Windows Analysis Report
Fw_ Complete with Docusign_ J929272_SOW Extension_002_09-OCT-24_201415.pdf.eml

Overview

General Information

Sample name:	Fw_ Complete with Docusign_ J929272_SOW Extension_002_09-OCT-24_201415.pdf.eml
Analysis ID:	1530942
MD5:	4e46610dcb7ece78f8c2123b95fa5e23
SHA1:	8ba69d84b2b311e3e9edc433f73e36a19e6fcb4c
SHA256:	e605ac00ac4839c0dfba0ad5eafe8a8c2cf0ca4b1ac3e273b0090d669de3a10b
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

Suspicious MSG / EML detected (based on various text indicators)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

Suspicious MSG / EML detected (based on various text indicators)

Source: MSG / EML

OCR Text: Can you please look at this? I asked Dr. Parsons to also report as suspicious. Thank you. Get Outlook for iOS From: Parsons MD, Gregory <gparsons@ceenta.com> Sent: Thursday, October 10, 2024 AM To: Woodall,Jeremie <jwoodall@ceenta.com> Subject: FW: Complete with Docusign: J929272 SOW Extension_002 09-OCT-24 201415.pdf Please help.l don't know anything about this issue and I am concerned it is fake email. Gregory S Parsons MD Otolaryngology t: 803-327-4000 | f: 803-328-1865 Charlotte Eye Ear Nose & Throat Associates, P.A. 200 South Herlong Ave Suite F Rock Hill SC 29732 From: DocuSign System <dse_na2@docusign.net> Sent: Thursday, October 10, 2024 9:43 AM To: Gill ScD, Jag <jgill@ceenta.com> Subject: Complete with Docusign: J929272 SOW Extension_002 09-OCT-24 201415.pdf External Sender I Exercise Caution Report Suspicious Verify the sender's identity BEFORE replying or opening attachments or links! docusign Lewis, Robert D sent you a document to review and sign. REVIEW DOCUMENT Lewis, Robert D robert.d.lewis@oracle.com This extends the expiration date of our NetSuite Planning and Budgeting implementation and there is no additional cost associated with it. Please let me know if you have any questions. Robert Lewis PM 817-897-2678

Source: unknown	HTTPS traffic detected: 23.60.203.209:443 -> 192.168.2.18:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.18:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.18:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.18:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.86.251.27:443 -> 192.168.2.18:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.18:49856 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63

Source: global traffic	DNS traffic detected: DNS query: nam11.safelinks.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: urldefense.com
Source: global traffic	DNS traffic detected: DNS query: na2.docusign.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: a.docusign.com
Source: global traffic	DNS traffic detected: DNS query: api.mixpanel.com
Source: global traffic	DNS traffic detected: DNS query: cdn.optimizely.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 23.60.203.209:443 -> 192.168.2.18:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.18:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.18:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.18:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.86.251.27:443 -> 192.168.2.18:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.18:49856 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.winEML@18/74@26/200

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241010T1200020369-6504.etl

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Fw_ Complete with Docusign_ J929272_SOW Extension_002_09-OCT-24_201415.pdf.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "E2281F03-DBD0-45BA-93C4-42734399A761" "B9A67480-8303-44DE-8058-9B3EB0AFE824" "6504" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "E2281F03-DBD0-45BA-93C4-42734399A761" "B9A67480-8303-44DE-8058-9B3EB0AFE824" "6504" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fna2.docusign.net%2FSigning%2FEmailStart.aspx%3Fa%3D423c3005-40e3-4f73-b01f-22c9db5b3def%26etti%3D24%26acct%3D038966a5-ff0e-476e-8a6b-74cff2dbb75d%26er%3D394d41b2-f386-4e71-a2b3-8177fba01463__%3B!!C8I-Dec!486hyGdic1hV2am9VfDJH5Ax3zwY0qv4ruelnV64xkz4xB5hLT894olBod_KeZbxsIbkdqirZCaLewk%24&data=05%7C02%7Ccgoolsby%40ceenta.com%7C0c2dd23699af4d34b13e08dce93351f7%7C97bf5e89559d4b3e997ec4ee27dbd4cf%7C1%7C0%7C638641653844817953%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=zaJtoIm3TinFFKZVAkfa85ottmo3ktA9hI4XaMqBzx0%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1932,i,5493115229194152307,3648905318716236932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fna2.docusign.net%2FSigning%2FEmailStart.aspx%3Fa%3D423c3005-40e3-4f73-b01f-22c9db5b3def%26etti%3D24%26acct%3D038966a5-ff0e-476e-8a6b-74cff2dbb75d%26er%3D394d41b2-f386-4e71-a2b3-8177fba01463__%3B!!C8I-Dec!486hyGdic1hV2am9VfDJH5Ax3zwY0qv4ruelnV64xkz4xB5hLT894olBod_KeZbxsIbkdqirZCaLewk%24&data=05%7C02%7Ccgoolsby%40ceenta.com%7C0c2dd23699af4d34b13e08dce93351f7%7C97bf5e89559d4b3e997ec4ee27dbd4cf%7C1%7C0%7C638641653844817953%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=zaJtoIm3TinFFKZVAkfa85ottmo3ktA9hI4XaMqBzx0%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1932,i,5493115229194152307,3648905318716236932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email	LLM: Page contains button: 'REVIEW DOCUMENT' Source: 'Email'
Source: Email	LLM: Email contains prominent button: 'review document'

