Windows Analysis Report
QUOTE 452362.eml

Overview

General Information

Sample name:	QUOTE 452362.eml
Analysis ID:	1530787
MD5:	c5da031682d07545611f4336226a24cf
SHA1:	ed3e66f0f96f0efffcff680c9279a3865a0f0745
SHA256:	23b733192fc8d50db460b5e20058bfde80c709ec8a978566905bf7644ec20a67
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Signatures

Source: https://campaign-statistics.com/link_click/epjJDQ-oZ7P8Dz-3Dc7Cq/b026cc61e40b597ae3518c0b47e7793d

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49743 version: TLS 1.2

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 172.66.40.88 172.66.40.88
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 104.22.74.115 104.22.74.115
Source: Joe Sandbox View	IP Address: 172.66.43.168 172.66.43.168

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=42ycGH7ZShD68cc&MD=fKTz3ubA HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /link_click/epjJDQ-oZ7P8Dz-3Dc7Cq/b026cc61e40b597ae3518c0b47e7793d HTTP/1.1Host: campaign-statistics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/styles.css HTTP/1.1Host: stats.sender.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://campaign-statistics.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/suisseintl-regular-webxl.woff2 HTTP/1.1Host: stats.sender.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://campaign-statistics.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://campaign-statistics.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fonts/suisseintl-semibold-webxl.woff2 HTTP/1.1Host: stats.sender.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://campaign-statistics.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://campaign-statistics.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/sender-logo-coloured.svg HTTP/1.1Host: stats.sender.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://campaign-statistics.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/vectors/vector-group.svg HTTP/1.1Host: stats.sender.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://campaign-statistics.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/vectors/vector-group-2.svg HTTP/1.1Host: stats.sender.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://campaign-statistics.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/compressed/error-occurred.webp HTTP/1.1Host: stats.sender.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://campaign-statistics.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/vectors/vector-group.svg HTTP/1.1Host: stats.sender.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/sender-logo-coloured.svg HTTP/1.1Host: stats.sender.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/vectors/vector-group-2.svg HTTP/1.1Host: stats.sender.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/compressed/error-occurred.webp HTTP/1.1Host: stats.sender.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: campaign-statistics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://campaign-statistics.com/link_click/epjJDQ-oZ7P8Dz-3Dc7Cq/b026cc61e40b597ae3518c0b47e7793dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: campaign-statistics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=42ycGH7ZShD68cc&MD=fKTz3ubA HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /link_click/epjJDQ-oZ7P8Dz-3Dc7Cq/b026cc61e40b597ae3518c0b47e7793d HTTP/1.1Host: campaign-statistics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: campaign-statistics.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: stats.sender.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 12:42:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeaccess-control-allow-origin: access-control-allow-methods: access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Typecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ryLni%2FihghpUFyWWmrK8R20k4ZOap7WmDZZVTwX2G%2BAFflqdgJNYjt2nHSEjLOJoETO6JVAhj6fKUCfAPwL7i2xC3Xsyc7HurtZEt4RsOS%2Fcmt6GqclfRxO%2F9GpvBsCwSzbxztgZn37NrA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8d06b0be7a8542e6-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Oct 2024 12:42:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeaccess-control-allow-origin: access-control-allow-methods: access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Typecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dm3UpvNCihDfek4HUDrbsbZlEbX4TY6f8fQoBP%2Bqehf5B0lO%2FNniudYDltzy8MPWIN7tU0s1XI42Zgpmzx5fWGKs%2FICaADwDl0JDbcy4L9tPopXTqKHrHJEZBARuYMKMKgN6c5%2BR2rjLCA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8d06b146f9c842e9-EWRalt-svc: h3=":443"; ma=86400

