Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Employee_Dimarefresh. 401(k) Profit Sharing Plan_Amendment.msg

Overview

General Information

Sample name:Employee_Dimarefresh. 401(k) Profit Sharing Plan_Amendment.msg
Analysis ID:1530945
MD5:e8f3402b52740f806d4ce6859519e650
SHA1:bc2a8a40f3d9fbd62076ffd7eefb4b37fa4090b1
SHA256:4e5774acad7cd8e423b22264be570831307b571b69daf4463d15b907af90f819
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:60%

Signatures

Detected non-DNS traffic on DNS port
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Outlook Security Settings Updated - Registry
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6984 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Employee_Dimarefresh. 401(k) Profit Sharing Plan_Amendment.msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 7152 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A4437FA9-80D7-4967-A832-A1A793F19637" "14ED8A6E-C547-4944-97D3-30793DAB6E1B" "6984" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 6836 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UXJADNK8\401(k) for Corerecon.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 1608 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1908,i,17588684250035578659,7279340704418246065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 7880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UXJADNK8\401(k) for Corerecon.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 8072 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1876,i,17065211570952552739,5413108760183494318,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6984, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
Sigma detected: Outlook Security Settings Updated - Registry
Source: Registry Key setAuthor: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UXJADNK8\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6984, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://ujidea.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWNGSTVWM2s9JnVpZD1VU0VSMTcwOTIwMjRVMTIwOTE3MzQ=#c3VwcG9ydEBjb3JlcmVjb24uY29tHTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 95.100.63.156:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 95.100.63.156:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: chrome.exeMemory has grown: Private usage: 1MB later: 28MB
Source: global trafficTCP traffic: 192.168.2.16:59267 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:59267 -> 1.1.1.1:53
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 95.100.63.156
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: global trafficDNS traffic detected: DNS query: ujidea.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: apis.google.com
Source: global trafficDNS traffic detected: DNS query: play.google.com
Source: global trafficDNS traffic detected: DNS query: google.com
Source: global trafficDNS traffic detected: DNS query: ogs.google.com
Source: global trafficDNS traffic detected: DNS query: id.google.com
Source: global trafficDNS traffic detected: DNS query: any.run
Source: global trafficDNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global trafficDNS traffic detected: DNS query: content.any.run
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownHTTPS traffic detected: 95.100.63.156:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 95.100.63.156:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: classification engineClassification label: clean2.winMSG@38/10@38/285
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241010T1206340012-6984.etl
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Employee_Dimarefresh. 401(k) Profit Sharing Plan_Amendment.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A4437FA9-80D7-4967-A832-A1A793F19637" "14ED8A6E-C547-4944-97D3-30793DAB6E1B" "6984" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UXJADNK8\401(k) for Corerecon.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1908,i,17588684250035578659,7279340704418246065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A4437FA9-80D7-4967-A832-A1A793F19637" "14ED8A6E-C547-4944-97D3-30793DAB6E1B" "6984" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UXJADNK8\401(k) for Corerecon.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1908,i,17588684250035578659,7279340704418246065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UXJADNK8\401(k) for Corerecon.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1876,i,17065211570952552739,5413108760183494318,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UXJADNK8\401(k) for Corerecon.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1876,i,17065211570952552739,5413108760183494318,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		1
Process Injection		LSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		Security Account Manager13
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Extra Window Memory Injection		1
Extra Window Memory Injection		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
google.com
216.58.206.46
truefalse
    		unknown
    static.cloudflareinsights.com
    		104.16.79.73
    		truefalse
      		unknown
      plus.l.google.com
      		172.217.18.14
      		truefalse
        		unknown
        play.google.com
        		142.250.185.110
        		truefalse
          		unknown
          www3.l.google.com
          		142.250.186.78
          		truefalse
            		unknown
            id.google.com
            		192.178.49.163
            		truefalse
              		unknown
              content.any.run
              		104.22.49.74
              		truefalse
                		unknown
                ujidea.com
                		192.185.189.43
                		truefalse
                  		unknown
                  any.run
                  		104.22.48.74
                  		truefalse
                    		unknown
                    www.google.com
                    		142.250.185.196
                    		truefalse
                      		unknown
                      ogs.google.com
                      		unknown
                      		unknownfalse
                        		unknown
                        apis.google.com
                        		unknown
                        		unknownfalse
                          		unknown

