.S.Okmcj.<.Q..c..n.....5..qS.......7...g\)..ue.;x."*.....W...{.....C...K....(.3,.....d.1...G.......MZKh.......I.l.<`._...........9.....>.....).?`....~.7.g.._...^{..t....=B[H.\|A..]A5.>M...(..I2..U..d...)...]D.T..c.+........./...76S..=.2.DI+3.C.U$Fb........t.F..k/p-n..g.... .&5....E!;s........=h[\yS4.....2..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1A8728D1.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2133
Entropy (8bit):	7.86298626930999
Encrypted:	false
SSDEEP:
MD5:	4DF1205B01187B26FF893615B19C65DE
SHA1:	13856C6DCE2C8C328153C9C6FD37643EDCC45B81
SHA-256:	5931FFF65F3CF45DA0DDD4F29D39BA23063A3735A8F99868DF6C23E26BD61788
SHA-512:	074239FBFE2D5B34EFDD6EC0255A459CFDDCA9538FDAE5F371F50414B4EC305D551461CBD852294E89197BD8375E7FC5C888657971281AFCCC06051AFA01FA1E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0...0.....W.......pHYs...%...%.IR$.....sRGB.........gAMA......a.....IDATx..ZOL.U..fkmM..%...p.S....M.<.....M!R....TL...x.=......<.5.......S6.R....U...K/.t...v.0.3........v.......}.B[.UU.D.Z..:>T..z..6...H.HQf..G.....O.H..x..p#...3.W"L....u.%c... 5.b.k.Q4....Zq.....BKKK.<?7G..iJOO...&.X.S..R......J<...{L..b....8....{C^..$..:.u.'nB.......?.H$B[.L&C.##.da.......FI.Tu_......GX=.O..uy.......).........n.ls.YP.A~gGG'.9{...../0....;l....ZZZimu.fggw......T..r..T... ..==B....{r`.gw.4Z...kimu\|n.U........fO~_+..h.....tv.#M[..~.`..B!ZXX....-.4.=...B.s.=...p.n-.}p.J.P0X....Jg...#Z^^&._..9joo.6>0.)....:.s.."!.X....k..........~...dR.<t.D......].pQ\...+........dxBr.@.=..m0..@....8......F_'`.pb...........#n&.._..Lf.$.HD.r]..\N...P.}...9.e..<....R..!q....K..Q.....T0.0.w...B.c...Tu$.....7..a..N0.^'.._.....<j._..V.........4...............[C..X.*.@....;...s.~....@.:...<.9##..ni.......".~M.s.) ....[I.H[...6....T.{<...\|.F..3..Q......1...+......K..3.-...T.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\29E217D3.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 2394 x 964, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	46551
Entropy (8bit):	7.915986795988805
Encrypted:	false
SSDEEP:
MD5:	33E20B00C30853C6E08552A9B85C9D53
SHA1:	396B1D7E4ED0DCC105570426D2EB6B608A38AEA4
SHA-256:	EB31A83E40943F1F61302299AB3E98221521BC4FA6260A6F50A3A522EB885018
SHA-512:	F66B45298B3BEC9F7B6566AE53FC34B9FD3E752436BE07E909A6FA47C3038CAD7A96780DF08584631F467BA53D88A0A7CADA8984E9CAFBEF6645CBE2B42EDB22
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...Z.........b......%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:CFAE4224449F11EAAFEBCC9F48D7E919" xmpMM:DocumentID="xmp.did:CFAE4225449F11EAAFEBCC9F48D7E919"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9D6EE1FF449F11EAAFEBCC9F48D7E919" stRef:documentID="xmp.did:9D6EE200449F11EAAFEBCC9F48D7E919"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.(r\|....tEXtSoftware.Adobe ImageReadyq.e<....PLTEGpL..........{........{...........{..{..{.....{.....{..{..{..{..{........{..{..{.....{..{..{..{..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\2F89589E.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 170 x 42, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	596
Entropy (8bit):	7.364661534557532
Encrypted:	false
SSDEEP:
MD5:	5DD0A1C2FF9D5D1FC2EB0BB037ACCA17
SHA1:	6938BE0251FC4CD282AD24333BBDD8AE06056F71
SHA-256:	A89F368E59B207F13EED73FC170CD4AF26086F3B6D97EAE8F1ED265CD631ED7E
SHA-512:	BFB490C0D07C6452830C4CE7DCDD88DE587ACC1CE1E937D3DD2A5A70A1E509153E1BA2B6CBFB4C57B4B738AC531545763014A53DC4B897D30E7A8C7054BB89F4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR............#..Z....sRGB.@.}.....pHYs..........+......tEXtSoftware.Microsoft Office..5q....IDATx...=K.@......\|.W.EG?.PP......C.......Z..$..;X.....8....mr9...!..C..3..........x....git..u. .fs..H7....9%r...s..?....r..r.....P..D@%.......T".....J.T"..P..J@%]{,.k..2/@u...&!........O.Ra......L.Xj6.....2S.....m.4d.7._..W.....Z...c.r....PF.G....M0q.........1.m.+7P..o[...q..T....f.VWVU..rE.o...A,x{.}.....[.....v.vp@....T?}.'.y..uA..R.I.{..0.@..U...x.{..a..@.ce5....W..........W....OV_~Z.P..@.*P...T".....J.T"...._..J..I!..>.....%.BN.}x..\|.'r./......b....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\30E4B0CF.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	7.721862655505014
Encrypted:	false
SSDEEP:
MD5:	231C27717520BD6935762DC5A12893FD
SHA1:	86E32480CE1F3AD1D0BFC369E2723C39E0220A72