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Queries the volume information (name, serial number etc) of a device

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
35.161.37.142	arya-1323461286.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
35.186.241.51	api.mixpanel.com	United States	15169	GOOGLEUS	false
104.18.66.57	cdn.optimizely.com	United States	13335	CLOUDFLARENETUS	false
162.248.185.182	unknown	United States	62856	DOCUS-6-PRODUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
162.248.185.183	unknown	United States	62856	DOCUS-6-PRODUS	false
54.201.17.39	unknown	United States	16509	AMAZON-02US	false
2.19.126.218	unknown	European Union	16625	AKAMAI-ASUS	false
104.47.58.156	nam11.safelinks.eop-tm2.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
64.233.167.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
2.19.126.140	unknown	European Union	16625	AKAMAI-ASUS	false
142.250.185.131	unknown	United States	15169	GOOGLEUS	false
172.217.23.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
52.204.90.22	urldefense.com	United States	14618	AMAZON-AESUS	false
51.116.253.168	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.42	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.18

Contacted Domains

Name	IP	Active
cdn.optimizely.com	104.18.66.57	true
nam11.safelinks.eop-tm2.outlook.com	104.47.58.156	true
urldefense.com	52.204.90.22	true
www.google.com	172.217.23.100	true
api.mixpanel.com	35.186.241.51	true
arya-1323461286.us-west-2.elb.amazonaws.com	35.161.37.142	true
nam11.safelinks.protection.outlook.com	unknown	unknown
a.docusign.com	unknown	unknown
docucdn-a.akamaihd.net	unknown	unknown
na2.docusign.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://na2.docusign.net/Signing/?ti=687025a17ea54551bfa5602a9e03a561	false		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT	data	384FA16F6B74049706B7F3C7A9A008D8	6CCC39D7A461B414E698A17291C5D205AC8F9E91	A1511A647AC6C3D31F6464DEA4D8837EA1149F0E76FF9732A2555785C7386666
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm	data	A11C0889F6C9F2051BB9D4A6C40492C1	58D5F450B26E19807F7DDDD41F9210C5F92F5DC7	F666DFD2E3FED59695A331E4E130762E65901A805A166FFC06060F962B5C1F56
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal	SQLite Write-Ahead Log, version 3007000	AC53169261C9D674B0D57EF035D8FB39	2D13A21C38C244A61136A6E4C8D1BD80C628261C	511E924BCC77A2DDEECBF93CDF42D5F32E295A6E6D29AEE553167007E707BC3E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{CD0ED681-5B48-46A2-B918-397AB52629A8}.tmp	data	E929D13FD849E9AE849BF049243BD29A	487E837643481E214804270DE6A0D553B62A6607	E75809F83983873511ABD47A2CCAA5A9ED277DA8F345B7396D1DE9614C9E08D3
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728576002588920900_71364968-CE07-4103-82E7-792B9BA0DE6E.log	ASCII text, with very long lines (28778), with CRLF line terminators	8C76DFF834147A3C9FB4B714A6462330	8E85FFBF372BFA7F6D4F7DC108D33FF2FA00B4B9	031BEB39A9CCC8AAD5268286CAE30865F4CF4AEBE39858A27B96671AED04D994