                          Contacted URLs

                          NameMaliciousAntivirus DetectionReputation
                          https://any.run/report/1b50a98939c6b718a0134ba794d6c7dcd3f8a1456cef77bfe8bdeb48fed9337d/93081d78-31f6-4fe0-860b-45a021313165false
                            		unknown
                            https://ujidea.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWNGSTVWM2s9JnVpZD1VU0VSMTcwOTIwMjRVMTIwOTE3MzQ=#c3VwcG9ydEBjb3JlcmVjb24uY29tfalse
                              		unknown
                              https://ujidea.com/o/false
                                		unknown
                                https://ujidea.com/false
                                  		unknown

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  142.250.186.46
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  142.250.186.174
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  172.217.18.14
                                  		plus.l.google.comUnited States
                                  		15169GOOGLEUSfalse
                                  192.178.49.163
                                  		id.google.comUnited States
                                  		15169GOOGLEUSfalse
                                  52.109.89.119
                                  		unknownUnited States
                                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  142.250.185.227
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  142.250.181.234
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  216.58.206.35
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  104.22.49.74
                                  		content.any.runUnited States
                                  		13335CLOUDFLARENETUSfalse
                                  142.251.168.84
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  142.250.185.163
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  20.189.173.18
                                  		unknownUnited States
                                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  142.250.184.227
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  104.16.79.73
                                  		static.cloudflareinsights.comUnited States
                                  		13335CLOUDFLARENETUSfalse
                                  142.250.184.206
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  142.250.186.99
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  52.113.194.132
                                  		unknownUnited States
                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  142.250.184.195
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  142.250.186.78
                                  		www3.l.google.comUnited States
                                  		15169GOOGLEUSfalse
                                  142.250.184.196
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  1.1.1.1
                                  		unknownAustralia
                                  		13335CLOUDFLARENETUSfalse
                                  192.185.189.43
                                  		ujidea.comUnited States
                                  		46606UNIFIEDLAYER-AS-1USfalse
                                  216.58.206.67
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  142.250.185.110
                                  		play.google.comUnited States
                                  		15169GOOGLEUSfalse
                                  216.58.206.46
                                  		google.comUnited States
                                  		15169GOOGLEUSfalse
                                  142.250.185.170
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  64.233.167.84
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  104.22.48.74
                                  		any.runUnited States
                                  		13335CLOUDFLARENETUSfalse
                                  239.255.255.250
                                  		unknownReserved
                                  		unknownunknownfalse
                                  142.250.185.196
                                  		www.google.comUnited States
                                  		15169GOOGLEUSfalse
                                  172.217.18.106
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  172.217.16.196
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  142.250.184.232
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  142.250.185.98
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse

                                  Private

                                  IP
                                  192.168.2.17
                                  192.168.2.16

                                  General Information

                                  Joe Sandbox version:41.0.0 Charoite
                                  Analysis ID:1530945
                                  Start date and time:2024-10-10 18:05:59 +02:00
                                  Joe Sandbox product:CloudBasic
                                  Overall analysis duration:
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                  Number of analysed new started processes analysed:17
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • EGA enabled
                                  Analysis Mode:stream
                                  Analysis stop reason:Timeout
                                  Sample name:Employee_Dimarefresh. 401(k) Profit Sharing Plan_Amendment.msg
                                  Detection:CLEAN
                                  Classification:clean2.winMSG@38/10@38/285
                                  Cookbook Comments:
                                  • Found application associated with file extension: .msg