SHA-256:	01A1C1166EFDF8E5313E2D9716EA7B9F72BAD5EA19D7A2FE9425DEA55E14019F
SHA-512:	6CBC8445468202451210F17B9466157A2B129FFEA1EBC7C3AC3F4147B22C554B07AD6A96674DA4448EAB9577DC9467A5313E555A5B239F9B31F5803841D5D5B2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.............pHYs..,J..,J.wztM...3PLTEGpL#. #. #. #. #. #. #. #. #. #. #. #. #. #. #. #. .zw.....tRNS.`. ...@..0.Pp.S.[....JIDATh.... .@........O.RFM......@.H..B.aNY.#.lJ.#...._.........u..~d...2}.eg..U.@..s...@..G..A.A..j.....?.o....Q.vh...Y...l7P.[.........:AiQ... kYC.....m......e.Q...E..>....N6S...!..u.#.d5....fX...>..S.....Cf3..e......d....n..y..q..'s........w.....10...h......ev0..<...4.r..............O3../.....p.js...V.:.!.8.X.......P.\s....E....\|M.o....)...r..T.#.dp.......:,.\|.p....[.$8..k3:..o.YmG.....q@........F.li^g$.x...xK.98h.`...C]1..m0...s...`..F....@!s......./.3..D.A..Cb..K.....s......6....4By..(%4.=..$.H^../...c]../...f.+.....6.....35.^i`;.F..8...\|..M.....V.....g.N.hv..w.&.._...y....'{!.....M...&.%4.[...&.....{.56d.7.....T.:.^....Y....w.n.G.{V....f.,.....}/.cA......bn.\...Lv"5..Y.....:...).y...>.y.I....C#..*...0.s.`...9.8@.wtc.(.,z.qpB@.......M..~........4....].@....0.UJH.2...'.....kM@..^.s.O.?..N.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\50F3D643.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 80x80, components 3
Category:	dropped
Size (bytes):	4761
Entropy (8bit):	7.903720794709867
Encrypted:	false
SSDEEP:
MD5:	C78C0CB744FDC2D0BCED556ABDC9C85D
SHA1:	180FFEB64427AB50353ADF5985FE1A46AF8AD021
SHA-256:	2126D041541635E0031340A10079D42C6131FC3D4C00CAB399B25CCCA2FA837E
SHA-512:	58BEBD5A6F51121F2AEE3C7347500253AACEC5E383631494053E5791B366BC08A48EEC1543895BE1652CCEB7901D1F9F1A099CABC399A18520D62560CA110987
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.......................................................................P.P.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..S....................#..]L..Y.B6.U..'.......u.I+l..}.v.#z4g^j._.<.....^.....u..-.8...#.%..A..+.\|i.B\..:...v..$.n....kp.P....rs.J....7.Gs..x.P.........H.m.ZG.~......<...!q...Vw..4.KZ..)..7.....q}.8..G..*6....x<.7.#.....'f..SE.[$.}v....pX.....h....Wo..}./...?...Rx...#yb.M.........-.....j........Y'..~e.....=.%6..k._......s...mm..........ZnLM.3>.BO.. .x%.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\522DAE5C.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 227x62, components 3
Category:	dropped
Size (bytes):	6349
Entropy (8bit):	7.91919547914831
Encrypted:	false
SSDEEP:
MD5:	541E5134BB9AC0285A4F9C55FDD52C5C
SHA1:	6B0A4ED5AA248A2EB2ABE9F29040764BC35CA972
SHA-256:	558FCB2ED003DEFE1E16916C7E28C08DC0949F2614815316730CFC52C968FD63
SHA-512:	55D77D2749D0CD19891A2A1136F8C0FF5B19A8DC205AC3EA83BD61C7EC797BDCEF2B686F3B7E137B25C1F9C2521BD7BD009D7C574B90FBE14507F50C3B827F1D
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.......................................................................>...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..S..(...(...(...(...(...(.+.............".\|/kv..hp.%..xN....U.1...1.....k..w..2..C.r.]G........]...U.ia.....l..;...._......+.O.x.K.~.x.......o8K.....$dF..9.....}.?F.?...*..5.&./t..V...0v...... .Z....i..\|h./.M)4.+.>.'...U.. .$,_qT....xb...j...(..C.(...(...(...(...(...(..1.]..#........4.U.$...P9,O..Mp.g.>"x..ot/....%....#.L....,y`.......%....SxO.W?....s....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5502DE86.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 140 x 140, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2986
Entropy (8bit):	7.361585421513578
Encrypted:	false
SSDEEP:
MD5:	F9BE454486B429CE40ECB82079F671DC
SHA1:	5ECAEF934FB963E0C066DAE21A0C9BA003B93B26
SHA-256:	4F1027541AA44F9568C427D27A5B4BDCBBCE22A34011686E439C66F8B5EF3B02
SHA-512:	46FD297788885E1EC2D7EFE30DBEDD11E6E3610D5D39CDD7B0288A39BB1B5CC061E9AF5687D08301BC839D8E89C30F8D93FC087F1DC7A8F45A3715910710B1B3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmp:CreateDate="2018-01-31T11:48:18+11:00" xmp:ModifyDate="2020-02-11T13:51:33+11:00" xmp:MetadataDate="2020-02-11T13:51:33+11:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:9db09b5e-1950-4b14-a8bf-48769d1b8cc0" xmpMM:DocumentID="xmp.did:9db09b5e-1950-4b14-a8bf-48769d1b8cc0" xmpMM:OriginalDocumentID="xmp.did