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1728576002589646400_71364968-CE07-4103-82E7-792B9BA0DE6E.log	data	8F4E33F3DC3E414FF94E5FB6905CBA8C	9674344C90C2F0646F0B78026E127C9B86E3AD77	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241010T1200020369-6504.etl	data	142A9B9ACC020DEF36367F8675A0198F	AB5C5C2F6CF2E213C773DA99375FDB31ADA58639	DC6D4C12AECFF0E19AC19E150FFF4A8F560FA2B1956607869DD52E17F1867839
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl	data	D44020404269C01B3919EE82C071FD5F	706D64E897A297D7592C01F22C99EFAEA07F7EF7	7C2ADDEB80E545BB76B31980065F4E9AF897A192992BF710F192378B205A386B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 15:00:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	B3DBF3AB520A8B5CC04E31C0E7086C95	5DDD52C75306B7D47E490AB4809A4E5A7081D6CC	AB87D217C6B0B80073D5C1CE6B49E7F9AC614C279E79A2CE53E09F293B05CEA9
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 15:00:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	20ED010B10C6203D83F4FF51D6D835A8	DCC6A16E8E50020FB034B5079850B32FC2A3A44F	685D6AA930CD0A21CD7BE7A8049608D68E1024BFE5BC5C5126FED2D1F4BBA415
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	B07D672C4910B2608FEC78054B67E2F6	4FBE49BF0260593A1AF60FE9531A607A7684C4B2	97F007CF1185DDD6F6E359871491B314E65F0481413236DED9E1C88ECB5A98D1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 15:00:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	42A1ADE827EA4A30C2725DBD7B751EE2	C5BCC984A1D5AD510C8F4182C0C89AF69F12DEAD	46FE8AE55AD104B25A75DF8EAE266262B365CD5A66CD534D7D8E245E6CE9B196
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 15:00:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	7A302ED7C9A326930964BFB00C4583B6	FCCDDBC844AFC276A8FE6CEB5ED9AEFD4FF71752	D3F8969508E8AFB7DE6A22ABA6AF546D3D85621877DEA1E10ADA11F857953E8D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 15:00:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	5BD1795D408E9E47958EA2EEB08354AD	6B8276013A1A7790CF95CA47B5AF91D75FD1A76E	A5DE485B7027A7A0284BE3FAFFC419FC1E27CF518662653C3C8F3750A5D8030D
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst	Microsoft Outlook email folder (>=2003)	B759C029A6A86E4BBE99C22D512DF76A	081A9DDE2A1B222EDA6EB47584832D45BECB858F	00BA608D9F69A0BD8AF0B7619DEA13CCBE950C718EE7290FC8D496090DD61821
C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp	data	BD4863515F16FB16A30CF5B490D7B261	95C76EE058C39CD7A9F6727DC71FB86DB950D825	A123B4AF9E88639F28BD97940A570CA5269C3308316D02C301AF021F848F046F
Chrome Cache Entry: 135	HTML document, ASCII text, with very long lines (65448)	16716E2811BC506DF86F81DC2E6189E5	C65F4A89DA8AE32000E007E8969935AE7C3774CD	10818E561AB3FBE76741883A033DED68EAC63F78FA9669B7925B4095F866F57B
Chrome Cache Entry: 140	ASCII text, with very long lines (65438)	C9A178E87EF9D67207B744DD8252556E	32A11476141AE8CC9E0881E56743DFA0DBC0843E	4298AB8A22EEDA2DEEEACBA50E9AB4E86696CEF95E639F4ACB8DA89C8187809E