Source: ~WRS{06449F0E-441D-4BD5-8997-03F32AA50A48}.tmp.0.dr	String found in binary or memory: http://www.bridge-care.co.uk/
Source: ~WRS{06449F0E-441D-4BD5-8997-03F32AA50A48}.tmp.0.dr	String found in binary or memory: https://campaign-statistics.com/link_click/epjJDQ-oZ7P8Dz-3Dc7Cq/b026cc61e40b597ae3518c0b47e7793d
Source: ~WRS{06449F0E-441D-4BD5-8997-03F32AA50A48}.tmp.0.dr	String found in binary or memory: https://pub.lucidpress.com/50f1c535-8058-4eec-b469-2bd69fae4557/
Source: chromecache_81.12.dr	String found in binary or memory: https://stats.sender.net/css/styles.css
Source: chromecache_81.12.dr	String found in binary or memory: https://stats.sender.net/fonts/suisseintl-regular-webxl.woff2
Source: chromecache_81.12.dr	String found in binary or memory: https://stats.sender.net/fonts/suisseintl-semibold-webxl.woff2
Source: chromecache_81.12.dr	String found in binary or memory: https://stats.sender.net/img/compressed/error-occurred
Source: chromecache_81.12.dr	String found in binary or memory: https://stats.sender.net/img/compressed/error-occurred.png
Source: chromecache_81.12.dr	String found in binary or memory: https://stats.sender.net/img/compressed/error-occurred.webp
Source: chromecache_81.12.dr	String found in binary or memory: https://stats.sender.net/img/sender-logo-coloured.svg
Source: chromecache_81.12.dr	String found in binary or memory: https://stats.sender.net/img/vectors/vector-group-2.svg
Source: chromecache_81.12.dr	String found in binary or memory: https://stats.sender.net/img/vectors/vector-group.svg
Source: chromecache_81.12.dr	String found in binary or memory: https://www.sender.net/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49743 version: TLS 1.2

Source: classification engine

Classification label: clean2.winEML@24/45@12/7

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\QUOTE 452362.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "E7D18160-CC43-4C8E-B574-ADC7AAB96AD4" "7188BDE5-66D5-491E-AE9C-E48C4525983E" "6712" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://campaign-statistics.com/link_click/epjJDQ-oZ7P8Dz-3Dc7Cq/b026cc61e40b597ae3518c0b47e7793d
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1940,i,7224633850826834353,5271304985398107482,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://campaign-statistics.com/link_click/epjJDQ-oZ7P8Dz-3Dc7Cq/b026cc61e40b597ae3518c0b47e7793d
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1948,i,9948224342545650432,7023359487037002687,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "E7D18160-CC43-4C8E-B574-ADC7AAB96AD4" "7188BDE5-66D5-491E-AE9C-E48C4525983E" "6712" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://campaign-statistics.com/link_click/epjJDQ-oZ7P8Dz-3Dc7Cq/b026cc61e40b597ae3518c0b47e7793d	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://campaign-statistics.com/link_click/epjJDQ-oZ7P8Dz-3Dc7Cq/b026cc61e40b597ae3518c0b47e7793d	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1940,i,7224633850826834353,5271304985398107482,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1948,i,9948224342545650432,7023359487037002687,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: Google Drive.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

IP	Domain	Country	ASN	ASN Name	Malicious
172.66.40.88	campaign-statistics.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.22.74.115	stats.sender.net	United States	13335	CLOUDFLARENETUS	false
172.66.43.168	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Name	IP	Active
a.nel.cloudflare.com	35.190.80.1	true
stats.sender.net	104.22.74.115	true
campaign-statistics.com	172.66.40.88	true
www.google.com	142.250.186.132	true