                                  Warnings

                                  • Exclude process from analysis (whitelisted): dllhost.exe
                                  • Excluded IPs from analysis (whitelisted): 52.113.194.132
                                  • Excluded domains from analysis (whitelisted): ecs.office.com, s-0005.s-msedge.net, ecs.office.trafficmanager.net, s-0005-office.config.skype.com, ecs-office.s-0005.s-msedge.net
                                  • Not all processes where analyzed, report is missing behavior information
                                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                  • Report size getting too big, too many NtSetValueKey calls found.
                                  • VT rate limit hit for: Employee_Dimarefresh. 401(k) Profit Sharing Plan_Amendment.msg

                                  LLM Input / Output

                                  InputOutput
                                  URL: https://ujidea.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWNGSTVWM2s9JnVpZD1VU0VSMTcwOTIwMjRVMTIwOTE3MzQ=#c3VwcG9ydEBjb3JlcmVjb24uY29t Model: jbxai
                                  {
"brands":[],
"text":"Bandwidth Limit Exceeded",
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"unknown",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}
                                  URL: https://any.run/report/1b50a98939c6b718a0134ba794d6c7dcd3f8a1456cef77bfe8bdeb48fed9337d/93081d78-31f6-4fe0-860b-45a021313165 Model: jbxai
                                  {
"brands":["ANY.RUN"],
"text":"ANALYZE MALWARE Huge database of samples and IOCs Unlimited submissions Custom VM setup Interactive approach Sign up,
 it's free",
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"unknown",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}
                                  URL: https://any.run/report/1b50a98939c6b718a0134ba794d6c7dcd3f8a1456cef77bfe8bdeb48fed9337d/93081d78-31f6-4fe0-860b-45a021313165 Model: jbxai
                                  {
"brands":["ANY.RUN"],
"text":"ANY RUN ANALYZE MALWARE Huge database of samples and IOCs Unlimited submissions Custom VM setup Interactive approach Sign up,
 it's free",
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"Sign up,
 it's free",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}
                                  URL: https://any.run/report/1b50a98939c6b718a0134ba794d6c7dcd3f8a1456cef77bfe8bdeb48fed9337d/93081d78-31f6-4fe0-860b-45a021313165 Model: jbxai
                                  {
"brands":["WordPress"],
"text":"Malware configuration,
 No Malware configuration,
 Static information,
 Video and screenshots,
 Processes,
 Behavior graph",
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"Sign up,
 it's free",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}

                                  Created / dropped Files

                                  C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):231348
                                  Entropy (8bit):4.385552154476953
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:FC6B91F8FA5722EE5EE971D4A055C301
                                  SHA1:ADBD717D964C41F6A613749736D745C06312888B
                                  SHA-256:825B7543B98E215D768E36EF26293CB54E2F6278F3C0B65F39DEA716F27CF12A
                                  SHA-512:9D504FEE7ACE5725EC918A7ACFE0AFFA53A6BBAF111D925C2B8EFEC4C44FDC454DBA146F527F9EEBF095BF0DAC978805D0744C28C6FF2B540431859E6286442A
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:TH02...... ..p.U........SM01X...,...0..U............IPM.Activity...........h...............h............H..h..O........:...h.........5..H..h\cal ...pDat...h8...0...P.O....h..3Q...........h........_`Pk...h..3Q@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..............!h.............. h.......h.O...#h....8.........$h.5......8....."h..f.......f...'h..............1h..3Q<.........0h....4....Uk../h....h.....UkH..h`...p.....O...-h .........O...+h|.3Q.....O......... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UXJADNK8\401(k) for Corerecon (002).html