Chrome Cache Entry: 141	ASCII text, with very long lines (37014)	22C262B6E67DB97DB3939E8E89842DC2	A329ECF6AD90155006F12F04DFC0DAA9E12B68A7	C801D71595A7D2897D9D5BFC9F9365299965A7440B22BFCEF54B7CE2871C8D16
Chrome Cache Entry: 145	Unicode text, UTF-8 text, with very long lines (13673)	F529E89C80657A21F4F052EF31389479	A6BA7AA6E586D062E67433AAF517A0A50B73154C	8BE50E593F1E4742B278E416DF2D97278F33813EBC6FBB3A5CB13191FFA6070F
Chrome Cache Entry: 147	ASCII text, with very long lines (27176)	6ADBF15138A29729F7C437E57CB29192	5A6D3F257A89E67B556A4B8B449769F6E8209ED6	625FAAC6CC2D0E6F4FB2D24763332E6B78782133CB7F9040E3BDE0A874D53AEF
Chrome Cache Entry: 148	Unicode text, UTF-8 text, with very long lines (30984)	48BC933608F733A9283F2218C73A941F	E04E625C70A5E8505B77A51D82D9A73AFA9F3547	FCBC395A3D24699D9229846A30C9FE245D77A7AFDBC8386838A03A837C6672AA
Chrome Cache Entry: 151	ASCII text, with no line terminators	84100B349395F367D41A8B44D0020355	676BB250F143F6C863C58C79B4CA1ABF7312DF00	5EAE3F71BE133111621E17FEE9DC04578D885A74EAF4D40AAC9634B7DB4B5459
Chrome Cache Entry: 152	Unicode text, UTF-8 text, with very long lines (63087)	8431C8559126D5327BEAEDE042D078E7	7BCF46919180A9718FE68EA351682A73F4170F2E	EB4BE71B5B17D5E5C573C02E91F3A5595D33C74A375A933CE5E730597DF83BAD
Chrome Cache Entry: 153	ASCII text, with very long lines (631), with no line terminators	6167F0AE726EE950E9AA8EAE00BCF56C	23DB6DD14D5E7C37E899D1BC27CCD41C672DA99A	C13945AEE5C41D1C015CF5E72BC8971D38C07BB3D313182E2ADB0E244857DA05
Chrome Cache Entry: 155	ASCII text, with very long lines (65448)	01E9D5FC8D10F2B4B5BE134D6ABE68D0	FDFB634A8A556BBB83D47ABEFE3A2703C1F44C1C	88F02BBD2635F80B72EF9F538B0FBD7D565F95118BEABDB9D529097ECCD75281
Chrome Cache Entry: 156	ASCII text, with very long lines (16718)	7E0A5ABCB31199770B38DD9A0F557491	D4719F356E6800A6F664BCE7B3DDF7715607E5A3	0EE7DF63AA74F1623D01D69A016D845FD9024854A2F034D229ADE68D801DE4AA
Chrome Cache Entry: 157	ASCII text, with very long lines (65448)	C3F69DF10A9CA0D22FE32C25432EB8B2	16E89ED49525F9C9274AD408D92DB61EB01A3280	1177EA5979591FC95B15359120A77AB44ED26CA0619B9B96838D3C7730ECB078
Chrome Cache Entry: 159	ASCII text, with very long lines (9667)	67EB698330BC24C39D51CE54687CBE19	864D423ED1CF0D6F3CF2DEF9D935DF7190094551	F5C08FB0F269E1D448373EFDB4F80474ED401EEADF6794416B20C55EFCC5AB01
Chrome Cache Entry: 160	SVG Scalable Vector Graphics image	6E132855B6DDD5C7A1FA7DAD2C9FE964	0342D3665682749F7C312B8B1EE6A169FA4C68C5	06DADA60F95EF29D2483D66D0412FF1EE698503F7E29DAE26403F6C5E071507F
Chrome Cache Entry: 165	ASCII text	ECE7A224F69AB2205D90900589AE1D05	3D861B816A5DA892C8A88D5755A5537C036239DE	FFA8C6A4CE199BFD9E32B05E0E4DECE330C6A577FB3A0E8518291619C658C486
Chrome Cache Entry: 166	SVG Scalable Vector Graphics image	21F840ABAA13C71AFB622EEC231F720C	41F57D2E935AD0EED26F96729789470737FB6F3E	0DC820F1B38866F9EF0C1D25880AF9F4C924B8D1B82D1463876D0724FD4A03C8
