Edit tour

Windows Analysis Report
email.eml

Overview

General Information

Sample name:	email.eml
Analysis ID:	1538483
MD5:	2d18b85cc5f0d0da838d9b337a55a5ac
SHA1:	c3d5afc9bb359666eb72d3d1caffb0bdd01b4dd4
SHA256:	c73ee54eb46678a9a0580e0a9c7c78d7b28d4795bd6eb800a619e43de7a7f66b
Infos:

Detection

Score:	25
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Office viewer loads remote template

Creates a window with clipboard capturing capabilities

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Excel Network Connections

Sigma detected: Office Autorun Keys Modification

Sigma detected: Office Macro File Download

Sigma detected: Outlook Security Settings Updated - Registry

Sigma detected: Suspicious Office Outbound Connections

Stores files to the Windows start menu directory

Stores large binary data to the registry

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6964 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\email.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6408 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D4EEA062-4FD0-4301-840F-1F49053A2E87" "86376162-623D-4435-AE13-210F3DEF5202" "6964" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

EXCEL.EXE (PID: 6260 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8SZEA0ME\940-CJV-000-GEN-MOS-00001_DRS (A) - Copy.xlsx" MD5: 4A871771235598812032C822E6F68F19)

EXCEL.EXE (PID: 4596 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" /Embedding MD5: 4A871771235598812032C822E6F68F19)

splwow64.exe (PID: 1344 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

chrome.exe (PID: 3552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2356 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1840,i,16796486400146655648,14553717720693679175,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 13.107.246.60, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 6260, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 49735

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6964, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Office Macro File Download

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6964, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8SZEA0ME\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6964, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.16, DestinationIsIpv6: false, DestinationPort: 49735, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 6260, Protocol: tcp, SourceIp: 13.107.246.60, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Office Macro File Creation

Source: File created

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Source: unknown

HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.16:49735 version: TLS 1.2

Source: excel.exe

Memory has grown: Private usage: 1MB later: 73MB

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.16:49735 version: TLS 1.2

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window created: window name: CLIPBRDWNDCLASS

Source: classification engine

Classification label: sus25.evad.winEML@25/47@6/77

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241021T0550250967-6964.etl

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\email.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D4EEA062-4FD0-4301-840F-1F49053A2E87" "86376162-623D-4435-AE13-210F3DEF5202" "6964" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D4EEA062-4FD0-4301-840F-1F49053A2E87" "86376162-623D-4435-AE13-210F3DEF5202" "6964" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8SZEA0ME\940-CJV-000-GEN-MOS-00001_DRS (A) - Copy.xlsx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" /Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8SZEA0ME\940-CJV-000-GEN-MOS-00001_DRS (A) - Copy.xlsx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" /Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1840,i,16796486400146655648,14553717720693679175,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1840,i,16796486400146655648,14553717720693679175,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File opened: C:\Windows\SysWOW64\MsftEdit.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window detected: Number of UI elements: 16

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Persistence and Installation Behavior

Office viewer loads remote template

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Section loaded: netapi32.dll and davhlpr.dll loaded

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 755

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	1 Clipboard Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.184.206	true	false	unknown
play.google.com	142.250.185.142	true	false	unknown
www.google.com	172.217.16.196	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
apis.google.com	unknown	unknown	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
88.221.125.185	unknown	European Union	16625	AKAMAI-ASUS	false
52.182.141.63	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.211.8.90	unknown	United States	16625	AKAMAI-ASUS	false
52.109.28.48	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.109.28.47	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.19.126.160	unknown	European Union	16625	AKAMAI-ASUS	false
52.109.28.46	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.168.112.67	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false
2.18.64.138	unknown	European Union	6057	AdministracionNacionaldeTelecomunicacionesUY	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538483
Start date and time:	2024-10-21 11:49:55 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	email.eml
Detection:	SUS
Classification:	sus25.evad.winEML@25/47@6/77
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 23.211.8.90
Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, fs.microsoft.com, ctldl.windowsupdate.com, s-0005-office.config.skype.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, s-0005.s-msedge.net, e16604.g.akamaiedge.net, ecs.office.trafficmanager.net, prod.fs.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetValueKey calls found.
VT rate limit hit for: email.eml

LLM Input / Output

Input

Output

URL: Model: claude-3-5-sonnet-20240620

{
    "explanation": [
        "The email appears to be from a legitimate business domain (egis-group.com)",
        "The content and structure of the email are consistent with a professional communication",
        "The email includes standard corporate disclaimers and confidentiality notices"
    ],
    "phishing": false,
    "confidence": 8
}

Is this email content a phishing attempt? Please respond only in valid JSON format:
    Email content converted to JSON:
{
    "date": "Thu, 17 Oct 2024 09:06:32 +0000", 
    "subject": "WF000792", 
    "communications": [
        "EXTERNAL SENDER: Do not click any links or open any attachments unless you trust the sender and know the content is safe.\nEXPEDITEUR EXTERNE: Ne cliquez sur aucun lien et n'ouvrez aucune piece jointe a moins qu'ils ne proviennent d'un expediteur fiable, ou que vous ayez l'assurance que le contenu provient d'une source sure.\n\nHi all see attached the WF000792 Cable trunking and traywork method statement for any further comment\n\nRegards\n\nSimon Brogan\nSystems Dept | Interface / Integration Manager\nAbu Qir Metro PMC\nCell: +010 10048489 | UK Cell phone: +44 7856745222\nSimon.Brogan@egis-group.com<mailto:Simon.Brogan@egis-group.com> | www.egis-group.com [egis-group.com]<https://urldefense.com/v3/__http://www.egis-group.com/__;!!PWAseTJI!-O7PTdTb4pClaGGCcs9sM7MegcMcDkEbZO_TzV4oOPDVqz1EIUsOTWht405qvmG3dXyTdHsLHTSyn0NWyoUfXQvwYRY$>\nFloor 4, Makateb Building, Banks Centre Street, New Cairo, Egypt\n\n[cid:image001.png@01DB208C.FFFBBD80] [egis-group.com]<https://urldefense.com/v3/__https://www.egis-group.com/__;!!PWAseTJI!-O7PTdTb4pClaGGCcs9sM7MegcMcDkEbZO_TzV4oOPDVqz1EIUsOTWht405qvmG3dXyTdHsLHTSyn0NWyoUfa5BDbOk$>\n\n\n________________________________\nCe message et ses pi?ces jointes peuvent contenir des informations confidentielles ou privil?gi?es et ne doivent donc pas ?tre diffus?s, exploit?s ou copi?s sans autorisation. Si vous avez re?u ce message par erreur, merci de le signaler ? l'exp?diteur et le d?truire ainsi que les pi?ces jointes. Les messages ?lectroniques ?tant susceptibles d'alt?ration, Egis d?cline toute responsabilit? si ce message a ?t? alt?r?, d?form? ou falsifi?. Merci.\n\nThis message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Egis is not liable for messages that have been modified, changed or falsified. Thank you.\n________________________________\n"
    ], 
    "from": "BROGAN Simon <Simon.BROGAN@egis-group.com>", 
    "to": "BAILEY Simon <Simon.BAILEY@egis-group.com>, MUDAMBI Simbarashe <Simbarashe.MUDAMBI@egis-group.com>, DUNDAR Tarik <Tarik.DUNDAR@egis-group.com>, HASHEM Mohamed <Mohamed.HASHEM@egis-group.com>, BETTE Nina <nina.bette@socotec.com>, MASWIR Devid <Devid.MASWIR@egis-group.com>, RAAFAT Walid <Walid.RAAFAT@egis-group.com>"
}

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.37836624366395
Encrypted:	false
SSDEEP:
MD5:	E5C189DED1FBD3E35B1C18FADEDCBAB7
SHA1:	A20771E4F6FEEE61633F1344733A89E9423932A5
SHA-256:	FC7587B2FAC8167B29C64284B1D37D774E8167608281C99061F4ADBB02C35E71
SHA-512:	5D45C254A153890597AAAA325A0B785AA57186AF2686A70C310A3921B67E95B96658A2611F27A3551C5FAE303739C4E24DF6ABC7DBABF0E3780C74B4A77702C1
Malicious:	false
Reputation:	unknown
Preview:	TH02...... .0{N..#......SM01X...,...`.=..#..........IPM.Activity...........h...............h............H..h........o..D...h..........#.H..h\cal ...pDat...h...0...`......h.../..$........h........_`Pk...h.../@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..............!h.............. h..cI....x.....#h....8.........$h..#.....8....."h..'.......'...'h..............1h.../<.........0h....4....Uk../h....h.....UkH..hH.$.p.........-h .............+h.../................ ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
Category:	modified
Size (bytes):	1869
Entropy (8bit):	5.0833538109742555
Encrypted:	false
SSDEEP:
MD5:	94288D547BAC449965090E7298AB6DD4
SHA1:	8D21DC21BC7E8E6F2DB3010C76C38F8C9E5422BC
SHA-256:	B9F9B1FF55423824DC528447A2B67B776AEBB4A6951EB0EE973B04C1964DFDB0
SHA-512:	F9A04BCF7C6CD30CF00183CF5ED26A754038B21C2971C100D27C28D1A2BCF078DAC343F8AC523D885375E349859832CBC96EEDCFF4288278B40507B5F718B1C9
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-10-21T09:51:16Z</LAT><key>30153066857.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2024-10-21T09:51:15Z</LAT><key>32483553004.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2024-10-21T09:51:15Z</LAT><key>27970306811.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2024-10-21T09:51:16Z</LAT><key>30169865670.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2024-10-21T09:51:15Z</LAT><key>25065980124.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2024-10-21T09:51:15Z</LAT><key>32677218994.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Reputation:	unknown
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Reputation:	unknown
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	unknown
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:
MD5:	9EFCBB62A721B61336FBADCEFD5C569B
SHA1:	A89266B36F95DA95A47919EC9BF115C4AF075273
SHA-256:	04466AB4B99D6989E1E3E075B47B2987294B35AE7C085228075967A8AF93B057
SHA-512:	A365F0F74786322F8483FB5AAC571C3A440C81E8E075B0A6DB72BA2324542388206952BD83308B3BEC27B5E361A16A0EB99DAAC20E1988AC9E768049F11E3285
Malicious:	false
Reputation:	unknown
Preview:	1729504231