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:HTML document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):5115
                                  Entropy (8bit):4.416979479961014
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:94779771AA5B06E253C4569C94EA9EAD
                                  SHA1:41DFD6A928EBA20432841DC158DAF9118DE1211D
                                  SHA-256:7216F53427DC885BFCC4CD182EDF3C1EC24AEF4D72175D98B5822FFB663C1BDE
                                  SHA-512:57A01BB8832F90FA235931BBB51F77DD6740C02041F12E31688402A634407A6FE3FA35E36A8F65632BE9E3DD5D805D813A80BFD9B32C5D089534C54EA49A4548
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:<body style="display:none;">.. <div class="pricing-block col-3 wow fadeInUp" data-wow-delay="0.8s">.. <div class="pricing-block-content">.. <h3>Business</h3>.. <p class="pricing-sub">For the whole team</p>.. <div class="pricing">.. <div class="price"><span>$</span>49</div>.. <p>Lorem ipsum dolor sit amet, consectetur adipiscing elit</p>.. </div>.. <ul>.. <li>Unlimited Downloads</li>.. <li>Unlimited Extensions</li>.. <li>HD Video Tutorials</li>.. <li>Chat Support</li>.. <li>Lifetime free updates</li>.. </ul>.. <a href="#" class="button">BUY TODAY</a>.. </div>.. </div>.. <div class="pricing-block col-3 wow fadeInUp" data-wow-delay="0.4s">.. <div class="pricing-block-content">.. <h3>Personal</h3>.. <p class="pricing-sub">The standard version</p>..

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UXJADNK8\401(k) for Corerecon (002).html:Zone.Identifier (copy)

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:HTML document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):0
                                  Entropy (8bit):0.0
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:94779771AA5B06E253C4569C94EA9EAD
                                  SHA1:41DFD6A928EBA20432841DC158DAF9118DE1211D
                                  SHA-256:7216F53427DC885BFCC4CD182EDF3C1EC24AEF4D72175D98B5822FFB663C1BDE
                                  SHA-512:57A01BB8832F90FA235931BBB51F77DD6740C02041F12E31688402A634407A6FE3FA35E36A8F65632BE9E3DD5D805D813A80BFD9B32C5D089534C54EA49A4548
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:<body style="display:none;">.. <div class="pricing-block col-3 wow fadeInUp" data-wow-delay="0.8s">.. <div class="pricing-block-content">.. <h3>Business</h3>.. <p class="pricing-sub">For the whole team</p>.. <div class="pricing">.. <div class="price"><span>$</span>49</div>.. <p>Lorem ipsum dolor sit amet, consectetur adipiscing elit</p>.. </div>.. <ul>.. <li>Unlimited Downloads</li>.. <li>Unlimited Extensions</li>.. <li>HD Video Tutorials</li>.. <li>Chat Support</li>.. <li>Lifetime free updates</li>.. </ul>.. <a href="#" class="button">BUY TODAY</a>.. </div>.. </div>.. <div class="pricing-block col-3 wow fadeInUp" data-wow-delay="0.4s">.. <div class="pricing-block-content">.. <h3>Personal</h3>.. <p class="pricing-sub">The standard version</p>..

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\UXJADNK8\401(k) for Corerecon.html:Zone.Identifier

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):26
                                  Entropy (8bit):3.95006375643621
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                                  SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                                  SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                                  SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:[ZoneTransfer]..ZoneId=3..

                                  C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:modified
                                  Size (bytes):30
                                  Entropy (8bit):1.2389205950315936
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:38DA6102848EC52EAE4C5792EF909DCE
                                  SHA1:EF9D383195CE01386D059C9C37063511CC310C0B
                                  SHA-256:6FCE9CF4703C843244A2356B4BE63B2ECE83B4F3BB88B44D8575CBDF8EBBBA57
                                  SHA-512:20AADF29FB87098297F6A105D1C3B8621A30434541B73DDA26EFB7817689BDD9D8CB2CB3065A493E0FC9621FEF82C24E4B82009C5830CD37642A311E47E1183E
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:..............................