Chrome Cache Entry: 168	ASCII text, with very long lines (65448)	9F5EDE38B0D1D7FE0EE6E2A72BB52655	DD7C0784B957C8103AEEF4200A1B658EFFDE28C5	83F8ECFA94B75E542672E438B4CFA06B7A819F78CD130BDD700FD2269EE4C44E
Chrome Cache Entry: 169	PNG image data, 79 x 79, 8-bit/color RGB, non-interlaced	C87DA3413DAD0BC57D3F6C42C3848657	5F307E843AE7B61DBB541B55CC159386664A40F4	AE8E67BAA196F0D1A50103804DA7CC8EA1B30F97A3878F044D2EE03902D9925E
Chrome Cache Entry: 170	GIF image data, version 89a, 535 x 234	5FE976676EFD2EE48E472CD3BB564AD0	5450C9C6FA27EFCE882380759C3FC738E8B33231	A12645ECFDB3F287D24C7F82F66974C8A3F21E5B098C44324E410F0D8DEF6D68
Chrome Cache Entry: 172	ASCII text	D2942A4771AEB6AE4AE136CB1EA2A4B5	DD04F9C4A29C5144070CA75C0F74FD626E530568	95BE600849FD1D4DC66F7542054B07EA48AF259B8CABF1AD1E84C9D2065FBFE4
Chrome Cache Entry: 173	ASCII text, with very long lines (57954)	147ED026911280F09266EA87A69A5FC1	394F5B74AE0AD9975057E732DFB2C9EE4739A760	1A7A6B6222ABC91E1E8F39A82F2D2D27A6DBCB81806463CA5511015C84F6414B
Chrome Cache Entry: 176	ASCII text, with very long lines (65448)	909800F91B439C017EA6DB37097896F7	347F2D52C9E835C3B2274D02AEC5038F52A8D992	2B8A364ADC95BBB07A86A9DF54A25C92450DA38F390EAB7C4CF10CB6DF0DEE0D
Chrome Cache Entry: 177	Unicode text, UTF-8 text, with very long lines (65169)	138CB6A0F4778731E5A5D983E5A4F74D	A7341ED2585D73A0D2ABF48C0B42E4D8A4B26D40	4C9AA6FC7B3C5725910095C23EE201664981DBFEFD231E556325253A65027F8A
Chrome Cache Entry: 178	ASCII text, with very long lines (65448)	811581C23FEE6BDDBA046C8F08214F11	A9B5566253314D172EF90CE4D58018EFF5AF67B0	49A1D8D973C45CBF80C4FB3E1FF386FEE0059706BD8C0E9CE91426FF87DB05F1
Chrome Cache Entry: 179	ASCII text, with very long lines (65448)	113837D09BD96E9F251276B99E5EC0A1	42913962D76A800D10811D932D98845C68027B5E	1FE082EBA6481FBAB28E59AF28FDEA69D40882F0B0260B3FB807A332AFB6FDBC
Chrome Cache Entry: 180	GIF image data, version 89a, 210 x 234	D5BED5D7A41476A2B1E8DA2BA024E90B	E62F24E715895E473A615E9FB47E3C79366EC262	08F0A90F9D52B8253E84CAD1C42A07D45675F4880F1CA54398AF5BCEBC987433
Chrome Cache Entry: 182	JSON data	F704DBFF52454E03BBC3FBFBDF9FB9FF	74DC58AEFC214A97233093F45BEA3207B1F81B78	634A17427C54E934107C3DE36E357D6705E3915348B7AF3B6CB6CC66B5DE7773
Chrome Cache Entry: 183	ASCII text, with very long lines (65446)	E5AED14FD34298C8134A8CD857D876F2	B7119EF665F8624579125F2A1EC3A0666597898D	B48462A3A96F73CF811C57D3212AB448C5672EF8C7028BE527A3663194E85DFB
Chrome Cache Entry: 187	ASCII text, with very long lines (65536), with no line terminators	2C73DD9B48CB342C5FEB81C8A378B291	FA52BCA3CF57FFE2FBA82D3C923B1A3DE1E38E76	DA90AEA8421C31DDAB9FADDF17FC9D1F7EE9B466786C8113F0C523DB8CB3F00C
Chrome Cache Entry: 188	Web Open Font Format (Version 2), TrueType, length 29516, version 1.0	5D66C3D97D4F69A2B3527E3997CBB66B	94EF4F31C1A1CD780A172EDFBF9E3DE61697EF5A	1BF53B33743C5C45D6C944815F74CBF58B228806858FB6E3A0B86C1204F4BE06