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	7397F178FE0D4AB7699061BE22F7BE6A
SHA1:	7FE823620A11B85863A5B84DDFBEB5E2628B2388
SHA-256:	6889C46C86A3B76B701980C8DFABFF2F8F1A44AEEA6389C970C28145E689B046
SHA-512:	67D5D9BD04138A6454BD3558341708EB673369C1E9700F53347DA03457F630FCBD6BD41229A523F2A86E901AA0EA8A881D105E7A58D01F01F0DB9F87455A8A03
Malicious:	false
Reputation:	unknown
Preview:	3.7.4.6.3.7.6.,.1.1.9.6.3.7.8.,.1.7.8.8.6.5.8.,.2.5.5.0.5.0.8.8.,.1.2.5.,.1.1.9.,.3.0.0.4.9.2.6.8.,.3.7.4.6.2.5.9.,.7.0.0.9.9.8.4.,.1.2.2.3.4.3.4.,.4.5.8.4.0.2.3.2.,.3.7.4.6.2.6.5.,.3.7.4.6.2.5.8.,.;.1.2.2.0.7.7.9.,.3.2.9.4.5.8.7.9.9.,.3.7.4.6.3.7.8.,.1.7.6.1.9.5.9.,.6.3.6.4.3.3.4.,.3.0.1.5.3.7.2.1.,.2.3.7.1.6.5.1.,.1.0.0.1.,.6.5.4.0.2.1.5.,.2.4.6.0.9.2.5.8.,.4.0.6.9.3.5.8.2.,.1.0.4.9.5.2.3.4.,.6.3.6.4.3.1.8.,.3.0.1.2.3.4.6.6.,.2.7.1.5.3.4.9.7.,.6.3.7.1.6.9.4.,.8.7.4.7.0.1.5.3.,.5.9.2.2.3.4.2.3.,.5.7.9.9.9.6.6.1.,.1.5.6.1.9.5.8.,.6.3.0.6.3.0.9.9.,.2.7.3.6.0.0.9.5.,.5.8.4.2.5.8.6.0.,.6.3.6.4.3.3.7.,.6.1.7.0.7.3.0.7.,.6.3.6.4.3.3.0.,.6.3.6.4.3.3.1.,.6.7.4.8.3.9.6.1.4.,.3.3.7.9.1.6.2.,.4.7.3.8.2.9.4.8.,.1.6.5.7.4.5.3.,.1.0.6.9.5.5.2.,.1.6.5.7.4.5.2.,.5.2.9.1.0.0.0.0.,.1.3.5.2.5.8.6.,.1.3.5.2.5.8.7.,.1.7.7.1.6.5.7.,.1.0.2.3.8.6.4.,.1.0.2.3.6.3.8.,.6.3.7.1.6.9.5.,.4.8.1.9.5.5.3.8.,.1.4.6.1.9.5.3.,.6.3.6.4.3.3.2.,.3.2.0.5.9.2.7.6.7.,.3.7.4.6.3.7.9.,.3.7.4.6.3.6.9.,.6.1.7.0.7.3.0.5.,.3.1.4.1.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13760166725504608
Encrypted:	false
SSDEEP:
MD5:	F1A946C52166F6EDF325E05111187C72
SHA1:	6BDB7245E694CE01669C963C994437F146DB09BD
SHA-256:	0F109939691E81A953CA51CCA165BAC4A3D74F373538F036BF7617148978B2C3
SHA-512:	FF45D86FCE1C2C4348B55640EF8BC36E987C5332176801F3047F5F9B512C2AA3E25B8BC86E45DE4D45F824FEC0B8481AA355EFE2C3B7200803534445BDDA9BD9
Malicious:	false
Reputation:	unknown
Preview:	.... .c......?d.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\35C5BC82.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	331364
Entropy (8bit):	7.878912906864061
Encrypted:	false
SSDEEP:
MD5:	2CE20455651865A5CD1CF694CB4B55A8
SHA1:	96EC840FD8D3AF574B03308ADD1CAA499F6CB54E
SHA-256:	6F7FF7C83F1C55A6F8229CCA2F29A01F48BE8B5C094E6984C887CA4701E47F82
SHA-512:	12E37592B7AAC292B24332D729ACD3CEFDA9915E76374AD124D654E0414B76F3A08737076A5D621E67D4854F4EBD9EE9273768BDA0A53E220DA49CADFA1E5478
Malicious:	false
Reputation:	unknown
Preview:	PK..........!..).c............[Content_Types].xml.VMk.@......^..N....9$..$.^7.ci.~..v....Z.%....z.y..{....;k.-D..U.....J..b?..f_X.I8%.wP.= .]~..x......V.I)\|..e.V`..8:...D.c..kQ....?s.]..f..`..=.........h...u-U.D.FK.H(.:..d.W+-Ay...]b. .6..2DM...R...^...w.........^&.....6:...u.aKg..@..Q.R.'.Z......4!Q+(.EL..8...W../... ...S+...hL.?E..}@....+8..V...AL..8.H.8.ehg]...[n0y;.....].9....z...Q..."..q.t$.t...x+2.@...p.;-..17".zJ.C.....=.C......x.;..^.m.H..G..;D/..kh.N..<..?.._.p...};.7..ox..h.....i..L.....W.........PK..........!..^.e............_rels/.rels ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\502ADF6E.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 728 x 90, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	34840
Entropy (8bit):	7.9785507286144846
Encrypted:	false
SSDEEP:
MD5:	49A30465B4AC272CF579C429697C319D
SHA1:	91DE2A0418C1797170E094CD522B294AC3A6EE7E
SHA-256:	129327BC487B8D47200718EC9DD503767B163FCDE822C9637B0C8FD63C280487
SHA-512:	2B82047EB28019B634D1A04B416A5028E712B936CF8CD6010117FA211E0D5583536AA88F78AC222213142FF0CBB754890A497DE001CC35FD1A68998F0000C4F7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......Z......V......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.1b65a79, 2022/06/13-17:46:14 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.5 (Windows)" xmp:CreateDate="2022-12-13T17:27:43+04:00" xmp:ModifyDate="2022-12-13T17:29:03+04:00" xmp:MetadataDate="2022-12-13T17:29:03+04:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:9e08a960-e2fb-0e41-80fa-b6abc23a7ca1" xmpMM:DocumentID="xmp.did:9e08a960-e2fb-0e41-80fa-b6abc23a7ca1" xmpMM:OriginalDocumentID="xmp.did:9e08a960-e2fb-0e41-8

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8SZEA0ME\940-CJV-000-GEN-MOS-00001_DRS (A) - Copy (002).xlsx:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8SZEA0ME\~$940-CJV-000-GEN-MOS-00001_DRS (A) - Copy.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.3520167401771568
Encrypted:	false
SSDEEP:
MD5:	9AC4D67F6E514F452D4A1DB79CE3B2E8
SHA1:	33F8C665ECBB81275D2E49D48F2565A58A282043
SHA-256:	407E1D871964C93DBDBD4D00613CD0A9E30D3ED6352D8052C58E7A252D52FC5A
SHA-512:	018D0F54AB0AB01F27E9FB870A128F2F581A58487399DD7FB56A94EC4AAEC6874708A5AD5650F362485E45E2C6A557ED08524C5B8335F83F240E0962281A0F1A
Malicious:	false
Reputation:	unknown
Preview:	.user ..c.a.l.i. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{04AA47F8-4D19-44A1-B5E3-33F1447083B5}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	4516
Entropy (8bit):	3.3179265500408355
Encrypted:	false
SSDEEP:
MD5:	CEA98466E9AAC5961227322CDB0ACB01
SHA1:	37302FCF7EAE75730117514C12459FC37F0AD159
SHA-256:	07419E75462F7CCE1B0AA5ED6725EAE8A9105D68A06A10ABE61EA3536827587C
SHA-512:	8F41379D47D0B0EB0AF48D596BA4D76EB762D19FDC3EFBC1D2ED8F85EEB6D3448CE130E90123AF611F2175ACB07F5F4084030068F921D109D6ABD25BDC4BE461
Malicious:	false
Reputation:	unknown
Preview:	....E.X.T.E.R.N.A.L. .S.E.N.D.E.R.:. .D.o. .n.o.t. .c.l.i.c.k. .a.n.y. .l.i.n.k.s. .o.r. .o.p.e.n. .a.n.y. .a.t.t.a.c.h.m.e.n.t.s. .u.n.l.e.s.s. .y.o.u. .t.r.u.s.t. .t.h.e. .s.e.n.d.e.r. .a.n.d. .k.n.o.w. .t.h.e. .c.o.n.t.e.n.t. .i.s. .s.a.f.e.....E.X.P.E.D.I.T.E.U.R. .E.X.T.E.R.N.E.:. .............................................................................................................................................................................................................................................p...r...v...B...D...T...V...p...........Z...,...............................................................................................................................................................................................................................................................................................................................................................................x.*...$..$.If........!v..h.#v....:V.......t.....6......5.......4

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\Excel\1380790193167760279.C4