Name	Malicious	Reputation
https://stats.sender.net/img/compressed/error-occurred.webp	false	unknown
https://stats.sender.net/img/vectors/vector-group.svg	false	unknown
https://stats.sender.net/fonts/suisseintl-semibold-webxl.woff2	false	unknown
https://campaign-statistics.com/favicon.ico	false	unknown
https://campaign-statistics.com/link_click/epjJDQ-oZ7P8Dz-3Dc7Cq/b026cc61e40b597ae3518c0b47e7793d	false	unknown
https://a.nel.cloudflare.com/report/v4?s=Dm3UpvNCihDfek4HUDrbsbZlEbX4TY6f8fQoBP%2Bqehf5B0lO%2FNniudYDltzy8MPWIN7tU0s1XI42Zgpmzx5fWGKs%2FICaADwDl0JDbcy4L9tPopXTqKHrHJEZBARuYMKMKgN6c5%2BR2rjLCA%3D%3D	false	unknown
https://stats.sender.net/css/styles.css	false	unknown
https://a.nel.cloudflare.com/report/v4?s=ryLni%2FihghpUFyWWmrK8R20k4ZOap7WmDZZVTwX2G%2BAFflqdgJNYjt2nHSEjLOJoETO6JVAhj6fKUCfAPwL7i2xC3Xsyc7HurtZEt4RsOS%2Fcmt6GqclfRxO%2F9GpvBsCwSzbxztgZn37NrA%3D%3D	false	unknown
https://stats.sender.net/img/sender-logo-coloured.svg	false	unknown
https://stats.sender.net/img/vectors/vector-group-2.svg	false	unknown
https://stats.sender.net/fonts/suisseintl-regular-webxl.woff2	false	unknown

ID:	1530787
Product:	CloudBasic
Start time:	14:40:48
Start date:	10.10.2024
Sample:	QUOTE 452362.eml
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	c5da031682d07545611f4336226a24cf
SHA1:	ed3e66f0f96f0efffcff680c9279a3865a0f0745
SHA256:	23b733192fc8d50db460b5e20058bfde80c709ec8a978566905bf7644ec20a67