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\66C682AD.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 80x75, components 3
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	7.861628667784984
Encrypted:	false
SSDEEP:
MD5:	A5161D0F171672BB8F0F925A4CF4C75A
SHA1:	A025B3E9FF1B24783AC3155A6C34A663E472FAF9
SHA-256:	61BFE629B2D89103A55C9C1B32248CCB074A2CDD71065C3591672F3AC034A6E0
SHA-512:	A0BCBDA0CF71C5156237884D3A8F82F75A62EB72D0012D9180AB53BA850E28A7F7965CA4ED36A265E2EF27DC4E02AF6EED1AC93B704E81B791B0F3159C3A1BA3
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.......................................................................K.P.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..S.I...H#.Ye.P....^H ..;.\|].}.O..x\|.C.)...$b.xB.n.MFE.y.......A<..#.5..qS..X/.^....L.5.n..GL..B.....Vo.u._.xsU..C.-6.[......B...5.:..A.m.H.Q.4.n.9`.."{T..Ry..o....F.....^..#...+._......M+Z.....B!...d.$`.(8.%D>.......M..&.u.'T.Xm..$-.I.X#.&s...'..`w..P.T.#.W..._..........]Iio..6gtx..&@....x.h....H..kq.L..Tc.2..........u..4.. U.-qr...N.T......4..6......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\675BC132.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 2264 x 80, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	25115
Entropy (8bit):	4.455416724957368
Encrypted:	false
SSDEEP:
MD5:	7922A52FF8198B1D4725F567F5153B00
SHA1:	E0D0E4353D63228C932ED5A7CE2AD3F1AD4E01A4
SHA-256:	1419C7B59B59A6B55E33EDB09CCBDADF4BD4947F4AEC2851AB55D3843C7B6253
SHA-512:	9C0123605D7EC96EC386A182FECDD08097C649E5608D7AD1434695BA3C31382601DF8D68E0A82CDD623D30E7762261A55222592276E7409DC77C603636580E5E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......P......./....gAMA......a.....sRGB.......F.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmpMM:OriginalDocumentID>xmp.did:2e37377f-c7fd-4d18-bf92-6256d779b16e</xmpMM:OriginalDocumentID>. <xmpMM:DocumentID>adobe:docid:ph