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BB7DF04E1B0A2570657527A7E108AE23
SHA1:	5188431849B4613152FD7BDBA6A3FF0A4FD6424B
SHA-256:	C35020473AED1B4642CD726CAD727B63FFF2824AD68CEDD7FFB73C7CBD890479
SHA-512:	768007E06B0CD9E62D50F458B9435C6DDA0A6D272F0B15550F97C478394B743331C3A9C9236E09AB5B9CB3B423B2320A5D66EB3C7068DB9EA37891CA40E47012
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\1924FFB3.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	PNG image data, 352 x 332, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	70276
Entropy (8bit):	7.989584795913617
Encrypted:	false
SSDEEP:
MD5:	8306F6BA2D74796502DCB22064393E53
SHA1:	C95026909CB004B21AF855C6D608DF60E38304BF
SHA-256:	504A86E96ED98FD8702339DB44A4E192FC2BCC291114B6C68731D4CFC2EAFB48
SHA-512:	52AEDAB0ED33BB2369576365C093C3F6DE35A9ECF3068EA4F6C4CA779EB9EBF1F9400236CC082D0B068CE0F696FF3B821B68BA858CB5FC87806421BB87E2E02B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...L.......f.....sRGB.........gAMA......a.....pHYs..2...2..(dZ.....IDATx^....Wy....{....$.H...'!!!...$........j.].......{.dK.U....m.........\..F.....+}wfg.~....E....FY.JJ.5f?.rZ..K.....2AY.\|^9?.R)0).\6..NyD..!.....B.N..6....1.f..fKZ.y.=/.XF.\|.!"...Nu........^9...P.H..+......G..&.U.T...4BD.."..K=_~I..m..(Y,.'...k]&.n.m..3.....#D8.q...#..6rm0.U...;/.?......((...i...#D8.a\..x..+.......[.^.%w../U...w..m....O3D..!....t..n[3I5.....F.{d.>=.......\h.\.. N3D..!.)..4.4.BAY..l.z=.G..].z...5.O.Y.}1/..;...p...8.&.^I.rI.....[.mM..G_.%C..oR_.o..6..D.\|Z!"...N...2..X.~.]xU.h...T.........-.^.AIS.x.....uU....{.k_c2".....G.p......R.$-..6n....U.[.$......n...{.h.....5.@^.<.]W.O.......kU....oD..."....$...0.V..$..V......y.j..y..K?..T..m..XR.f{..E....]./.?.[..a....".>...p..'....t8...RJ~....W..)..iw6.}.w.Sw....5..Y..+j[F.d.]....W.K..i.......BD..".$...r.3..X.(o....OeT],......}...F..>Z....U.P.._.\...........\Kw.D.O3D..!.I..l.k.[4.4F5..T.+..U

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\358ED395.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	PNG image data, 155 x 116, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	16093
Entropy (8bit):	7.978579584793853
Encrypted:	false
SSDEEP:
MD5:	02E1FFAF1915905822BC02656AF153FA
SHA1:	755B15B5C8EA2714B348B26E6EFA532E202DA57B
SHA-256:	A74EA5640982A27F7D597687A37E0A9F6701897ECE3FFF786BF9450CE857BD9F
SHA-512:	503F83C959CB1BB35460773CF2EBB49A9BFDBAA3D4A86AE948784CC9D1792A48458ABE390B4B4DB73949FFE1CC0C440BBAA658B791FEE50FA6DF20F3B6331F4D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......t............sRGB.........gAMA......a.....pHYs...%...%.IR$...>rIDATx^..`\g.6<s.....f..m.N..$.$...6!...Y`.....KY.........C.%..K#.8..c9.%[...h4..v...;RbH.f...\|\|=.3s.{..>.<.e...^....VW...Y.iZaF7..Yg.$........4.CG.Y...t..G\|.wSC...P..13.x.......C..HDQU.c...U.U...+:.....u.3.Y.IQex.f6......n...6F..`:...m. ,..A..C.g%]...y......%....lb.6.E.oy..56..<..(..P.A.e%'.O.<..d....{......'KRuu...7.Z.R.y]..-v.2.5.....eav.."..F.3.C7....G....c...U.Fc'....=...-...bc..K.=..r,.v./.tCYI...cee.+W..x<XN.-.#.fp...,...........i../b.y,...s....U....eeB.M2...0 .I.}....@...D...jf..AOS..\|.Q..<?1=...g.;vlrz^R........hfM7....Da..."..<o.....::V.,[.Z,@.~.:61Q_W?....'.....Bc#..$.n........KV9.v4.[..9N0...5Bt.....;..(...@.......K...ONM=..cO.~.`s<......^.Q.a....Up..9lodd...l.K;;;.....,...\....#].u..pX.........I.../..]..s....d......^0....}I3..5..VR...p....8y...B.....o......`.u8......}M...../.9S..._~...g....`...r#k..iY....33v.mtt......NL.'.........e--...{D

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\4923B0E4.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	PNG image data, 270 x 87, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3960
Entropy (8bit):	7.85035397197527
Encrypted:	false
SSDEEP:
MD5:	A5B18494A54163672787DB695FAE18C1
SHA1:	0C71A9A923E6678138074A6F9477289F5449FAE5
SHA-256:	8B991DE32DF70F2122EA8AA455B92F8BDB74A74F373B3A703BD46A32D97F20B7
SHA-512:	965114A7C2CB9A70F1B8228E2ACD01F38913F872134F41C96D4E8BBE31F7BDDC5AA218B57F84921FCEBD9DEE46789D0D55436D9D97F8DCF99EC1DC91BA9C298D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......W......G......sRGB.........gAMA......a.....pHYs..!...!..........IDATx^.}.%e..g..sf..f)R.I..dH.Q.Y..FjQ....QA...i......A..%&Y..B..i...../gf.....=......s.~.....s.....f......s..k..'E.=....-...4i.X..J....P....u/...I..rK0G..........:.'.m..N.y!..YT.)5g.f9.i.4..lV..JX)...TCgU{'E.T{,...:..p#E...,...Q.k.#z+..R..{P.......".....Y..U.e.F..x.[.SN..I.9..&).0....+.\.it.-..<...j..Y.S..R..lB5t..v.CQ..>\|w.G)-..(o.bN..N.....f.Y....F..E.^A.j.......)z.z.ZY...E5t...e...u..K.......(o.b.3...p3...f..._.....cQ...T3E..i.yTCg.Gt.E.....].'E..N..I.9..&).0..u.I...q..L^..j...)j...Q...$^.(....^t...f..G.*..g.C..Ny.)E...x'..sW..FQ..=....J....7I1'P.$..fy...O...<.^H..J....N.t.FQ+"..F5t.Yt.E.f8.A.u..OZ.N..P....j.Z...b..F..:A...;.$.=.b+E.....'...."z...4.3E.f.........>w.V{!}TCgU.CQ+.....S.LQf.A..]9E.~....P.....i.48...Y-.K.e..<.z..cWF.z..Y.........Z....N.-x.E.I.}.l....L.j....(o.b..g..........UZ)...z.?....,......".2....L..u..MR...7I1..T.././..0..J..,l...kh.i.\|.V

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\4A1B1C92.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	PNG image data, 221 x 258, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	59729
Entropy (8bit):	7.987900656815908
Encrypted:	false
SSDEEP:
MD5:	4C19E098998FD5DC523300195F78AC15
SHA1:	956A08ABC16A82E8AF93B3358310D2D25748133F
SHA-256:	FED055D148BB190707C9DBB08E63B91713FB4C3DB12BCB88A55943AADB746040
SHA-512:	6618B9BB74B3A26D1D59B7549CFF643244CFC453B88A3864ED73C5AA98723A1A34E34AC49188EC80C16BA8AA0EE6069036F04B5D1C7EA76B8EE0140A6E0FCD4D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............E.....sRGB.........gAMA......a.....pHYs...%...%.IR$.....IDATx^..i.dYz.......fDdD...vwU......g.. M...D.h.../9f2..}.}.HF.y1...G.$r@. .......]....5.....}~..xDeGUgTC.@.P'==..{.9.y....{...l...\|Y.`.r\..<'-O..i.<..g4.\|../.+^.'..DC.d.Ox...br~.'?.....Q......{.,_.?G..<W..O22..y.g.?.\|....t....e....E.UO$8...r......z..../..XB~.k......w.}i&.,?..\|ks....'..........\|Y~.e-.......,>..KP~Y.".`.r/).%..KP~Y.....x?.x?>......K...IG.....?.....g]\...y.0.p..J?R.#3.N&........c..j.h8.G.@ ...z.~$.....N..aG...'..D<...i&..y....G..t...SO...d4.....G.Z..".H.?.......;...~.\|......#....M'P......d4.M.H....^.=...>..w0.u.m.k.`...^....K"..F...piq1...G.p$:.NG.a4..y}P>..B.P.P...^.....\|...<~....&......NJ(.....Og4...Z]H.'r..w.F..)_...i....'..}G..bb...._.".P.."........N;..g0u:....p(4.NK.G.^;.....G. ..n7...l...c.h<.D...T..H.....r.t{ 8..T...R.^.....4.....x..9>>.[.._.......ok.9.....o.....Gg..@C.p1$x..p.f.9....f.U.V..~".o5[.A?....T..\|....~ ..9...Z..D..T...

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\72E293E6.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	PNG image data, 369 x 137, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	6279
Entropy (8bit):	7.9629609853447265
Encrypted:	false
SSDEEP:
MD5:	7DA9A61F09BD53A999F2C44EFF7CD2D5
SHA1:	6797B744463B1AD13D1A7027ABAA3952A9E0CCE4
SHA-256:	83C5B2036EAAD7F952CA68A65F8E84B482B91D8B7CF51B902D49382FFBC63878
SHA-512:	C27760958B2190FDEDC6C298CFE5620C4332E169034B1B022757CF2A0052E1C56DA1075F6256A14573E4F98B009597DEF2B0E0E7474891FF9FF48D79003FD465
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...q............V....PLTE.....3#. ... .............0-..........FDDwuu..)....."...................................,(....E.....................NKL.............e>;;..v....gee......K...b``WUU..h?==523.....Z...rpq}.......IDATx..].w.:...h....u@..P.u.W......r......w..z.g.a.N.s..t3...`...k.0.....3.......?....d:..."I.....%)..J.q..U.i.'L.c%U.i&@R.2[m~I.....CR."....1.^./...:r...u.....Q..J...I/.....u.....vHW../.W`.V.....T........z.-(../..0.q.t.._o...V..6..+.X...P........l$..7..i=..:...}.Xu:..:f2O...u.;....\|..v..z.&n......1....}.....g......L.x.2.........$.$.......(.[D.Ri.Z..)SQ.w^......@W..~"..c..(.\|.......\1~s-D....'I..\.;..yb...?...p.t.nl..%.0....3...V..Y........._`.#\RZ....~.GR.G9.?........\.W...A....W?nOp.W>.E.I.gr.x..x..k..I.....9J....Jft..x...#.Hws......$K2#.M...a\|.0^.x.]Z.......J..].s .......\}...x..D..y....~.[.@..YS9.=...?d.\| ..!..o.{......Q.SL.....dp.....,.b..fp....1..c..m...i....S..3.....?..H..4......\......F).b.......