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 15:06:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2673
                                  Entropy (8bit):3.992103881925818
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:4662B08EB07BA9316CD49D82AB4E7155
                                  SHA1:04A5AD3A73A28BBA4C68FA6ADECD3A91AEA7C985
                                  SHA-256:C414CFFA2D0A958F99AAE9BE2855CD0C25F6F6A6D7F5B42951BD586657663460
                                  SHA-512:FDA039F1E423865A607DAD1A5CFC3ED8AF5293F8FE97C44E48E4D40981D7B55415D4A0E7E346460CFC7074A089FCB44E3803980E361FC84C7AB80C6C905384FD
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,....NZqg....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IJY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VJY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VJY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VJY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 15:06:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2675
                                  Entropy (8bit):4.005049331397968
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:352F4C648EA4F121D1787845DB210FC2
                                  SHA1:40384354947D46F7DB5D3DCCDEB7B36F2A827A95
                                  SHA-256:6CA67A984E53CE09DDF03218C9A7EB8D417F7B484A9D44796C96A14382789E5C
                                  SHA-512:5875E48E4B281CC6FDD2CCDF6749181DD228181CCE07ABDA70724A38EBB9FA5D7CD7838CC76D56ADE8E009AE01929BC182E7F8B75CF55781F3804A63B5D2F7F2
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,....7Hgg....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IJY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VJY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VJY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VJY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2689
                                  Entropy (8bit):4.015287966670341
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:BAB7F38CAD916C204598EEA437CD5B7A
                                  SHA1:C3F8398C5C198C17F1F6567AD32F3F22C1D0FC81
                                  SHA-256:BBA3B28BB2F53A9F6DFAA151E9D42C6F154ED7D41A784AF07149A8E63A9AC901
                                  SHA-512:E15F4C42442998C269A4DFD06095AA5A074D5197431D4903320DA56AA8DAF1471693E6026BDB257031E6AFD0CA430747589A0DE3E98C90A93304C9D815F86F0D
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IJY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VJY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VJY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 15:06:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2677
                                  Entropy (8bit):4.004074775744413
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:3DABF8EE4A0C6A4810A02001BC6582FC
                                  SHA1:30B4CC2F86B03ED02A623242D4ED4CA22894D77B
                                  SHA-256:CFE18D5FC694B3427AA46A6956C0EE7414F969DDB1269AA1A8611A7A6A70756E
                                  SHA-512:2EFE09DBB8BE9C08695024886275387C52F860255EF38100DD5931EA65133CEC22E175752D9C644290F34C3B43FF7EDFF106AD87F115D054099E7B5541E9CCC4
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,....&?bg....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IJY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VJY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VJY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VJY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 15:06:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2677
                                  Entropy (8bit):3.993848196056706
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:6F10B4E85570FD60363DF6CA361AD998
                                  SHA1:8A23E12B878521E8ABE30FE4385CA0BBD21FD989
                                  SHA-256:DFCE57851B3B1121654C221CF7CF9ABE220B298AE48BE40FBE1EC623617DEB4A
                                  SHA-512:DF1CB95132329F5B2315BBAD8ED0CFDBC095C70460B1FFDE6647A013615E1783C8DF81F70F12722366794C7C87D8F5984EE8EE7698FDCDCA298C043805AEA6F8
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,....v.lg....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IJY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VJY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VJY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VJY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 10 15:06:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2679
                                  Entropy (8bit):4.00446184396923
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:8DBD0C6845855CD5C563901A59A57D06
                                  SHA1:3CC790B0ACB78C189917E9489D6FCA2A00708DE2
                                  SHA-256:172A561E594910982330BFAB04E8DCC1F91FD026FC41FD2158CDE9C14699893F
                                  SHA-512:8E537461CD7CF2386B65C451159DC09244BEAA0BB68F9890BA171BB82EDE4F69EEFF442893E1B77547E9FEA61BB2AE61AB86317463F083B3CE7D8DDD5A1E44FD
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,.....(Zg....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IJY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VJY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VJY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VJY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  Static File Info