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\899447B8.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 140 x 140, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2197
Entropy (8bit):	6.9311065385562225
Encrypted:	false
SSDEEP:
MD5:	1B2E3A1025CD0ED4A253492D04AFACD8
SHA1:	B46069F20CFD2879E14FD11336F08B2B9FCEFCF5
SHA-256:	64643A35107CD82346E1BB1A3103C1A600F2C30FCEEACFE239D6F0540666AC96
SHA-512:	129DD547A5A06457C5249CC19DFFAE36ACA1FBC47348762C008243C5386B31A51EB28213AE3B59D7806EA9E1E1DF2C66890777AE63254307C7565B0412E95BA4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmp:CreateDate="2018-01-31T11:48:20+11:00" xmp:ModifyDate="2020-02-11T13:51:42+11:00" xmp:MetadataDate="2020-02-11T13:51:42+11:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:2307e1a7-c8e0-4fba-8b39-5d620b676d16" xmpMM:DocumentID="xmp.did:2307e1a7-c8e0-4fba-8b39-5d620b676d16" xmpMM:OriginalDocumentID="xmp.did

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\AC84BB8B.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2877
Entropy (8bit):	7.9028514706867385
Encrypted:	false
SSDEEP:
MD5:	1E13EE0ED09C4AF1ADFB6C0D280879B0
SHA1:	1192A79F7B4C4FF814583743F8C66ACA7ECB8ACF
SHA-256:	E2395FBA25D3FB8A971345CA65D144F7D9C9D933F70409165446E63D18C0958D
SHA-512:	4D86A41DE4B3CA8BB73BF641838953BE03FFF34A890B7BDDC506276186D42979BC99A7DC5553005F135AA1C02137C85C6A2623498C78A617CC195E28FD8B3C95
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...`......w8....sRGB.........IDATx..\}l.G..o..Z....$%i....4P5. Q.........@...nZ.wg.....%.$M........-.T>$..B.........MA..4Q...v...g..v....q..H.}......};o.D:h.4.....F.rC ..MBp..6.n@x..{(.?.6..1..z.............&....D....P.3A. ....).?.4...2...&..?.$...J.d...a&....M@5..^..A....".LBo.q.d.......B.a_I.....i....#...k.. 'h..-.;QmTG...1an...cN..i.."%....5...j...'bQ-...$.s.......T.8.. .$..N...Y..k..P...a..g....>`...Y[#.-..._M.m. .$.^Ed,.Z..}Y..}.2.c..X....c...$.e{..I.+.+.n.TH........7..k..wCm.....6.'..rd..U0.A..WT.vi.O@"..Jq'F...........NH`.:eb.9.gJ.5..=s.....\...F;.."@fH.i..%\..Z......N3.x..%.n...............}.i..a.....~.IL.c...7...b....j.!<...ufR.{.._....>..wc...b+.\..._....8.L..f..&..".0...@.%.g ..%...I.-R*D..3!^!..2.(k[..VS.......&.w.I......-..;.{.p..H.4..G.C./.z..UpB.S.2=.U.s.U..]....c...x.4P...c2.{.>.g..v....T.=G..`....:AqJb..{.v.4.......3h.R...3....$u......oVZ.7..a.)b.T..!........Z5.y.H.....h.UCgdr-.?...~..~yF.R,.{.$Hg.=..LB.3!.W...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BCE482B5.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	7.770891724632807
Encrypted:	false
SSDEEP:
MD5:	60198C68F9AAB3B00BBAD7E538B2263B
SHA1:	0998DD7D77F6701242701493B8CEA5E217900246
SHA-256:	894000A48287670BAFDB1797EA7EAF131BC297B7EDE87DF1ED9127D751650783
SHA-512:	490CF73CA7AB4086C884349DDBF7248C3637272C4EBC153A6AC5DBE16585DBDC8D3998D668388F1216CA1C506A4B08A0DCD2D9F5BB3294D98AB393A2C630044D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.............pHYs..,J..,J.wztM...3PLTEGpL#. #. #. #. #. #. #. #. #. #. #. #. #. #. #. #. .zw.....tRNS. `...@..0.Pp..C......IDATh...z. ..e.....v:s....%v...V... l...=...........Q.L...1.'.lo@_...........ju..eh.....z..sj,.%.p.....,.....Ene....=.f.\|..7h....n.$..q9...B..T.......B..gD.V.{...r.&...T.....h.N.....c.l=":.".K}.Q.