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\8DE526AF.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	PNG image data, 527 x 96, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	7036
Entropy (8bit):	7.953513912778157
Encrypted:	false
SSDEEP:
MD5:	96AF74F066B34F01D29C1BF087554C52
SHA1:	248ABE40FB726C987EF016BB8F3A3BCA0B055A4E
SHA-256:	CC9E1C1AD0E7E92369294E4646C76F79159D625CE49E744ACEBEC7C7AF08EFFC
SHA-512:	A3F6772FC48FDAB7B7B1E13D723BB9FA1DA8B8DDE79E4CE939F51FB0B7B71D7564CB49E52E84328803586C6D58BD71DF3FF27493F827DD8291AE188DF071207A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......`.......a6...3PLTE...... ...@@@...............```......ooo...000PPP.(p.....IDATx..}.:.n.Vc..O{%..4j.\..3..{.e..\|.B.~>.....C.].u....U.w..]..f./F.n..s.....)..&vV.@I.4.. ....}N......40.....y\.rjZ..\[....h....9..d.?..?...4...+EP....?.y..dV:.S...4..a.......B-n.E.X.3.(I....f......_#..q....A..I...=.D.3...Ef^.....h.yF.Lc.....r....B-<<\.#....gdG.x...)>...8.Ec...0...y........[.=.h.k.=<X,SY$.P....7C...Hq.X......_..V.G..../.W.OH......!-.....,.K....e.F.R...d.6..x.}.{..!....P.....kR..n.h.&.`8..k~.]<..+<,YW.dP.y.z.k.9g..&..Yh....,.d...67;+.9......S5.........&d-~.....+....y2.X.p.-..F.k.G{.p.F@.=V'~.Fi...jN.#.^.....AN`!.?A..n..A<..5..t!...K<<(.Q.@.1...0.Y...\|..x..B....s2_7.......p..i...vg.g.... 8gl...r;.<..e..n..<..G..{!HFn.\Po.<.......ec.i..........t.O?..=......x ....4\...M ..69.H:..U.)..w..vd='...uEc.1.....b1-.f....'...3..C .}5Ika..Y..^.w...j..v'..9...!.......3Q.F....C..so..$..x<...0.(....z.Yk.F<...Gl.Hz..u.8...E.yU........

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\Diagnostics\EXCEL\App1729504271598345200_5C856275-EEE5-4A24-8349-DBC88E78744F.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	ASCII text, with very long lines (857), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.011590307238908642
Encrypted:	false
SSDEEP:
MD5:	6B04F8870EBEB7A56F913DABABC6BF37
SHA1:	AFFA25781E1BA7C3A4846AB678A5364F328D3A3D
SHA-256:	1976D0EB23289CA8B07D3943EB8C7D9BE2E744A6003D83CFAF7621711789764A
SHA-512:	D12C29B2FEAC81DE95600C76790BF1A837F303161351583D2BD22AC9D182B3B5A962AAE5F7382E26D493ABEA13A76495B023D2C747B6C2882DAD12E5847510AC
Malicious:	false
Reputation:	unknown
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/21/2024 09:51:11.632.EXCEL (0x11F4).0xB48.Microsoft Excel.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":15,"Time":"2024-10-21T09:51:11.632Z","Contract":"Office.System.Activity","Activity.CV":"dWKFXOXuJEqDSdvIjnh0Tw.1.10","Activity.Duration":13,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/21/2024 09:51:11.648.EXCEL (0x11F4).0xB48.Microsoft Excel.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":17,"Time":"2024-10-21T09:51:11.648Z","Contract":"Office.System.Activity","Activity.CV":"dWKFXOXuJEqDSdvIjnh0Tw.1.11","Activity.Duration":12085,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVersion":4

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\Diagnostics\EXCEL\App1729504271601968200_5C856275-EEE5-4A24-8349-DBC88E78744F.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\E9928739.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	PNG image data, 3331 x 673, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	69141
Entropy (8bit):	7.061746523567722
Encrypted:	false
SSDEEP:
MD5:	3200BFEBAE3D6F2E08BE208E6644220D
SHA1:	08CF1ABDE6347801CC02BBACE93B3FB76147AB99
SHA-256:	0162A7C2E85D72DC2FBC0E319BA0475C27C01467BE11AF027715FDAC60C3995D
SHA-512:	28A59AA68470B07D7D1F123E506DD03F399D92D382D000CF56A9858651BF8B5AD5E0FD9B29B720EB8B39CEE5F81169DD16232EF93B7592A2949F4FDFEAD42964
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............^.Yt....pHYs.........g..R..8.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2019-10-22T12:07:15+02:00</xmp:CreateDate>. <xmp:ModifyDate>2022-09-25T16:17:57+02:00</xmp:ModifyDate>. <xmp:Metada

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\FD3D4E18.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	PNG image data, 411 x 397, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	48138
Entropy (8bit):	7.973856556595367
Encrypted:	false
SSDEEP:
MD5:	D3D02DB4E2177D62A6B87EC5B5736411
SHA1:	C55A9743D139017D19036664B6CD0057B0FC6494
SHA-256:	BAA20527EDD26BC2E44026BB9E5975380226ABA308A83F7B4CCCDE68677BD871
SHA-512:	55558A312A0D3E1C98D864ECA739685AD69EAA1151D92B48FE737C6138CD51D8C394FB538484DDEAEC446FEFAD11A595EE329CA5554B5825912B7FCF7A8765F0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................~....sRGB.........gAMA......a.....pHYs..2...2..(dZ.....IDATx^..`.E.......P....j:...jBH.H..(J.;"(..`..R-HQ.D@.....;.W\|.yf.&..M.0..r...{~{f...?()))))..l.....r\.6JJJJJ9...%%%%.........R.K.FIIII).`.......R.QRRRR.q).())))..l........q...<z..2E..H.FII.@..Y.j.j6.........)..).())..EFFb..oP.JW,X.;...U.S..`...T ............2.[......[..w).())..EE.`.y(........q........).()).[=..?.}.......0...w..c'....s.`..,[.B..).o).()).[1j.......8...9.e..o."..Kpu...[6.D.. ..%%.\|.G.=BhX8.4....b..p....{..1.5...Q.....l....B.".]....wk.w@..A8w.j,.).k).()).{.........s...5A.J..y.>Y..T0.`......7.d......].9^....DS8R.QRR...aC...B@...m.&...R......R.QLl,.....?.f..TP.`...T ..&.>..O.....U.M......R..a......v..9Y...I.FII...\|..x...8LuSS..`...T`D.,^..MZ..8....l..........A.......&..).()).(.=u......sW$\|....l.....n.........2i@.`H.FII.@)"..Zt.q. Ju.YP.`...T ....g.^.m{...P.../...B"UqZ......R....^...._.....]..J...{.~..0..k..A..1...u.*V..R.QRR.......B...T)..U.

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\mso8747.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3237
Entropy (8bit):	4.6317012858785604
Encrypted:	false
SSDEEP:
MD5:	B9E32D2158DA8850BFCB310250F64928
SHA1:	52D7DC0D96F70CEF6361072CF8BD72523AAC434E
SHA-256:	AEC3BEF4F6DB20C4100631C42089C3139A7083C01FAED8B26D5E0AB4C5E42D74
SHA-512:	9015603AFCF3ECEE75E8D10286C90582F7F44F346BB0A672DEEDAECCA3BA4423D8B8485367551CE5C6E946E1FDB978D8749A6B0B957A1B7465672BC765AF4C43
Malicious:	false
Reputation:	unknown
Preview:	PK..........!..!..............[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0...H...W.8p@.%.#.P...7.....}{6m...H...o<.W.iT{..ch.@a....7.y/.@......6pD.U{{So..I.:P..sz...2&.2.b...1.:..5=.z.6............. ..$.G..r^.Y...Fo.KR.......JQ.vh...$..y.7...j.w..&.$.v.sL$..X..,..E.#...'."Q*.?0v..(.w..^.\.Cw..O..~.......PK..........!...K............_rels/.rels ...(..............................................................................................................................

C:\Users\user\AppData\Local\Temp\79D18FE0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	1230
Entropy (8bit):	2.7146670657611214
Encrypted:	false
SSDEEP:
MD5:	7397F178FE0D4AB7699061BE22F7BE6A
SHA1:	7FE823620A11B85863A5B84DDFBEB5E2628B2388
SHA-256:	6889C46C86A3B76B701980C8DFABFF2F8F1A44AEEA6389C970C28145E689B046
SHA-512:	67D5D9BD04138A6454BD3558341708EB673369C1E9700F53347DA03457F630FCBD6BD41229A523F2A86E901AA0EA8A881D105E7A58D01F01F0DB9F87455A8A03
Malicious:	false
Reputation:	unknown
Preview:	3.7.4.6.3.7.6.,.1.1.9.6.3.7.8.,.1.7.8.8.6.5.8.,.2.5.5.0.5.0.8.8.,.1.2.5.,.1.1.9.,.3.0.0.4.9.2.6.8.,.3.7.4.6.2.5.9.,.7.0.0.9.9.8.4.,.1.2.2.3.4.3.4.,.4.5.8.4.0.2.3.2.,.3.7.4.6.2.6.5.,.3.7.4.6.2.5.8.,.;.1.2.2.0.7.7.9.,.3.2.9.4.5.8.7.9.9.,.3.7.4.6.3.7.8.,.1.7.6.1.9.5.9.,.6.3.6.4.3.3.4.,.3.0.1.5.3.7.2.1.,.2.3.7.1.6.5.1.,.1.0.0.1.,.6.5.4.0.2.1.5.,.2.4.6.0.9.2.5.8.,.4.0.6.9.3.5.8.2.,.1.0.4.9.5.2.3.4.,.6.3.6.4.3.1.8.,.3.0.1.2.3.4.6.6.,.2.7.1.5.3.4.9.7.,.6.3.7.1.6.9.4.,.8.7.4.7.0.1.5.3.,.5.9.2.2.3.4.2.3.,.5.7.9.9.9.6.6.1.,.1.5.6.1.9.5.8.,.6.3.0.6.3.0.9.9.,.2.7.3.6.0.0.9.5.,.5.8.4.2.5.8.6.0.,.6.3.6.4.3.3.7.,.6.1.7.0.7.3.0.7.,.6.3.6.4.3.3.0.,.6.3.6.4.3.3.1.,.6.7.4.8.3.9.6.1.4.,.3.3.7.9.1.6.2.,.4.7.3.8.2.9.4.8.,.1.6.5.7.4.5.3.,.1.0.6.9.5.5.2.,.1.6.5.7.4.5.2.,.5.2.9.1.0.0.0.0.,.1.3.5.2.5.8.6.,.1.3.5.2.5.8.7.,.1.7.7.1.6.5.7.,.1.0.2.3.8.6.4.,.1.0.2.3.6.3.8.,.6.3.7.1.6.9.5.,.4.8.1.9.5.5.3.8.,.1.4.6.1.9.5.3.,.6.3.6.4.3.3.2.,.3.2.0.5.9.2.7.6.7.,.3.7.4.6.3.7.9.,.3.7.4.6.3.6.9.,.6.1.7.0.7.3.0.5.,.3.1.4.1.