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT	data	4D0755D56E2C74A1F4EA30FC69F39CA1	EC5E37E8B9A662BB05E06BA5534D11CB9730A3B8	6EE06485DB5B29F2642009429FF0FFAFEA84CAFA6978F04851DE7402E04083FA
C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json	JSON data	C37972CBD8748E2CA6DA205839B16444	9834B46ACF560146DD7EE9086DB6019FBAC13B4E	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365	4296A064B917926682E7EED650D4A745	3953A6AA9100F652A6CA533C2E05895E52343718	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin	ASCII text, with very long lines (65536), with no line terminators	CC90D669144261B198DEAD45AA266572	EF164048A8BC8BD3A015CF63E78BDAC720071305	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin	ASCII text, with no line terminators	D9673107D7F1613A9FDF0C4AA38526BE	E63B9A9F210070FEBBB65715DDA0A574AF9F4B81	BB0F85CF4087079E14224D6593CD9CCCACC9F9DC4F8BEEC56BCAD24053030DD9
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db	SQLite 3.x database, last written using SQLite version 3034001, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2	D0DE7DB24F7B0C0FE636B34E253F1562	6EF2957FDEDDC3EB84974F136C22E39553287B80	B6DC74E4A39FFA38ED8C93D58AADEB7E7A0674DAC1152AF413E9DA7313ADE6ED
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal	SQLite Rollback Journal	30234BF40C378CCE2C49A6D2254BC772	7291B9A78872D78C3C223C436CAD8C20F082EA1D	EAD97EC27E700B263835823856225994C822F83B861344023BFBB8F17D2BFA21
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm	data	E7BD639A6E9C15818E68F26C996CEC63	6E37495144174E4EB0CB82FA96B82B7B0E77092E	7C56C0D99D5D2BA4420070316F8B92FBA3354EC7608A79A1314A46DAB3B25BA0
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal	SQLite Write-Ahead Log, version 3007000	E49BB193AFF4ECE82B29F2B8F5049BD8	E5D0F97249CAB866829C66062F231CB3BC83FCB3	F38F747259D57C168E481FFE62A19FBF709EB66630FE318AC83D1817F1688A6B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\9D6CBD1A.dat	PNG image data, 423 x 97, 8-bit/color RGBA, non-interlaced	82C4F9B1EE2532CED9218A8230B02ACE	65C57B72D3ABC2F9196338595A3986385A77ACA2	82CF0D93349DEC7A1899136888925544F69AF7DB9085BC7AB2078E303A94C1BB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C967F653.dat	PNG image data, 346 x 117, 8-bit/color RGBA, non-interlaced	277DF12FC4595F71C1547C102D35500C	787606F044CD88BE8FEA2836F0FE75604D104694	C45D845122D50A0EEBFA433B088D10B45FE61B3E932524B78D81D678D49F268E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{06449F0E-441D-4BD5-8997-03F32AA50A48}.tmp	data	6154FB6D8E89B9D2E502E657F5B5795D	AD557F3C6CC5F05AAEDA9CF65620AA30CE5094F8	20F393E0C44EA0291D71C6A66EC0268E66939207E06A9C3528F70C9CFF8659A2
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728564113853210200_38D7F205-5C57-48A1-8959-C4195BE2998A.log	ASCII text, with very long lines (28757), with CRLF line terminators	740D2641B6F7B9424B0BED08246FA86B	E945017E5689AD230D00CD991E540E3594839261	123DFC78CECD22382A9C14B97CCC62A1FF94A27414DB36261DD2128C8189935B
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728564113854207800_38D7F205-5C57-48A1-8959-C4195BE2998A.log	data	8F4E33F3DC3E414FF94E5FB6905CBA8C	9674344C90C2F0646F0B78026E127C9B86E3AD77	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241010T0841530636-6712.etl	data	A77BCD0952ED7AB336E5A75D0F4B9862	DFFF88EC65513BA103CD2EFAC47EA9A967AEA187	FC4AA44DFD5E3DF096569EADB8276C10364152DD87886C5179C268DFE0B3F203
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl	data	7CB3C0545ACE82BE690BF80C90EB3944	00A1DB877D74CD3AE6CCD13A36E78F496EC92CC0	4E252094343A7D06FAE0011139C5C0C400DBFA46C2A2827D84839A281556EEF9
C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs	Composite Document File V2 Document, Cannot read section info	112CCF629ACC9E2F5C1146002FF0DA5A	0A12C8D34131D22A3235149CC00245A7FBBCB405	BCFA3D7BDFB7BB35044330ED98A75BF84D7F4805A9889463ECC8FC22851B31BE
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 11:42:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6FE7E256168149A3F8A88A2AFD86BA39	4BB7A76081182D5D02FFD09230BC66ACB71FEA40	854F944BCC51E10103A61AD1D2312E41B4FE4BE6BCF51E998025C36C95A1A875