Chrome Cache Entry: 190	ASCII text, with very long lines (65443)	EB6A17CF377B81B94B0D5A0BA4A97A42	80E2E8B10D97D8D426EEF8F33FC1512EE5E02D6D	0AE019E7A9DB996C3E21E0DE08FA17EC215C509CAD09B6DC0C37191B44834BC6
Chrome Cache Entry: 194	ASCII text, with no line terminators	1000A6CAF7299F030F5C73974CCD617E	44C1943894BE0A43D5F1176C085F82A9CF75DAAA	BB107868145E022BC860243BF8E7144DB9F5350D02F73F9EF56F70C3B89A2BEB
Chrome Cache Entry: 195	Web Open Font Format, TrueType, length 13780, version 1.0	D2793531447C140874B62B7448EF7191	1CE36AA9C6445DACDFA8B597BD79A34514CC9F60	2B1A1F78DF06385464750F48AED402C315164D51FD9475E8B5A47D897CF9C084
Chrome Cache Entry: 196	Web Open Font Format (Version 2), TrueType, length 31468, version 1.0	B70FB054C362CBA0FE0E6233920555E4	C1C2CDF248E7042B196EE18512C1DE9418ED61F2	C2DD95A4FD1D3569F219994B8BA845A5AE065733B80619B87157FA7BA97CCB74
Chrome Cache Entry: 198	ASCII text, with very long lines (65447)	B996140AA55B4DCEFBE20B0EC96447B3	5C715DD38582604148904BADAF0342982195F698	54C6DB3FC48C1F54FAD197E91744DA04EB8FB584FBDB581A5C1E92CD6E72E12D
Chrome Cache Entry: 199	Unicode text, UTF-8 text, with very long lines (65442)	EFA35FF69FEDE1DDF50A1642C7E3A41D	67562C6324D944E82E5E3779074108A96930A82C	C8644722991E31AD65A2410D32E83A18D58AAE0B4840356E74B780AB4E0AF10E
Chrome Cache Entry: 200	GIF image data, version 89a, 145 x 60	097D652B65DEC6E954C335739754FC61	83155314927200EC3B9951246D0C1C3B631B088A	00E709E22EA18FB242C2F41290179522537ABEC841EEF2655D17E02B36CFDC7A
Chrome Cache Entry: 204	ASCII text, with very long lines (46034)	B132A2B1FF6239DB7559C14823C8DDE4	91A97746EC7D0AD09878F31C44296F65B92B31AD	94ECEB951F7B7CF12F313B60ADC665714B26E54BE9A912DBEAA0CF30AF9FB3D7
Chrome Cache Entry: 205	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	AFE00DB89CE086B91A541C227EDBF136	961B2EE6FB39C4D515BDC49EC1BA688B0916F104	E11827C678AF8519E702F364E525AC34509CAD49F8D839677E089949EDDA060E
Chrome Cache Entry: 207	ASCII text, with very long lines (65449)	4C42510553118994DAE00ECF04B267C7	66223CA571111E0F56B3BC58A6580EB2030D38FF	7F8B1B1E0333E669CC10FC8BF5956A7B71B87B57E4057485C99BE5F48AE2CCE0
Chrome Cache Entry: 209	Unicode text, UTF-8 text, with very long lines (65442)	F74CF54CCDE6B5407F8664D8DF85AFE6	A0B9F7F72A7A82C62FB46F8FF20C8AA49FBED246	1F4DA21A71FCAA527BE447F9E4F43D99113FF853E3B9150A8E4831694534DEB8
Chrome Cache Entry: 211	ASCII text, with very long lines (11684)	C80C3EE7F2985F623C8987DF045B1B9D	78BD993D005B1531A4A95137299BC9055555A5C5	E0C3549C802D72F10F33F6CE070AA088E36FCE73544510B64EDA2C37041CFEAA
Chrome Cache Entry: 214	ASCII text, with very long lines (16777)	D0C21017536DCF0C23F1ECAA5BBE0976	A05C5276719510DE9BDA7551D04774975884D015	5491AE8CC407D46F15E544CF6CAED0C79C640199DCFC7567FD6DA0F7C6539F45
Chrome Cache Entry: 217	SVG Scalable Vector Graphics image	EC396047518A7FEF11D53D1B4F6BE65B	E3BEC4CDAF5567641517A23019ADBFA2328B0A7F	8F77CFC832517C619BC1B8D82A6A478EE18D97442B4C78B006B0286CEC91E1A8