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241021T0550250967-6964.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	114688
Entropy (8bit):	4.625950176110524
Encrypted:	false
SSDEEP:
MD5:	3225D21A526CE6A06C4F0E0A04595B51
SHA1:	0CF8D3306E1A9B63C690A331C41BB252975E226D
SHA-256:	A6F2A2DB3116B3B0BF5BC5BF3501C06BC20A5CB11C24167D38F05109AABBCA82
SHA-512:	0D696FAEAADF11DC12D02B907429C9F66791187F9772841165CB04473AB0D43FDED675674CB1D7CB7C5E3CBFF884E91E6B9A1CB4CB91699433124259F64B6CC8
Malicious:	false
Reputation:	unknown
Preview:	............................................................................`...8...4........#..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................&...Y...............#..........v.2._.O.U.T.L.O.O.K.:.1.b.3.4.:.e.6.a.9.9.1.9.d.5.1.e.e.4.7.4.0.8.d.9.a.3.6.1.c.2.2.f.6.5.e.6.5...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.2.1.T.0.5.5.0.2.5.0.9.6.7.-.6.9.6.4...e.t.l.......P.P.8...4........#..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\olkD368.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	200292
Entropy (8bit):	7.7580337599469
Encrypted:	false
SSDEEP:
MD5:	6A4B78DB9F84F47D3DB22F55AA54A864
SHA1:	CF3B15AC80D19518E7F30FAC1824AFA9448E3A57
SHA-256:	9A71E21CF395599268C9970381BBD66EDAA98F02EADEC1B236264EFE44556124
SHA-512:	C492509F3837C991D6B0137DFC46A6D40BCAB38AF1A19E1E237153434D54FB92F543AC301E06D06AABD932441794DE85673F91424BE8C4326F6DF76C72506446
Malicious:	false
Reputation:	unknown
Preview:	XT...._......e.....k..GD@l..V.u.......<......].Z..RF.`.....1S..R.e....[_.~H...$...I....JV.2.{....1....~....Y..{1.!xX<.z.p..;..p.n.&...U.......:...(`...)?.&`...U..T..l.X.s..m<....=......p=.ki..I.MjF...wt.....0...].]......25..x.....x_.00$<......w.E.q..r.J.x..._E.f}P.l;s....G...k..1)..CE>...'..;p.N..ae.JT.[...h(....b..q.....\| ......?.{S.a..?p..Y.....2...q.4......X..V\|.x.*6}...?y..=.Ky].2&..\|&..}../x4....e.9W._..){..I).l.5l.D.......\|....K.....?`..e.....kK.n............l.FN.\...H.&.)$,.c.-.].9....x{~w.2...M.F..6.7'.+.7..V...v...,@.s.!..}...pDFE.h..Sg.d.`.u7i...[.!....w./.R...b.q.n.^y.....m+z.6..n?...3].6)......A_.L....R......ZF..KE........b1\\|\|..e.{.$82g.1g..k..Xy=.2&..<....g..9...8...7r.4..M.F..lz..a.y....b.~..PTt...6...\._....=+...L].]...7.X.a.y...J(.W.6.(>.4.;J._R{...o.q..Mr.~.h......-).lTn.F.-;...>........5.Y....?/;&e].+.......D.'.6.Z....x~....>R4B...y.J....{..q.~(..'._?v.2v.8...N`....06l;.u[.b....u......-.~..=.G..c....:......NRO.}........

C:\Users\user\AppData\Roaming\Microsoft\Excel\Excel15.xlb (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Applesoft BASIC program data, first line number 16
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	5F9F0C2645813B127FE515D32808CEFF
SHA1:	A63FBDF6761936536EFB920E06B696AC35735F14
SHA-256:	32BB853F754937168C8B7E5532E7CD0DFB62752AB461AE63E5BD9DB17DC400CF
SHA-512:	D52CAD21BF690A4665270F27F4C845461477F6B7EDCAEF497A2B0E167D7801117D8E8552E6F5D4F99540E47FA257472D6CD95565D81C8CCAB4A2BABE6847D036
Malicious:	false
Reputation:	unknown
Preview:	........ZO.......................................................q...q...............q...q...............q...q.....................................................................................................................#.h.#.h.............#.h.#.h.............#.h.#.h..................................#.1.#.1.............#.1.#.1.............#.1.#.1..................................#...#...............#...#...............#...#....................................#.,.#.,.............#.,.#.,.............#.,.#.,......................................................................................................................................................................................................_..._..............._..._..............._..._................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Excel\FC630000

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Applesoft BASIC program data, first line number 16
Category:	dropped
Size (bytes):	10428
Entropy (8bit):	3.4700900910032932
Encrypted:	false
SSDEEP:
MD5:	5F9F0C2645813B127FE515D32808CEFF
SHA1:	A63FBDF6761936536EFB920E06B696AC35735F14
SHA-256:	32BB853F754937168C8B7E5532E7CD0DFB62752AB461AE63E5BD9DB17DC400CF
SHA-512:	D52CAD21BF690A4665270F27F4C845461477F6B7EDCAEF497A2B0E167D7801117D8E8552E6F5D4F99540E47FA257472D6CD95565D81C8CCAB4A2BABE6847D036
Malicious:	false
Reputation:	unknown
Preview:	........ZO.......................................................q...q...............q...q...............q...q.....................................................................................................................#.h.#.h.............#.h.#.h.............#.h.#.h..................................#.1.#.1.............#.1.#.1.............#.1.#.1..................................#...#...............#...#...............#...#....................................#.,.#.,.............#.,.#.,.............#.,.#.,......................................................................................................................................................................................................_..._..............._..._..............._..._................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:
MD5:	697552832226EFEE9B478CFE6BCB2C55
SHA1:	5F453B2CF7999AECE9BE3358B21E76217EA6E03F
SHA-256:	03393A638E973EA807FBFA6C0C38847BC9C3DDE3477B005D5AF963B14AB2FE24
SHA-512:	76DEBD80534E6CA99C567E9AE54A5F1D0599F2CA176F36A520CD1D2254CE8B3A9B878F83336EE12EAA9E6722EF59755231D8ED0A8428CF7ED7695E289D7BA642
Malicious:	false
Reputation:	unknown
Preview:	....=.........................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.021954885049738
Encrypted:	false
SSDEEP:
MD5:	1031078A039FA4867BE955C1FF0B9178
SHA1:	9A844F5BFA4DA9A7925DD39BA8AB80F90F233EEA
SHA-256:	1700E4A46BD2B0BE639959A140F12BC28CFA596679FAFA3581BB077092142B1A
SHA-512:	ECA37D737520D9883B48ABAB941536F4487CC0D2A677F79F8671934B288826B151D871F2E3DCC566C0D4FC4B1CC4EE4B0676F45BCEC21D148B33BFB3A189649E
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	0609F276F21984C021166A3AE90A7FCA
SHA1:	79931D2B3B5A970214B624D0CCF08E98831AE6AD
SHA-256:	7B88C03AC3B09CF5C600303CE812633CE06A42124CC36F132746E78D364BF848
SHA-512:	94C5BF1BAABB5B949932244AE36542325519A58B868C3F29E5F73087AC9B7E96F913D9AD43DF13BC4BA5A1D90D763589B29729F2C29DBB90358EE05C0E04EEE5
Malicious:	false
Reputation:	unknown
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	3.782482493156145
Encrypted:	false
SSDEEP:
MD5:	0A0FD2C7EF91432DBB602ECC2C9DD8C0
SHA1:	53A610C4F1439EE992ECDE1D24847CF0D64D37DB
SHA-256:	3917FB525B16319636305354B119B28AA9E22CF93E489A9C0566EB0824C52355
SHA-512:	0A868E359EC005AC7C60A00584B6B5F1592B27E4FD2E1B53BB9E6A778EB40C6A1575F009E3A5F9852465417BC76D46635F3A9AC068F744704697F8684F2EC641
Malicious:	false
Reputation:	unknown
Preview:	.user...................................................c.a.l.i....C/..<.u.... ....2...X/.Xz.cM...hC/...Qb.... ....2...i/..p..p.v.p.v.M...........p.v. ... Y/..i/.