[.>..s.Y..q..)..9)..my.....=I...P5.C.bn.(..[.5.zW.$,T32.`.. 2bf.9...Xg$Q.?_.}...$..R6{+.y...........c.U.B"....Z.0p......-.S....?3.l......oW......A\|{.\|.O....).5.0h..pd..8K#....,.ZI,.Nqw#.....t.2.}....g.ct.:!.{.......L.....Z.}/...)&hV.(......+M........Q..G...~K.5.&^.5..n[n..q...h.a...}.g5..C.`q${d.(....a......!).b=.....l..d?.`p..).MVP\|....d.W.j/..G......U.8....a..6>p...2.s`Pd...F.\....Y.;h.:..D..?..:t../[._UQ.J.<.P.-......^..O..h.....=..l....[c.c.....A...........H..'p6...Nc`....B`.l....[z..<J..D.>.w..6.=Xd.x.E.f../.....]....\|..eD'1r.*..V..T...kj..t..tM....u...`~..B.Fb.}.O#.E....! ..`.Tb...H....9..%.;..........3.B.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\DE467484.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1486
Entropy (8bit):	7.798966001027529
Encrypted:	false
SSDEEP:
MD5:	3EFE9AAE287A69A9B381EBBB028E7810
SHA1:	2A3C7A282DBCF85D6791DF54DF4829DF119DA4DC
SHA-256:	BF85ACD9EF1ADA1B2AD780D8E9E4FDD1A4ACD21842D3B5002E9BB371E4518E80
SHA-512:	64A35638E507CCA35501CEC70BB8F396F196B065125F9FE26AF7109195CA90AA4D5EE1840BC85FB383A5E0CD4CAFAB9D6EAA882DC3A4162A39518294A31AD163
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.............pHYs..,J..,J.wztM...3PLTEGpL#. #. #. #. #. #. #. #. #. #. #. #. #. #. #. #. .zw.....tRNS.. .@.`....0P..p.=.J...%IDATh..[..(.5.b..._;.5i.E.....T'.....mS..-..#N..+.a..U\|.....cp.@.'..W../.U.(.^.,S.(.F.]...C..........O..>~Bgk..........V...M.(....pK......p.I..c.lP.=..Ag.w._.C...$,pHj..S.D4~N&S...1.L.>"..lE,.......p?...w<.G...3CN....Z..%.~I..<P!...b\.v9n.......D5An8.. ..1{.......C...b b..A..e..v....Uk..\.[...,...1.w...%r.$..ov...c..~..Z.......A.@.E.......;.=.{.C...Y...uy.K..(....y.YB..PY...'j7......e......w.NxS..Hb5.7v..~.R]K.y.....[.Y.:..p.R.PJ..r....x..h...T..^..?..K.....b......Y.p...~...:3..!.Z5c.%.F.9.Z9..d;...V.-...:.oq,....Z.(.h..a..?.h..1.bz....1X4.lR.e...&I(..k...$..\.M......x......O"..)`....Nu.MP3..l.9X.X^.bp.....o......_..p.8t..,......<m....76....;.....,c.....7p..3.qK'..p..Dv}`...v../.bx...0..n.......,)..@.m=..u...7...y>s..lL.;.l.M..+zG.I.l.$..?..&...#l7.....3.3..\..la>...RY.8R.H......f.6..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F609E810.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 96 x 96, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	558
Entropy (8bit):	7.123275457405295
Encrypted:	false
SSDEEP:
MD5:	D9DCA1CAC67A8515C5E7572528BDD5A2
SHA1:	E758AF30B557F3E6DC91FCF3F114725BE898B4F4
SHA-256:	D03539CC6A66D43CFD2347316E7F93720B2D0D9228836EAA86726D87A5113D90
SHA-512:	1AF4329F527D2F0B01CD0C18AA614E439EF4B0A5ABC69658A6B04F7236F3CFE769E9C0E79C100C3C6AD721456D791E9BCC502F7EF84225A76BD84F9A79BC3F11
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...`......F..... cHRM..z&..............u0...`..:....p..Q<...iPLTE...#. .:z.:z.:z.:z.:z.:z.:z.:z.:z.:ze2`....................k..R....:z..w..F.................^....n.......tRNS.f/?o......_...R.....bKGD....H....IDATh....n.@..`Z.M..n.F.....R...4....n..h...%.I.5.$.....!@....h................o.!.....n....Y....?.V.......lN.........+u....\|..Z.7._.~;. . ..2..\|..z....gh@....]...}ue1-2.#A...U.....n..; J.B..\ ..w........2..P..h..f..I.m.c.......r.rG .%O......lQ..l..8.....0D.<....Q.0G{b.A.p..X`@.....W-....hT4.."D]....IEND.B`.