Chrome Cache Entry: 219	ASCII text, with very long lines (65440)	5D81758C68059F4BBDD35B9E236192D1	6BF894633C8F38A3DDC23A5488D938ED29D4F308	53EC1CEEEA54741A338272B3AEBE0D7DE6FD335D95D3B25B8F7C68E128A36A85
Chrome Cache Entry: 220	ASCII text, with very long lines (20560)	D56F8C4A6B3DB2677E962A7B0F45634A	5AFF66065038A218B20AAA779AE7F9023C88287A	1C0ECB84B8364F76298D5022BDD9A03CDE1E065964BDB5870FA6439572F550D9
Chrome Cache Entry: 222	ASCII text	7363E1A92A77C2F6AB0332C9A64CC051	B424892E6298C96B00A63BF7B3244AFC93EFDEAB	4E640814854B6E878309D5B3ADD69C450D0995CF83617BBFAFBA63EA2043CF2F
Chrome Cache Entry: 225	ASCII text, with very long lines (12839)	8121EBC1ED98F1C422DB06BD07314F28	3EED7BFA7B27DF00C245B328AC1ED42DC7F6581E	EE129C66EF904C9E672419CD355922936DED5DA313AAEC82F314777AF0E9809F
Chrome Cache Entry: 226	Unicode text, UTF-8 text, with very long lines (16888)	CE7C0BB19E58A93C8F056BC20DAB9A26	13E50DC5E64A6BCB229ED4FE3B7AD1233833914F	18283FDE9392D1E5083F28DFF6FBE0DFE9FA450F1829A885858C05DEA1BF2813
Chrome Cache Entry: 227	ASCII text, with very long lines (7965)	CF0A3FB647010CD001AF1B0430E25098	2DEA95C29D245223540CCBFE2F246F718DB7B283	D7B8DDB44BFC73780B9AF7FBB6619AABEDC3C57062FF68E06A016DE042A7FF71
Chrome Cache Entry: 229	ASCII text, with very long lines (65448)	9DA993B3F5C7590CCCA0A4D411BC44A8	23D1C23805D2C364B5FCD8B26863584180B00714	CBF3E508493FAF9864881FA1DD1A157739501028FBE7006C78ED3299556BA349
Chrome Cache Entry: 231	ASCII text, with very long lines (24513)	DEE3ACB144002DC7CE943395961513C6	466134785A8419111FCFE49C03AA4BAA5A37AADF	08C559F348FB32A07FF05AD6DFB9B5C18E38AA54993CE132CAC17E0179CF4772
Chrome Cache Entry: 232	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	F4B52A4EB3D0CDD585A73EADE7CC734A	00BD17DB2EA7F845910C713CBFF3A6719D59A1EC	94BACE793EA5F351B65F5B2948BEB949B01FB811274A3F8EB8D52B9719A149BB
Chrome Cache Entry: 235	ASCII text, with no line terminators	C9785540787087E135E2E3256D4128E6	41BD40CDDBF7127B59A6D093F72D6EF7AC2E45D4	ADB38815ED6BC0240FFD0E7299D9CFA5860D5C662C7C2B4DAE11EF97EC951B05
Chrome Cache Entry: 236	ASCII text, with no line terminators	41CA76A699859BBACC56AFEF3AFCEECE	BA803CD85C15DED3486AEDAB1D4C48439E5FE9EE	72DE07A3EEA6DCC4CFD9E4489DCD64E09916BB4530CF26C879731C419953949D
Chrome Cache Entry: 237	ASCII text, with very long lines (9377)	B37450C5A66EEE84E294D821A6A02A64	3BF70E88ADEE39121B6237EE5D3BE9021565BB71	30092DA12ACD136AE59B9DAA166475DAEB91A6C1085CB2A78EB70793E9F5C5C1
Chrome Cache Entry: 238	ASCII text, with very long lines (65453)	B97295549B6CCC07A875710755227041	B7D3DE8850B86C54AC89A5FAC61DD5B7145712B7	64FAB500F51819BE48C82D056B8C4C5E21C9E9B5F5EF342D147BEB060865521D
Chrome Cache Entry: 239	Web Open Font Format, CFF, length 33752, version 0.0	4DE7535F6F5DF8D5437C21C068DDB0EC	3553204B4624CA41CF1C4F3BD9B37D8C968CBA23	8F6A520A392FF62149E5FC5AA87BFAB9B3816CD6010D4D4FCA194E8683CA498B