C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19609
Entropy (8bit):	7.478686904879618
Encrypted:	false
SSDEEP:
MD5:	0609F276F21984C021166A3AE90A7FCA
SHA1:	79931D2B3B5A970214B624D0CCF08E98831AE6AD
SHA-256:	7B88C03AC3B09CF5C600303CE812633CE06A42124CC36F132746E78D364BF848
SHA-512:	94C5BF1BAABB5B949932244AE36542325519A58B868C3F29E5F73087AC9B7E96F913D9AD43DF13BC4BA5A1D90D763589B29729F2C29DBB90358EE05C0E04EEE5
Malicious:	false
Reputation:	unknown
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	2.699513850319966
Encrypted:	false
SSDEEP:
MD5:	C5A12EA2F9C2D2A79155C1BC161C350C
SHA1:	75004B4B6C6C4EE37BE7C3FD7EE4AF4A531A1B1A
SHA-256:	61EC0DAA23CBC92167446DADEFB919D86E592A31EBBD0AB56E64148EBF82152D
SHA-512:	B3D5AF7C4A9CB09D27F0522671503654D06891740C36D3089BB5CB21E46AB235B0FA3DC2585A383B9F89F5C6DAE78F49F72B0AD58E6862DE39F440C4D6FF460B
Malicious:	false
Reputation:	unknown
Preview:	..c.a.l.i.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:52:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9867084069136993
Encrypted:	false
SSDEEP:
MD5:	55E614E14E645E062F61C57FBF9ACC45
SHA1:	7B643C593DB658089882C3623E35F950B43522CE
SHA-256:	4D4CD0F1F781209FD0AFE5970BF6C6C946CAA09DD50F9D7B265E62198C3C6D87
SHA-512:	E9FF866D9A7A64DB94F909C54ACF8C1525BFBE5D212F2F2A82B10079162C3DFDD3CE2B1E22A3ED6B20E2D190F93CC5EBAD332ECEB3A5E95B81D89B447C3D95E6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IUYDN....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY.N....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUY.N....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUY.N..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUY.N...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............q[.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:52:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.003948760275371
Encrypted:	false
SSDEEP:
MD5:	523016A3933B8C1E0422074DEC51E15C
SHA1:	6361085487CD316364FB326B9047F520F7FF0536
SHA-256:	5C41535B05ABA56AC3803F33B7094874AFAB0BB028E4F81A24A572071C4C08E9
SHA-512:	629A75E2205E6126FBE987E785FCBA35D9A22A1E903818A8971CBB6A19C04F3C13D36719E953111BA506946F623046449E47D39EE709835993EED2F70FBF41D1
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....\..#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IUYDN....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY.N....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUY.N....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUY.N..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUY.N...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............q[.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.009675368383242
Encrypted:	false
SSDEEP:
MD5:	F7F47A559B165768A2B423205C88D79A
SHA1:	BBC2F129268085D3972B533F25D0D6EF2401DEB4
SHA-256:	AB11262372893FC2097EB42D5E9D05F449FB62E7AF001DC96100482A8C31CA66
SHA-512:	B719C081EE15158F26EBA5D7E9ECCBF5F406C43B443A2ACA2DE8602BF8EA86E90DFE847914C2F2328F6C7DCF1B8832C159635240B8EB964DCAA1B5C160ED68EB
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IUYDN....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY.N....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUY.N....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUY.N..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............q[.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:52:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.001512522164512
Encrypted:	false
SSDEEP:
MD5:	B41BB293869D4EC6007E40391C00CA2F
SHA1:	34CEF19E359264BBE81EF32E9AA497CD53F34A3E
SHA-256:	94081189C713BA4540FE7920F4561AF67B75DFFF79E5151EFA99E6C348B78D87
SHA-512:	CD5FBBADB37EAB4250307343915A36712C4F97006B057D6AB85D64B10425124546270523B5D01032761339C5CBBD7CD4BF3A7E951C6A01040A87BE017F227E9E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....`..#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IUYDN....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY.N....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUY.N....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUY.N..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUY.N...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............q[.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:52:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.990313427170383
Encrypted:	false
SSDEEP:
MD5:	1DE39CAA39C6A5D5AF9D0AE3070F1AA0
SHA1:	C1043DD530122E5E69AA9149EE0D79F5CD78D995
SHA-256:	4EE738C6E4494D85FB630133B479D199CF9C67396F89FDA885F6E5E5049621A6
SHA-512:	6BEB253F8E7E4EAF0FDD56B668811FFB0D2044097EFF59454743334F34A05110A4E96E9C4D7A1779A6FAFCDAF702B471EEFD26143C235CB5A0177F62876B1351
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IUYDN....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY.N....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUY.N....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUY.N..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUY.N...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............q[.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 08:52:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9995881263749036
Encrypted:	false
SSDEEP:
MD5:	06C4E219E8877496B39181FEE3031628
SHA1:	57B5C29A6ED9AF401D82801DF172198FA17B55E2
SHA-256:	D569548B15BC39C7B1F6F35338FE48840990EBF45DB7A51E9DD950E3DFAA4F6E
SHA-512:	D16BFCFBBF8CE26974AE617087C4020222A01F209C48956EC03C2BB02075F210217320C328DCDC8D601CC12B2D0FBF682B7C676FAEF11310F019E8A0558D6B71
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....zc..#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IUYDN....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUY.N....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUY.N....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUY.N..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUY.N...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............q[.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	2302976
Entropy (8bit):	2.3003329241202697
Encrypted:	false
SSDEEP:
MD5:	2D124B81537E42AC7D9134C43C6322D9
SHA1:	05AEB69768755D8445027DA6593398824CEE87B9
SHA-256:	90B98AE631D32C0E9D3E5CE77E913D635C62F10B87B8849054FEF8196FA6DF32
SHA-512:	C4531A00370E8C711E677D09EBBEDAC2D753EA9FFCD6F8860F9633FEA063F04F85FDE95E0EC16DBED55A1CE3815C95D47102BFB90C6C7658555C60F252A84B12
Malicious:	false
Reputation:	unknown
Preview:	!BDN.:..SM......\...............P.......{................@...........@...@...................................@...........................................................................$#......D........".............E...............H...........................................................................................................................................................................................................................................................................................0.......=.j.X.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	524288
Entropy (8bit):	6.99390863315539
Encrypted:	false
SSDEEP:
MD5:	5A787516CB794F3256D6EF989700B7B3
SHA1:	ADCBD075CBCFC92672F264EFF82E99498F5897DD
SHA-256:	E3DAEDBD32965B97F516FE81A678B217C00AE926FDE12C6796F746F65195F4DD
SHA-512:	405D6F893DBE53C6E6F30041F4F799AF96E46BA807DD76474835D42368D6490919601E5356CAD593753BF41F2C0FCE05E6B95706BF39E4A64CF99CA48968F87D
Malicious:	false
Reputation:	unknown
Preview:	.A.0...........4.....f..#....................#.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................t<...........#.0...........4.....f..#.......$............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 967

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4226)
Category:	downloaded
Size (bytes):	4231
Entropy (8bit):	5.835052078287081
Encrypted:	false
SSDEEP:
MD5:	53E30001E4CCA8CF052A8858B21122BA
SHA1:	FA2B3A744480051AFE947608866EEA43BCEE8A03
SHA-256:	940DF410E0CFB2AEC782064F98C9846458B84A3527607783689A18B8FBCB5026
SHA-512:	14EB8616F3AF970AE492F9D32E14E040026F0172A347BA3C88DAA5C5D8040F87B5682D1F62B2FB433D0B5A04DF566BE1CD016EDBC1425D3B558131034DDBF46E
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["mls cup playoffs","usps mail carriers tentative contract","apple macbook pro m4","the lincoln lawyer season 3 episodes","weather warnings storm ashley met office","lunchly mold cheese","arkansas razorbacks","cod black ops 6"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgovbS8wM2hmeDZjEg1Gb290YmFsbCB0ZWFtMu4KZGF0YTppbWFnZS9wbmc7YmFzZTY0LGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFFQUFBQUFjQ0FNQUFBRG0rMGxnQUFBQTIxQk1WRVgvLy8rZElqVUFBQUNlSWpXaEl6WlpFeDVnRlNCNUdpbGRGQitYSVRPRkhTMlBIekJ1R0NXQkhDeFJFaHRjQUFCQkRoWTJEQkpDQUFESnk4dFZBQUQ0K2ZrN0RSUWdCd3NzQ1EveTgvTkdEeGhhQUFob0FBQk5BQUFsQ0F4SUFBQTFBQUNhbTV1SGhvYWpwNmJwNnVseWRYVldXMXMyTkRVUUZCTk9TVXA4ZUhqWTJkbFdPajJ1c2JCakFCV1ZGeXlJRGlST0xUR0RBQk5nWEYxc1ptWjRCeDRTQkFaS0FCRzh3Y0JqVkZaS016VXJPRGRCSnlwMUFBeFhSRVpaQUJVekpTYU5BQjk4S2p

Chrome Cache Entry: 968

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 969

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133794
Entropy (8bit):	5.434622489356859
Encrypted:	false
SSDEEP:
MD5:	A9298AEBC49F239A505FC5B9300BAEC5
SHA1:	1D9D46B9EC1921B7A5DB6B999A81B759EDBF9880
SHA-256:	F2ABF4632845212373DE3CDCCB401A39077148E360FA5B6EEFB7423063A0F333
SHA-512:	1C9BE230D75044662E891EE5AE4812F0C6D2D7CC4E6DB45CA1E9B1CB1B1F217C59047B831C9D7D607D25F523B3DEDA4BF3C50C19AD0C684EF9FC50E2D3E28C3C
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 970

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 971

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.w7uZcIyFZsQ.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTtQO3fUcONTNQ0-jEHtQyhEn9DXYw"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Static File Info

General

File type:	RFC 822 mail, ASCII text, with very long lines (347), with CRLF line terminators
Entropy (8bit):	6.068364451826333
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	email.eml
File size:	528'851 bytes
MD5:	2d18b85cc5f0d0da838d9b337a55a5ac
SHA1:	c3d5afc9bb359666eb72d3d1caffb0bdd01b4dd4
SHA256:	c73ee54eb46678a9a0580e0a9c7c78d7b28d4795bd6eb800a619e43de7a7f66b
SHA512:	b71b8e8f41a66ec79fff444dbd1bf4fec5ac69ebe0d8904906c0615ae0f4dc5a12f1e1f9fc04b3f3022c19019a3bee04870742ba6aaf91c6beba07551575d469
SSDEEP:	12288:98sFGlSlqYd9qY+pdnQrFCdNyC1z7XDJK/cYwZyvyMQLpawbG:5lhBhoNyC1z7DJK/wMvypLswS
TLSH:	DEB412393E035DDB4B3261E2BDDEBCC15ECDBB57918195F026AE493115AC0E4CAF2A21
File Content Preview:	Received: from DU0PR03MB9080.eurprd03.prod.outlook.com (2603:10a6:10:467::19).. by AS2PR03MB9586.eurprd03.prod.outlook.com with HTTPS; Thu, 17 Oct 2024.. 09:14:03 +0000..ARC-Seal: i=2; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=fail;.. b=tY9FDv