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:
MD5:	DC5367560160634BE77013ACFFA6A35F
SHA1:	1D0D2C32BE7EE5D332EA31AA17A21219ACB6599D
SHA-256:	C405D2D40F1311038478C5F3563EF39F5640BA6CA31F3CE835FB94D252D90189
SHA-512:	514A6A0156015B2C6CA8D5914CB4FC0731D888CEE1D41E1B03FFA76CFCCE2B1D339249276FAC8F095AF184A76A17CC28DCB421211002A81C3201E9FDECE1D3D1
Malicious:	false
Reputation:	unknown
Preview:	.... .........................

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	14
Entropy (8bit):	2.699513850319966
Encrypted:	false
SSDEEP:
MD5:	C5A12EA2F9C2D2A79155C1BC161C350C
SHA1:	75004B4B6C6C4EE37BE7C3FD7EE4AF4A531A1B1A
SHA-256:	61EC0DAA23CBC92167446DADEFB919D86E592A31EBBD0AB56E64148EBF82152D
SHA-512:	B3D5AF7C4A9CB09D27F0522671503654D06891740C36D3089BB5CB21E46AB235B0FA3DC2585A383B9F89F5C6DAE78F49F72B0AD58E6862DE39F440C4D6FF460B
Malicious:	false
Reputation:	unknown
Preview:	..c.a.l.i.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 05:31:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9895893432960623
Encrypted:	false
SSDEEP:
MD5:	5855E56826AC49BE4B02C79321A14093
SHA1:	304299061000DA7835F35993A7770C45A61E26DC
SHA-256:	B6C4CDB5245847D54DF44923F9CD19E517C984CFFE258C833D6A963998128FAB
SHA-512:	7850645FE377AF42445057720ABF6360CFB37FFEAB71E62BC5F8A509F9E259BF4BF7FA6B03A1C33738A359D9804BA87FDE1FA9F472BCEEA4600A82A42B34CD49
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....$^v.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAY.3....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY.3....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY.3....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY.3..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.3...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 05:31:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.003404622675578
Encrypted:	false
SSDEEP:
MD5:	ED9CBE6CC79E0939673D99165E3A9C75
SHA1:	5CFBED51EFA5C371B28DF7B4CDCD64BCD01EB2C6
SHA-256:	501AB6B1477ED4A07172AEF7630B5A101847F84025C7DFCC72248937F2E4AA6B
SHA-512:	BBC1E7350B2A8DD3D21C958C2B5CF9481A718338B04D42CB935CD6F9C77325CE38182A0DEEB6B8FCE2EE5672B2DAFED014DF6B680FFD25174FF8743BE097DA8C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....(j.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAY.3....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY.3....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY.3....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY.3..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.3...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.011549250253597
Encrypted:	false
SSDEEP:
MD5:	7ABFD4988BBCF61AE4C5C7F1E7FEBAEE
SHA1:	1D02C6745357697C6B26DFB5D76E352F35C76E9F
SHA-256:	48A4B5B840AF15DE0E6AC05668074ADBECF0838FDC03BC4621DBF37B30A37D02
SHA-512:	DEEF5DD1D2FE3D690ED3026C0F9B5524A5C07795DB1825B0E418B00DA9EC407CA0F8CCB3C5DB385EDA3F3883531F1DB4C393F22B5A68830593DE2069F7B279A0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAY.3....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY.3....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY.3....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY.3..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 05:31:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.002022670410052
Encrypted:	false
SSDEEP:
MD5:	B849061AC9C83E3E7153F391A7851B2C
SHA1:	B71E08726BF615B78C0B64EF47C3947B619088E6
SHA-256:	0D1201E3B948107310E49B16BB94A8430D2A74D569978107855923D05887C780
SHA-512:	6A84EA87275084F16D43CB817C2F2C43199E3BB93C7FFC0FE6E55B8A48E4194F357B03A0FE29876203AAF8FEA0286C5A3EA8DBB5C1D7B7D98F9831BB2515F166
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......d.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAY.3....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY.3....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY.3....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY.3..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.3...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 05:31:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.991304219807948
Encrypted:	false
SSDEEP:
MD5:	2E230CF6E8E72919855597824E670312
SHA1:	66312801B3ECA151F5443BA5A477A103A6033CCF
SHA-256:	4C852E382C61025530F6EDCEA10D7179CD711B09E946297E2EA47F97FB2FE915
SHA-512:	DA6D06BA6B64DD1C9356D3AFE7EA4CFEC5C569EF4F91B4852DBC897A28D739FE8E8719E20315260803C4CA7AD0E3C0C17CA0E82AABAAE6843E615EDD346D7978
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......p.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAY.3....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY.3....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY.3....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY.3..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.3...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 05:31:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.000066883890954
Encrypted:	false
SSDEEP:
MD5:	FAE25B9DA24A256BCB4398FE6CCC7410
SHA1:	EA2E20B8361B887C7D93AF3B673BD08E9CE1C65D
SHA-256:	CF7868B77C97FA2B286F801405196AEBDB591A876F20D9F00B08AF289423151D
SHA-512:	9BCEA21AB8A73A046CEEA761360D419D675B30F5AC983CF8B60649103CE1C1CBCEF29CB728EC7B053656F7C79717F27592FF2C1C58EC1C0842DD349EE569E3A6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....4[.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAY.3....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY.3....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY.3....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY.3..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.3...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

General

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	5.777942541730954
TrID:	Outlook Message (71009/1) 50.89% Outlook Form Template (41509/1) 29.75% Microsoft Word document (old ver.) (19008/1) 13.62% Generic OLE2 / Multistream Compound File (8008/1) 5.74%
File name:	FW_ Olivia McGahen shared _GAIR LEGAL_ with you.msg
File size:	334'848 bytes
MD5:	b64d7dab50e885bdef5eed4eb6245b16
SHA1:	e40a0008ffaab573d052fbb0888d1d8c60a4cc42
SHA256:	52067b9e17aa0d260fcb3621c1bf11ed0ddff36914cefccb9669d1d3d05e4af8
SHA512:	5fc3a18f68c20ba32f0da14334cb16c6adfbb0180c8bd8d98627cca209a1fb35cfe09fe4fe6abd33212e923f87c23430106895b132db3655b69e3f5f198b7224
SSDEEP:	3072:E7iwE53i5ksW3ZZBeFN00QT2l9tbBkBX7NoXnNXw3KELKrXEig5IQM:S5gZmF4X7W9XAGr0iAIQM
TLSH:	7A64F92076E51609F37B8F754BE3909B8526FC82AE21DA9F719D370E0B725809851B3F
File Content Preview:	........................>.......................................................w..............................................................................................................................................................................