Phishing

Suspicious MSG / EML detected (based on various text indicators)

Source: MSG / EML

Source: unknown	HTTPS traffic detected: 23.60.203.209:443 -> 192.168.2.18:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.18:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.18:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.18:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.86.251.27:443 -> 192.168.2.18:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.18:49856 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.203.209
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63

Source: global traffic	DNS traffic detected: DNS query: nam11.safelinks.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: urldefense.com
Source: global traffic	DNS traffic detected: DNS query: na2.docusign.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: a.docusign.com
Source: global traffic	DNS traffic detected: DNS query: api.mixpanel.com
Source: global traffic	DNS traffic detected: DNS query: cdn.optimizely.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 23.60.203.209:443 -> 192.168.2.18:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.18:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.18:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.18:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.86.251.27:443 -> 192.168.2.18:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.18:49856 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.winEML@18/74@26/200

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241010T1200020369-6504.etl

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Fw_ Complete with Docusign_ J929272_SOW Extension_002_09-OCT-24_201415.pdf.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "E2281F03-DBD0-45BA-93C4-42734399A761" "B9A67480-8303-44DE-8058-9B3EB0AFE824" "6504" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "E2281F03-DBD0-45BA-93C4-42734399A761" "B9A67480-8303-44DE-8058-9B3EB0AFE824" "6504" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fna2.docusign.net%2FSigning%2FEmailStart.aspx%3Fa%3D423c3005-40e3-4f73-b01f-22c9db5b3def%26etti%3D24%26acct%3D038966a5-ff0e-476e-8a6b-74cff2dbb75d%26er%3D394d41b2-f386-4e71-a2b3-8177fba01463__%3B!!C8I-Dec!486hyGdic1hV2am9VfDJH5Ax3zwY0qv4ruelnV64xkz4xB5hLT894olBod_KeZbxsIbkdqirZCaLewk%24&data=05%7C02%7Ccgoolsby%40ceenta.com%7C0c2dd23699af4d34b13e08dce93351f7%7C97bf5e89559d4b3e997ec4ee27dbd4cf%7C1%7C0%7C638641653844817953%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=zaJtoIm3TinFFKZVAkfa85ottmo3ktA9hI4XaMqBzx0%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1932,i,5493115229194152307,3648905318716236932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fna2.docusign.net%2FSigning%2FEmailStart.aspx%3Fa%3D423c3005-40e3-4f73-b01f-22c9db5b3def%26etti%3D24%26acct%3D038966a5-ff0e-476e-8a6b-74cff2dbb75d%26er%3D394d41b2-f386-4e71-a2b3-8177fba01463__%3B!!C8I-Dec!486hyGdic1hV2am9VfDJH5Ax3zwY0qv4ruelnV64xkz4xB5hLT894olBod_KeZbxsIbkdqirZCaLewk%24&data=05%7C02%7Ccgoolsby%40ceenta.com%7C0c2dd23699af4d34b13e08dce93351f7%7C97bf5e89559d4b3e997ec4ee27dbd4cf%7C1%7C0%7C638641653844817953%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=zaJtoIm3TinFFKZVAkfa85ottmo3ktA9hI4XaMqBzx0%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1932,i,5493115229194152307,3648905318716236932,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email	LLM: Page contains button: 'REVIEW DOCUMENT' Source: 'Email'
Source: Email	LLM: Email contains prominent button: 'review document'

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Queries the volume information (name, serial number etc) of a device

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

ID:	1530942
Product:	CloudBasic
Start time:	17:59:22
Start date:	10.10.2024
Sample:	Fw_ Complete with Docusign_ J929272_SOW Extension_002_09-OCT-24_201415.pdf.eml
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	4e46610dcb7ece78f8c2123b95fa5e23
SHA1:	8ba69d84b2b311e3e9edc433f73e36a19e6fcb4c
SHA256:	e605ac00ac4839c0dfba0ad5eafe8a8c2cf0ca4b1ac3e273b0090d669de3a10b
Filetype:	E-Mail message (Var. 5) (54515/1) 100.00%

Windows Analysis Report
Fw_ Complete with Docusign_ J929272_SOW Extension_002_09-OCT-24_201415.pdf.eml

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report Fw_ Complete with Docusign_ J929272_SOW Extension_002_09-OCT-24_201415.pdf.eml

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
Fw_ Complete with Docusign_ J929272_SOW Extension_002_09-OCT-24_201415.pdf.eml