Static Mail

General

Subject:	WF000792
From:	BROGAN Simon <Simon.BROGAN@egis-group.com>
To:	BAILEY Simon <Simon.BAILEY@egis-group.com>, MUDAMBI Simbarashe <Simbarashe.MUDAMBI@egis-group.com>, DUNDAR Tarik <Tarik.DUNDAR@egis-group.com>, HASHEM Mohamed <Mohamed.HASHEM@egis-group.com>, BETTE Nina <nina.bette@socotec.com>, MASWIR Devid <Devid.MASWIR@egis-group.com>, RAAFAT Walid <Walid.RAAFAT@egis-group.com>
Cc:	FARAHAT Diaa <Diaa.FARAHAT@egis-group.com>
BCC:	FARAHAT Diaa <Diaa.FARAHAT@egis-group.com>
Date:	Thu, 17 Oct 2024 09:06:32 +0000
Communications:	EXTERNAL SENDER: Do not click any links or open any attachments unless you trust the sender and know the content is safe. EXPEDITEUR EXTERNE: Ne cliquez sur aucun lien et n'ouvrez aucune piece jointe a moins qu'ils ne proviennent d'un expediteur fiable, ou que vous ayez l'assurance que le contenu provient d'une source sure. Hi all see attached the WF000792 Cable trunking and traywork method statement for any further comment Regards Simon Brogan Systems Dept \| Interface / Integration Manager Abu Qir Metro PMC Cell: +010 10048489 \| UK Cell phone: +44 7856745222 Simon.Brogan@egis-group.com<mailto:Simon.Brogan@egis-group.com> \| www.egis-group.com [egis-group.com]<https://urldefense.com/v3/__http://www.egis-group.com/__;!!PWAseTJI!-O7PTdTb4pClaGGCcs9sM7MegcMcDkEbZO_TzV4oOPDVqz1EIUsOTWht405qvmG3dXyTdHsLHTSyn0NWyoUfXQvwYRY$> Floor 4, Makateb Building, Banks Centre Street, New Cairo, Egypt [cid:image001.png@01DB208C.FFFBBD80] [egis-group.com]<https://urldefense.com/v3/__https://www.egis-group.com/__;!!PWAseTJI!-O7PTdTb4pClaGGCcs9sM7MegcMcDkEbZO_TzV4oOPDVqz1EIUsOTWht405qvmG3dXyTdHsLHTSyn0NWyoUfa5BDbOk$> ________________________________ Ce message et ses pi?ces jointes peuvent contenir des informations confidentielles ou privil?gi?es et ne doivent donc pas ?tre diffus?s, exploit?s ou copi?s sans autorisation. Si vous avez re?u ce message par erreur, merci de le signaler ? l'exp?diteur et le d?truire ainsi que les pi?ces jointes. Les messages ?lectroniques ?tant susceptibles d'alt?ration, Egis d?cline toute responsabilit? si ce message a ?t? alt?r?, d?form? ou falsifi?. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Egis is not liable for messages that have been modified, changed or falsified. Thank you. ________________________________
Attachments:	940-CJV-000-GEN-MOS-00001_DRS (A) - Copy.xlsx