                                  General

                                  File type:CDFV2 Microsoft Outlook Message
                                  Entropy (8bit):3.8248207458765933
                                  TrID:
                                  • Outlook Message (71009/1) 58.92%
                                  • Outlook Form Template (41509/1) 34.44%
                                  • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                                  File name:Employee_Dimarefresh. 401(k) Profit Sharing Plan_Amendment.msg
                                  File size:87'040 bytes
                                  MD5:e8f3402b52740f806d4ce6859519e650
                                  SHA1:bc2a8a40f3d9fbd62076ffd7eefb4b37fa4090b1
                                  SHA256:4e5774acad7cd8e423b22264be570831307b571b69daf4463d15b907af90f819
                                  SHA512:daaf6fbb84516a887ac0883084c5fda0649aa12fa7eab7ae710bcda21f11dcf75086d39bf34afbaa488bebce9bc54d6389cba049159dd1cedb36cb6eae30b3cd
                                  SSDEEP:1536:5dv8ttOI3tWFj8Pi1X8vOHzZ4jFWgW9/1:j0ttOBjki1sWHV3/1
                                  TLSH:0D83BC2036FA5216F2779F3249E290979936BD92AE11DA4F319D330E0772D41DC62B3B
                                  File Content Preview:........................>......................................................................................................................................................................................................................................

                                  Static Mail

                                  General

                                  Subject:Employee_Dimarefresh. 401(k) Profit Sharing Plan_Amendment
                                  From:info@shoot360fargo.com
                                  To:support@corerecon.com
                                  Cc:
                                  BCC:
                                  Date:Wed, 09 Oct 2024 22:35:34 +0200
                                  Communications:
                                    Attachments:
                                    • 401(k) for Corerecon.html