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 11:42:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	0334B2F7154670788BE609D3E502C7D1	D610CF3F4B62EA37D06C67239EA4155B32BE108B	F2B2C4698637ABF70996EA160546375C2C6919D7F06B4A377E9D757C71C137BF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	0CF24C771B24D110DE33956A87B4D3A6	011991FD5A8F30C2D20B3458660E21E72A1426A1	915715DA00A586587CF7370410D391FEA485C8F85DBAB5E4B241E7D2C1A66AB2
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 11:42:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E9B82A0C5260EDD1791EB14E5E8CF953	477CB7AC33D26C351CB0CEC4BC985A2C1D81AC20	23D6AA4F841285D2100492E9F999DE619C63E328491736BFA2FA93D42F72FFEC
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 11:42:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	F9C91B99B5E0C7891707E65B74673330	490398A0FE174346870509F5435929B7CBD591F8	AA571DDC8E8AA1B3AEDE0BC9BB898FE124A368AE76A13FDD18FB8AE2D073AC97
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 11:42:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A17B7DBA552B6C2DC56EFF842295EDF9	88EBCC5A85BD419EAF5A071924192BD73B072B2C	1622182C12255E96617D75EB0950C3C008EEFB14FFEDEE129B074D5DD9830D94
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst	Microsoft Outlook email folder (>=2003)	1398D1D08AC596BD8C3F98FFAAB2E25A	180451E2833AA1E6A5D739BD02834A9487AB689E	99EA717AD792956722F751B82A025ED3217B949E7BA9623E9A139A9255D6441C
C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp	data	48E9DAB873B5D02BB24626076586C877	704B796022FF17CD20FC8A73D3899B56E1620CAF	6E62C526C0482E7F816AC372FBFD30DCA4D382E131B6FCD084C0DE1D170A498E
Chrome Cache Entry: 73	SVG Scalable Vector Graphics image	6AFB13186E9A763923D81539AC40DFD5	C60F20D279378ED3DA708B6B6BD501A1A8254BAE	3888AB1A5C21B5177EF0C6D4F879C7BC9539C772F134FED8766E0E8B1FE8FACF
Chrome Cache Entry: 74	SVG Scalable Vector Graphics image	7DFEED736D6A66B947A8D7DD6E776EB2	D44FBB142B9943F5732E372BACC8E12225857732	E56E9E257859DE5DE4DF546FA0F47526CE55B72BF4B12EE2AAFF44D3A63A2A18
Chrome Cache Entry: 75	RIFF (little-endian) data, Web/P image	45299E83AE30B9807C5C8C9EC5642D3B	84D8A2FD843BA0C566829BB3113460353A98307C	92E68E3B34A4FBA6DFF4054C841ECE330A0D7C97A5C29DF46A70292C60FC08A6
Chrome Cache Entry: 76	SVG Scalable Vector Graphics image	6AFB13186E9A763923D81539AC40DFD5	C60F20D279378ED3DA708B6B6BD501A1A8254BAE	3888AB1A5C21B5177EF0C6D4F879C7BC9539C772F134FED8766E0E8B1FE8FACF
Chrome Cache Entry: 77	SVG Scalable Vector Graphics image	564A7F44F5912C58F688C788855B4EFE	40B37B80AE91ADE5982B691F8B42A3B8E3F3B3AC	1649AE705B570522F7AA00AAEE848BDEC024822C39B6D4C84E1CF4FFB48A6C06
Chrome Cache Entry: 78	Web Open Font Format (Version 2), TrueType, length 68956, version 2.32767	9C1ACA0D3F7E29E25A05B3799F3D14DC	6DA26EF84E51EA45022A9F25FAB790D9BC648CCF	4889BED9299840D1C7A2D663D0C90F4741991D5F70A290CCC636B84411FA5FDD
Chrome Cache Entry: 79	SVG Scalable Vector Graphics image	564A7F44F5912C58F688C788855B4EFE	40B37B80AE91ADE5982B691F8B42A3B8E3F3B3AC	1649AE705B570522F7AA00AAEE848BDEC024822C39B6D4C84E1CF4FFB48A6C06
Chrome Cache Entry: 80	SVG Scalable Vector Graphics image	7DFEED736D6A66B947A8D7DD6E776EB2	D44FBB142B9943F5732E372BACC8E12225857732	E56E9E257859DE5DE4DF546FA0F47526CE55B72BF4B12EE2AAFF44D3A63A2A18
Chrome Cache Entry: 81	HTML document, ASCII text	B466939C0189393CE047AC91FA448EDA	F051DEA42FF215555BE44BDF1AF20CD7947C440D	D927AA31D8F6C57AD03C05E3F8FB3B2B7B8BD52F195D1AA4906DF5E4C5A94FB5
Chrome Cache Entry: 82	RIFF (little-endian) data, Web/P image	45299E83AE30B9807C5C8C9EC5642D3B	84D8A2FD843BA0C566829BB3113460353A98307C	92E68E3B34A4FBA6DFF4054C841ECE330A0D7C97A5C29DF46A70292C60FC08A6
Chrome Cache Entry: 83	Web Open Font Format (Version 2), TrueType, length 68316, version 2.32767	B5C7CF1C74AA9B19421670F7E0986D67	540C72F2F67AB5247CD45AD2D2D9E5E388F8A854	595C9B95CC4D52B94A19987DC9F2E2743C4E74F140510B04A91A9602C6E5BDDF
Chrome Cache Entry: 84	assembler source, ASCII text	0021185F2B750FEE3930EA674E53FF8D	1ED183067471046904279D867F8358D09A0718FD	A9AF6CCC7986217BF89585732B962366ECF4AA4867866B4D37821B3566DFE46C

Windows Analysis Report QUOTE 452362.eml

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
QUOTE 452362.eml