Static Mail

General

Subject:	FW: Olivia McGahen shared "GAIR LEGAL" with you
From:	"Gray, Claire" <claire.gray@icare.nsw.gov.au>
To:	Phishing Alert <phishingalert@icare.nsw.gov.au>
Cc:
BCC:
Date:	Fri, 27 Sep 2024 05:24:12 +0200
Communications:	OFFICIAL [cid:image001.png@01DB10E0.89D26F70]<https://www.icare.nsw.gov.au/> Claire Gray Senior Claims Specialist Claims Support Service [cid:image002.png@01DB10E0.89D26F70] 1800 221 960 \|1300 013 960 [cid:image003.png@01DB10E0.89D26F70] Locked Bag 2906, Lisarow NSW 2250 [cid:image004.png@01DB10E0.89D26F70] icare.nsw.gov.au<https://www.icare.nsw.gov.au/> [cid:image005.png@01DB10E0.89D26F70]<https://www.facebook.com/icareNSW/> [cid:image006.png@01DB10E0.89D26F70]<https://twitter.com/icareNSW> [cid:image007.png@01DB10E0.89D26F70]<https://au.linkedin.com/company/insurance-and-care-nsw> [cid:image008.png@01DB10E0.89D26F70] icare is a flexible organisation, encouraging different ways of working. I have sent this message at a convenient time for me. I dont expect you to read or respond until a time thats convenient for you. OFFICIAL From: Olivia McGahen <Olivia.McGahen@gairlegal.com.au> Sent: Friday, September 27, 2024 10:51 AM To: Gray, Claire <claire.gray@icare.nsw.gov.au> Subject: Olivia McGahen shared "GAIR LEGAL" with you You don't often get email from olivia.mcgahen@gairlegal.com.au<mailto:olivia.mcgahen@gairlegal.com.au>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> [External Email] Do not click links or open attachments unless you trust the sender and know the content is safe. If in doubt, report as suspect email [Share image] Olivia McGahen shared a file with you Here's the document that Olivia McGahen shared with you. [icon]<https://gairlegalau-my.sharepoint.com/:o:/g/personal/olivia_mcgahen_gairlegal_com_au/EkfOV5ZnIZ5ItaQU3XBTsdoBEDG3LMTuHFdlMyMfe6BABQ?e=5%3aSZddJa&at=9> GAIR LEGAL <https://gairlegalau-my.sharepoint.com/:o:/g/personal/olivia_mcgahen_gairlegal_com_au/EkfOV5ZnIZ5ItaQU3XBTsdoBEDG3LMTuHFdlMyMfe6BABQ?e=5%3aSZddJa&at=9> [permission globe icon] This link only works for the direct recipients of this message. [Open]<https://gairlegalau-my.sharepoint.com/:o:/g/personal/olivia_mcgahen_gairlegal_com_au/EkfOV5ZnIZ5ItaQU3XBTsdoBEDG3LMTuHFdlMyMfe6BABQ?e=5%3aSZddJa&at=9> This email is generated through Gair Legal's use of Microsoft 365 and may contain content that is controlled by Gair Legal. [cid:image030549.jpg@59325B87.675C1810] Olivia McGahen Secretary Newcastle Office Suite 14, 123 Scott Street Newcastle 2300 T: +61 2 9916 9650<tel:+61%202%209916%209650> E: Olivia.McGahen@gairlegal.com.au<mailto:Olivia.McGahen@gairlegal.com.au> W: www.gairlegal.com.au<https://www.gairlegal.com.au/> [cid:image186652.jpg@E626ECD8.AEFC1686] [cid:image286916.jpg@72A30AF9.3DD02691] [cid:image948105.jpg@9877C241.4D6C8121] This e-mail message and any attachments could contain information that is confidential or privileged. If you receive this email by mistake, please notify us and do not make any use of the email or attachments. We do not waive any privilege, confidentiality or copyright associated with the email. Liability limited by a scheme approved under Professional Standards Legislation. All legal practitioners employed by Gair Legal Pty Limited (including partners) are members of the scheme. Gair Legal Pty Limited is a corporation not a partnership.
Attachments:	AttachedImage AttachedImage AttachedImage image030549.jpg image186652.jpg image286916.jpg image948105.jpg image001.png image002.png image003.png image004.png image005.png image006.png image007.png image008.png image009.png