                                    Headers

                                    Key Value
                                    Receivedfrom [127.0.0.1] (147.124.210.176) by
                                    2035:49 +0000
                                    ARC-Seali=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
                                    ARC-Message-Signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
                                    h=FromDate:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
                                    ARC-Authentication-Resultsi=1; mx.microsoft.com 1; spf=fail (sender ip is
                                    by SA1PR11MB6664.namprd11.prod.outlook.com (260310b6:806:258::11) with
                                    2024 2035:36 +0000
                                    (260310b6:a03:d4::18) with Microsoft SMTP Server (version=TLS1_2,
                                    Transport; Wed, 9 Oct 2024 2035:36 +0000
                                    Authentication-Resultsspf=pass (sender IP is 40.107.237.138)
                                    Received-SPFFail (protection.outlook.com: domain of shoot360fargo.com does
                                    15.20.8048.13 via Frontend Transport; Wed, 9 Oct 2024 2035:44 +0000
                                    by SJ0PR16MB4112.namprd16.prod.outlook.com (260310b6:a03:323::19) with
                                    X-MS-Exchange-Authentication-Resultsspf=fail (sender IP is 147.124.210.176)
                                    via Frontend Transport; Wed, 9 Oct 2024 2035:35 +0000
                                    Content-Typetext; name="401(k) for Corerecon.html"
                                    Content-Transfer-Encodingbase64
                                    Content-Dispositionattachment; filename="401(k) for Corerecon.html"
                                    Frominfo@shoot360fargo.com
                                    Tosupport@corerecon.com
                                    SubjectEmployee_Dimarefresh. 401(k) Profit Sharing Plan_Amendment
                                    Message-ID<4c6f85ce-1660-9ecd-0eb6-904369d0b6f4@shoot360fargo.com>
                                    DateWed, 09 Oct 2024 20:35:34 +0000
                                    MIME-Version1.0
                                    Return-Pathinfo@shoot360fargo.com
                                    X-EOPAttributedMessage1
                                    X-MS-TrafficTypeDiagnosticSJ5PEPF00000203:EE_|SJ0PR16MB4112:EE_|BL6PEPF0001AB4C:EE_|SA1PR11MB6664:EE_|IA1PR11MB6291:EE_
                                    X-MS-Office365-Filtering-Correlation-Id988545a5-24e3-4f06-7e8f-08dce8a1f336
                                    X-MS-Exchange-SenderADCheck1
                                    X-MS-Exchange-AntiSpam-Relay0
                                    X-Microsoft-Antispam-UntrustedBCL:0;ARA:13230040|36860700013|82310400026|376014|1800799024|2613699012;
                                    X-Microsoft-Antispam-Message-Info-Original=?us-ascii?Q?2oEkSDWrFlKmwGgQcLfICKADhBqhw+5QjPliwxRIIQ0sTF4bdhkBiMBEu5vu?=
                                    X-Forefront-Antispam-Report-UntrustedCIP:147.124.210.176;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:[127.0.0.1];PTR:ErrorRetry;CAT:NONE;SFS:(13230040)(36860700013)(82310400026)(376014)(1800799024)(2613699012);DIR:OUT;SFP:1102;
                                    X-MS-Exchange-Transport-CrossTenantHeadersStampedSA1PR11MB6664
                                    X-MS-Exchange-Organization-ExpirationStartTime09 Oct 2024 20:35:44.7581
                                    X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
                                    X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
                                    X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
                                    X-MS-Exchange-Organization-Network-Message-Id988545a5-24e3-4f06-7e8f-08dce8a1f336
                                    X-EOPTenantAttributedMessagefd95b4e8-ccc7-4e27-b8dc-ec4c54e4a14d:0
                                    X-MS-Exchange-Organization-MessageDirectionalityIncoming
                                    X-MS-Exchange-Transport-CrossTenantHeadersStrippedBL6PEPF0001AB4C.namprd04.prod.outlook.com
                                    X-MS-Exchange-Transport-CrossTenantHeadersPromotedBL6PEPF0001AB4C.namprd04.prod.outlook.com
                                    X-MS-PublicTrafficTypeEmail
                                    X-MS-Exchange-Organization-AuthSourceBL6PEPF0001AB4C.namprd04.prod.outlook.com
                                    X-MS-Exchange-Organization-AuthAsAnonymous
                                    X-MS-Office365-Filtering-Correlation-Id-Prvs7b3d0100-efcb-4830-3009-08dce8a1edb2
                                    X-MS-Exchange-Organization-SCL1
                                    X-Microsoft-AntispamBCL:0;ARA:13230040|12062699021|35042699022|8052699015|2613699012|43540500003;
                                    X-Forefront-Antispam-ReportCIP:40.107.237.138;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:NAM12-BN8-obe.outbound.protection.outlook.com;PTR:mail-bn8nam12on2138.outbound.protection.outlook.com;CAT:NONE;SFS:(13230040)(12062699021)(35042699022)(8052699015)(2613699012)(43540500003);DIR:INB;
                                    X-MS-Exchange-CrossTenant-OriginalArrivalTime09 Oct 2024 20:35:44.5550
                                    X-MS-Exchange-CrossTenant-Network-Message-Id988545a5-24e3-4f06-7e8f-08dce8a1f336
                                    X-MS-Exchange-CrossTenant-Idfd95b4e8-ccc7-4e27-b8dc-ec4c54e4a14d
                                    X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIpTenantId=e84eff66-aba4-4c44-8015-84853f7454ec;Ip=[147.124.210.176];Helo=[[127.0.0.1]]
                                    X-MS-Exchange-CrossTenant-AuthSourceBL6PEPF0001AB4C.namprd04.prod.outlook.com
                                    X-MS-Exchange-CrossTenant-AuthAsAnonymous
                                    X-MS-Exchange-CrossTenant-FromEntityHeaderInternet
                                    X-MS-Exchange-Transport-EndToEndLatency00:00:04.4616221
                                    X-MS-Exchange-Processed-By-BccFoldering15.20.8026.020
                                    X-Microsoft-Antispam-Mailbox-Deliveryucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
                                    X-Microsoft-Antispam-Message-Info=?us-ascii?Q?YEKSiyHoAae6TaUMI7ilCsUMc0shqT+M4GPfeA++v1VgOIpEy7aooyV1euu2?=
                                    dateWed, 09 Oct 2024 22:35:34 +0200

                                    File Icon

                                    Icon Hash:c4e1928eacb280a2