Headers

Key	Value
Received	from SY7PR01MB8077.ausprd01.prod.outlook.com
03	24:12 +0000
Authentication-Results	dkim=none (message not signed)
by SYBPR01MB6511.ausprd01.prod.outlook.com (2603	10c6:10:11f::8) with
2024 03	24:13 +0000
([fe80	:381e:9b01:a595:f0aa%7]) with mapi id 15.20.8026.005; Fri, 27 Sep 2024
Content-Type	application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding	binary
From	"Gray, Claire" <claire.gray@icare.nsw.gov.au>
To	Phishing Alert <phishingalert@icare.nsw.gov.au>
Subject	FW: Olivia McGahen shared "GAIR LEGAL" with you
Thread-Topic	Olivia McGahen shared "GAIR LEGAL" with you
Thread-Index	AQHbEHdP4vATL9S3gkC9HFhmtzhQ6LJq+GGA
Date	Fri, 27 Sep 2024 03:24:12 +0000
Message-ID	<SY7PR01MB807784D3A83E16F2615255829B6B2@SY7PR01MB8077.ausprd01.prod.outlook.com>
References	<Share-9f3154a1-103e-3000-d65d-ddcf62cfc433,9f3154a1-103e-3000-d65d-ddcf62cfc433-edc90472-27f2-4aa1-80f3-739537f78909-6d09e9d9-8127-4bd3-bbf5-d495965ee1a9-DispatchToRecipients-PreprocessPayload-r0-SendEmail@odspnotify>
In-Reply-To	<Share-9f3154a1-103e-3000-d65d-ddcf62cfc433,9f3154a1-103e-3000-d65d-ddcf62cfc433-edc90472-27f2-4aa1-80f3-739537f78909-6d09e9d9-8127-4bd3-bbf5-d495965ee1a9-DispatchToRecipients-PreprocessPayload-r0-SendEmail@odspnotify>
Accept-Language	en-AU, en-US
Content-Language	en-US
X-MS-Has-Attach	yes
X-MS-Exchange-Organization-SCL	-1
X-MS-TNEF-Correlator	<SY7PR01MB807784D3A83E16F2615255829B6B2@SY7PR01MB8077.ausprd01.prod.outlook.com>
msip_labels	MSIP_Label_bb9b66d2-3d65-440a-b8f5-ec17a745f5ea_ActionId=6eaa3717-f621-4371-b069-916709ff6173;MSIP_Label_bb9b66d2-3d65-440a-b8f5-ec17a745f5ea_ContentBits=0;MSIP_Label_bb9b66d2-3d65-440a-b8f5-ec17a745f5ea_Enabled=true;MSIP_Label_bb9b66d2-3d65-440a-b8f5-ec17a745f5ea_Method=Standard;MSIP_Label_bb9b66d2-3d65-440a-b8f5-ec17a745f5ea_Name=OFFICIAL;MSIP_Label_bb9b66d2-3d65-440a-b8f5-ec17a745f5ea_SetDate=2024-09-27T03:23:44Z;MSIP_Label_bb9b66d2-3d65-440a-b8f5-ec17a745f5ea_SiteId=34ae0514-4eb5-4608-8b64-b002d2054238;
MIME-Version	1.0
X-MS-Exchange-Organization-MessageDirectionality	Originating
X-MS-Exchange-Organization-AuthSource	SY7PR01MB8077.ausprd01.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Internal
X-MS-Exchange-Organization-AuthMechanism	04
X-MS-Exchange-Organization-Network-Message-Id	353eccc5-4a97-4726-634c-08dcdea3dbc1
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	SY7PR01MB8077:EE_\|SYBPR01MB6511:EE_\|ME2PR01MB5428:EE_
Return-Path	claire.gray@icare.nsw.gov.au
X-MS-Exchange-Organization-ExpirationStartTime	27 Sep 2024 03:24:13.0760
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Office365-Filtering-Correlation-Id	353eccc5-4a97-4726-634c-08dcdea3dbc1
X-MS-Exchange-AtpMessageProperties	SA
X-Protective-Marking	UNCLASSIFIED
X-MS-Exchange-Organization-BypassFocusedInbox	true
X-Microsoft-Antispam	BCL:0;ARA:13230040\|69100299015\|366016\|41050700001;
X-Forefront-Antispam-Report	CIP:255.255.255.255;CTRY:;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SKI;H:SY7PR01MB8077.ausprd01.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(69100299015)(366016)(41050700001);DIR:INT;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	27 Sep 2024 03:24:12.7131
X-MS-Exchange-CrossTenant-FromEntityHeader	Hosted
X-MS-Exchange-CrossTenant-Id	34ae0514-4eb5-4608-8b64-b002d2054238
X-MS-Exchange-CrossTenant-AuthSource	SY7PR01MB8077.ausprd01.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Internal
X-MS-Exchange-CrossTenant-Network-Message-Id	353eccc5-4a97-4726-634c-08dcdea3dbc1
X-MS-Exchange-CrossTenant-MailboxType	HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName	7pc+lqtN1I6SdqQJd5aTnGCX24CpZUS8FyhrLwZsMmZhWXS8BUdzSsfVlOyxzPzzQLxQvBaZd/i7b773L5UbpXlOJeAf8TuzCJiDJAajHFA=
X-MS-Exchange-Transport-CrossTenantHeadersStamped	SYBPR01MB6511
X-MS-Exchange-Transport-EndToEndLatency	00:00:03.3315488
X-MS-Exchange-Processed-By-BccFoldering	15.20.8026.005
X-Microsoft-Antispam-Mailbox-Delivery	dwl:1;ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(831239)(252001)(410001)(930097)(140003);
X-Microsoft-Antispam-Message-Info	=?us-ascii?Q?zahLCkJcZ/UFMfUdni60ldyf4bhJlS50CvwVt68tD2Uow3E5zw1XyPlbuUmq?=
date	Fri, 27 Sep 2024 05:24:12 +0200

File Icon


Icon Hash:	c4e1928eacb280a2

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FW_ Olivia McGahen shared _GAIR LEGAL_ with you.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1212F459.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\130A90CA.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1A8728D1.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\29E217D3.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\2F89589E.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\30E4B0CF.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\50F3D643.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\522DAE5C.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5502DE86.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\66C682AD.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\675BC132.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\899447B8.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\AC84BB8B.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BCE482B5.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\DE467484.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F609E810.dat

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

General

Static Mail

Windows Analysis Report
FW_ Olivia McGahen shared _GAIR LEGAL_ with you.msg