Headers

Key	Value
Received	from AS8PR06MB7589.eurprd06.prod.outlook.com ([fe80::3bb0:30dc:4437:e439]) by AS8PR06MB7589.eurprd06.prod.outlook.com ([fe80::3bb0:30dc:4437:e439%3]) with mapi id 15.20.8069.016; Thu, 17 Oct 2024 09:06:32 +0000
ARC-Seal	i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=erPKR64WVzCdjvcr6qnUcC+7aVs93bTDHEX5IjALiGSwV2zrSPWUx4YRoAP5ZnpHMkL8N7b4oc1c5wpgNXiEnzIhQFqv1zVUAmfLqWY1JV3uZHlwGilBP1DXqL9DHQ1WbMkjBLPTTdynDXAuHeL3Cmk/YZZ7pZRjaiaCAMM8guiNjMFKt66Z8D4WIv30y0BOMqEgopPG6cE+FY5RJXxTnGveMx6Wu5dDGWwyKODfhC5kli2ar/37JPDHA4Jq/WGNiLZzzHz5OTsCTuwLepoxRgCseepwmcZDUOHmL2CKzXg2FAmez3OJrien33nsYmBh3N/JPmk5iigUhDiGEMMKLQ==
ARC-Message-Signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=dPVCkbyjseRrw2CEFRHqSRCWz4sTLZx4Wzh8O7brn6U=; b=Jl9FOfRypQfR5m85Stw45FHVUFZkiMJCMwFes8MqA9IQZLyekPZv5x+vF3TL6xwZvo7Ot8945BsZ8wNZmMObWx6gYHgKJXLevG+XhYnEWc0Cqlsik6vqQuzaBa9mmeZkNZuS8pZFeVaNiQpKcPMDYl/uRJPc0z2YGnDkb88uhdjUlK9gbzepa96NBLbpKadBsht1Mh/edaT5nDxXrF+TrL6POTS7mCgfwvJXY749BIxpABd1jBpuQmD9sTqCjjjMgZTUU+sEnZCIUVzxQzncdshAjEAgQV30xoF35JV+hFKIz/aD2snYAd8ufyCLIUd3ApZJ/sGEsP3umHIg/miLFA==
ARC-Authentication-Results	i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=egis-group.com; dmarc=pass action=none header.from=egis-group.com; dkim=pass header.d=egis-group.com; arc=none
Authentication-Results	spf=fail (sender IP is 91.207.212.148) smtp.mailfrom=egis-group.com; dkim=fail (body hash did not verify) header.d=egis-group.com;dmarc=none action=none header.from=egis-group.com;compauth=none reason=405
Received-SPF	Fail (protection.outlook.com: domain of egis-group.com does not designate 91.207.212.148 as permitted sender) receiver=protection.outlook.com; client-ip=91.207.212.148; helo=mx07-001ef801.pphosted.com;
Authentication-Results-Original	ppops.net; spf=pass smtp.mailfrom=simon.brogan@egis-group.com
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=egis-group.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dPVCkbyjseRrw2CEFRHqSRCWz4sTLZx4Wzh8O7brn6U=; b=SFURnIIXrTHvr0fsKotloBbnfqb7bZOrZXmrSInB7tM67nTeSYRsvSAv6ToW0eNG/0Oqjr0txtdsi/jbkoAUfm0AfCyTbhDnHmBCCSVRqx//dFGUPR8OsGuLjCKp4OKbnI8euv6dmUKobQEhJWs3w6cB2pSaFsd4Jx8Hm8M7/LLDi+t2VWCxdELQJ9/T8F7QT8PmEhGIikO8sHpms9o7q1JgoaN3g2Mt22LJQhpLXlaAI4h6CoXNWuiRP1hmRg8siK8D6zRHgtJ3p/Zs6zqtlWLz4DoHykClR2ew3KtLDctNO5/xJAIhZ+CCzcyTwMbrmSXfcVB40XPQ5Mkx0rQivw==
From	BROGAN Simon <Simon.BROGAN@egis-group.com>
To	BAILEY Simon <Simon.BAILEY@egis-group.com>, MUDAMBI Simbarashe <Simbarashe.MUDAMBI@egis-group.com>, DUNDAR Tarik <Tarik.DUNDAR@egis-group.com>, HASHEM Mohamed <Mohamed.HASHEM@egis-group.com>, BETTE Nina <nina.bette@socotec.com>, MASWIR Devid <Devid.MASWIR@egis-group.com>, RAAFAT Walid <Walid.RAAFAT@egis-group.com>
CC	FARAHAT Diaa <Diaa.FARAHAT@egis-group.com>
Subject	WF000792
Thread-Topic	WF000792
Thread-Index	Adsgc4gvNkP95fYCQX+6TO6WMl6P5g==
Date	Thu, 17 Oct 2024 09:06:32 +0000
Message-ID	<AS8PR06MB75891F145431AB8971E2DD1EB0472@AS8PR06MB7589.eurprd06.prod.outlook.com>
Accept-Language	en-GB, en-US
Content-Language	en-US
X-MS-Has-Attach	yes
X-MS-TNEF-Correlator
x-ms-traffictypediagnostic	AS8PR06MB7589:EE_\|AM9PR06MB7266:EE_\|AMS0EPF000001A5:EE_\|DU0PR03MB9080:EE_\|AS2PR03MB9586:EE_
X-MS-Office365-Filtering-Correlation-Id	253c1745-d342-4d10-0c9c-08dcee8b6c77
x-ld-processed	a5877034-8d6a-496a-8cf8-ceb5e3451109,ExtAddr
x-ms-exchange-senderadcheck	1
x-ms-exchange-antispam-relay	0
X-Microsoft-Antispam-Untrusted	BCL:0;ARA:13230040\|376014\|366016\|1800799024\|38070700018\|8096899003;
X-Microsoft-Antispam-Message-Info-Original	fNoTbPxzihhtZ/4VgT3wlP2Sy7URz0y8yyzZC3MCvSxLCIwj1MEF9eYAdJU2Z6rKkshZAx2c+LwjXBNVs8MdWUUdHrfj2MQkUINZL4fxF4i2xaF/jQTmmQnMLXefkiiY4spXJaHOTCgeyC9F0hsAHZqTpiR4Lz3Gst45O8pP5+vOQgjf6PkibvYWqbXcduUWxM9FLvRr8bbbw0yAJxlFIK7j7OvB/li1qhR8/vCutrwCvexIvxNiHjdTLEakwVDMLv3tHT/xtkgJIp4Gsz5zDX0tD6sFKddXkeZdJbqyUvEI40YI3cbLRAOO2T7DffwxG3YA+ktN7xBWuF9nGd769I5ON9Yt+snhDdWVk/0SGmoEEAe1pJAqb73elbXNrbWl2VSAk/ISya4Fn2yx5EAXXwkfc4hXGDFNQdz7gYlBlng7WRgUnpE7wyFvkppM+Ra3DOH42fVLSjSdFKCdpBeP97ZTm8PAILEUbx8HF/V9ieyC4rSPYj+vjkjufl8v2MZBCPtYrt4YfMAzeS6jYY/f0+epgbvM7R0icO1uOelkTxxx0lXXia6UJu0l2VL1TGBoI/u9OIMM2NaJj8DTZQ+nUA0bboJgGs/fDfQt2KQGf3Mh0aMi7XBQvMjOooYXAL4Rpmy7ZPKsr/XqT3nxHTX/SrRaeMAVMKo2+D0ku7KB+C46AcLraCamsDkJr/xnEsYf9ou4v5Tr7i1uLCf8k45mpXpab3l+qeyQ8es8RZl8xYuxlQBfE1e7x2UAGj87x14FJwGAApVVU3tPTDjiIOZZ2nBtiB4i5h+l2V9PxKiz+FcccgDIIFTxziAZ503PqSKxHcmuKebQI5bgn9d/ESc/b/B5JBOrJX43FdfDykGvDn0YRX6UXPeUS4fxufVBPWFc6otfrpqF6js6v2oiwYo/Fzxuoqy1v/naTdMOsrGuapcnVdy/O0N+w+GebLsnH5lgnnTVwvdnf1EelZDCUDTUOJ8AsPYRjFICdwvwpTpVOEDDG+2Qe2kSGxweDqBVHlgGr5XfU/JevdhynwBN9+rPMzA6LSYG0fR0LgjTIfzsVzrEXSVPC8klx2KPvJFAK9cCNoTyTGpF20Gr9VNcJHPxmW0W/LSWREMTMP3Y+s6lJ+6VrTjyWXA6iNZdhqI1750thVbJf3BEz8291QUYsGwBidcFZlqWA7Z1ojfGbIx0F7Mc4MleHgvu+iKuhdLLy602yD1/ophqSxG6dWPzGDf0ltNRZSwtlM9GgJFTlFqrpkp+E8S56YIFWj7Tm/pNKXW4
X-Forefront-Antispam-Report-Untrusted	CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS8PR06MB7589.eurprd06.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(38070700018)(8096899003);DIR:OUT;SFP:1101;
Content-Type	multipart/mixed; boundary="_006_AS8PR06MB75891F145431AB8971E2DD1EB0472AS8PR06MB7589eurp_"
X-MS-Exchange-Transport-CrossTenantHeadersStamped	DU0PR03MB9080
X-Proofpoint-GUID	vkS5bAmD9MfINR5eed40g0eX0jKSgOy_
X-Proofpoint-ORIG-GUID	nXiUxbWwjR9ywX9AKbqkqiKyd22W0asi
X-CLX-Shades	MLX
X-CLX-Response	1TFkXGBoRCkx6FxoRCllEF2BzY0VQf0wdXE1vEQpYWBdgXxlrZnlvUlJSYRE KeE4XbXxuG19LYBhhchkRCnlMF2dMTkwSX2VdHnMfEQpDSBcfGxEKQ1kXGhEKQ0kXGgQaGhoRCl lNF2dmchEKX1kXGRobEQpfTRdnZnIRCllJFxgZcRsGHh93BhgaGgYbGhpCGxkGGgYHGBgGGnEaE Bp3BhoGGgYaBhoGGgYacRoQGncGGhEKWV4XaG55EQpJRhdZRUlFXk9JdUJFWV5PThEKSUcXeE9N EQpDThdEckN/Ukh9XUB4E1NdchNrYUhbQVtDYVNOGBh9GktZQxEKWFwXHwQaBBkdHQUbGgQSGgQ bGR4EGR8QGx4aHxoRCl5ZF094REBYEQpNXBcHHh8RCkxaF2lra2sRCkxGF29ra2Nra2sRCkJPF2 kcGVJ7RGNeYEwZEQpDWhceGgQbGh0EGBsEEhkRCkJeFxsRCkReFx0RCkRJFxsRCkJFF2hZcEh4W RJhaBpOEQpCThdtfG4bX0tgGGFyGREKQkwXYF8Za2Z5b1JSUmERCkJsF25sbml7f2dNexNrEQpC QBdiYltoRwV/H0JdQhEKQlgXbXwZS2AdUllTYmgRCk1eFwcbEQpaWBcdEQp5QxdgZV0eYnwdX38 TaREKWUsXEhwYHhEKcGcXZHMFaAUYQkxEX08QBxkaEQpwaBduAWN8fV8eT0d/ExAHGRoRCnBoF2 tsAXxwZmxNRUhMEAcZGhEKcGgXbUdNaWZPE01vT2sQBxkaEQpwaBd6b2NYQUJEU01SYRAHGRoRC nBoF297ehtgeh5EQlhvEAcZGhEKcGgXZ1tMT3lFWmVPAUQQBxkaEQpwaBdiRmdcbFJtRhJfGhAb GR8RCnBoF2ZceGweExpGbklGEAcZGhEKcH0XZ0V6flxdBWhkSUgQGx8bEQpwfRdgfVgabGFbYl9 6YBAdEhEKcGMXY0dGGxNLaX5vBQUQBxkaEQpwfxd6RkxPS1lkfBtLBRAbHh4RCnBfF21ofnNDS0 h7S0tYEBseGREKcH8XaUsBYX9JaEYYaHMQHRoRCnBfF2lAbUVyH3loSxocEBweEQpwbBdgfBNcY BNaaFJvRBAHGRoRCnBMF28aQgEeRGhJZnB5EAcZGhEKbX4XBxsRClhNF0sRIA==
X-Proofpoint-SPF-Result	pass
X-Proofpoint-SPF-Record	v=spf1 mx include:egis.fr -all
X-Proofpoint-Virus-Version	vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1051,Hydra:6.0.680,FMLib:17.12.62.30 definitions=2024-10-17_09,2024-10-17_01,2024-09-30_01
X-Proofpoint-Spam-Reason	orgsafe
Return-Path	simon.brogan@egis-group.com
X-MS-Exchange-Organization-ExpirationStartTime	17 Oct 2024 09:09:36.7373 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	253c1745-d342-4d10-0c9c-08dcee8b6c77
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	33135fa5-f5a7-4d5c-8632-9a17d4acfa5b:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-Exchange-SkipListedInternetSender	ip=[40.107.21.83];domain=eur05-vi1-obe.outbound.protection.outlook.com
X-MS-Exchange-Transport-CrossTenantHeadersStripped	AMS0EPF000001A5.eurprd05.prod.outlook.com
X-MS-PublicTrafficType	Email
X-MS-Exchange-Organization-AuthSource	AMS0EPF000001A5.eurprd05.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Office365-Filtering-Correlation-Id-Prvs	f2484983-4db4-4615-4029-08dcee8afee5
X-MS-Exchange-AtpMessageProperties	SA\|SL
X-MS-Exchange-Organization-SCL	1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|82310400026\|35042699022\|5063199012\|5073199012\|4073199012\|22003199012\|4076899003\|8096899003;
X-Forefront-Antispam-Report	CIP:91.207.212.148;CTRY:GB;LANG:fr;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mx07-001ef801.pphosted.com;PTR:mx08-001ef801.pphosted.com;CAT:NONE;SFS:(13230040)(82310400026)(35042699022)(5063199012)(5073199012)(4073199012)(22003199012)(4076899003)(8096899003);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	17 Oct 2024 09:09:36.6905 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id	253c1745-d342-4d10-0c9c-08dcee8b6c77
X-MS-Exchange-CrossTenant-Id	33135fa5-f5a7-4d5c-8632-9a17d4acfa5b
X-MS-Exchange-CrossTenant-AuthSource	AMS0EPF000001A5.eurprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-EndToEndLatency	00:04:26.7033436
X-MS-Exchange-Processed-By-BccFoldering	15.20.8069.009
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1415005);
X-Microsoft-Antispam-Message-Info	c1/JI+N0eMUBlI2lblTEOZMrQcjlFJ65NjEwP+lQNvj9uPJDGnkkpus1+yz2okn6cTUdDtQtoukViLyFwfII8fmNmR2DtayPezzXcktBcqLxVerbrQ2ZIr9pqdGZ8Y2g362rcHjhj1bClMfguAVfPxXDhbSn0+GRSVRaA8NfXu8yUVssqT/WtYeVE0IMmyiq3ZncxKJwhxrQqVKtCgUqUVYa7dLXe5LaQK0BN6ezhiALTnry3cUMYnerjuGXyojNroBkUl/BFZTEc17FsNNZ1RHE5cXV92en7CPLAEs2zTDptcMI1BciaiFvRgCvvrlWGX3XOb6EGH0CWjIvP/tMN8xWxnTPDkU2d/EI/Yp1pV+Di0iPcuQjbKbaArQeUnkALKOO6ehw6yfly4P1QLoZjlCQ5nZz0RF92AZM/G3WSDI0RwiLbMr65688lL92txxMOFzFNHjuHMFZOB+D5SagXPPtKFqGOH/vKuUhCQkYpFvCIe+kIRNNbGmWkbM1BYjYuhxd2RP+A4UXsAAbaEr602QyFkkWUbesVrAA69wlJ8GWqdAlX35GZ4YRd6gZa/GpzZql8/n6/KwAZWhkhu3YPCMRh+bZ+Ut1f29eseNJGxVoj8vdZ5jVtYhFc3esPcsryzIsTWHHBEzXt4Wr6G7rMLZUgJ230eFNPPCLboCBqHJCYBCpbF3f49LbYfeX1fwu2txn3iY0AfzDhlY5mSV3bUManmctBpTWkMtQ0Yv/8cELHkeAQy/fu+sXNty9WGG0LnIwURyV+HCgZQzq30efSZpHWQOqtuye++rm9fsaI5pqRjg2ykyIu7hpP+5XF05fwgpeZ3Eh3RjnSYWGw41kpAup7cZ7Kmx63IFM5DX2NksKuM6W9rAaxaW5jATWHObZGqo5668wJQrbix89Lfh/GUk5IgihMlrWWRyMQG6Dk75Jlx2UwkYqGMjKghrk4QAkqkKI8/QKZZ9lL3oJfiH7NcGcws7G1XOf+axHilbunZfS1kVXjzTJ7DGsDBnTt6WURj7+KoyULea9qaQhvbRLexuI9bWvc5rrnBa0EPYfz/w5VIJRrcivbXCEKdKVXxA8nyxPJlzLpBEHJgPu8x4PcoWHggQNVe+0zrFxJ5raOjnnGr+6zU+OWG4xcryF5g8eXUc65fu5lQXQ+TfRTbsi/XeuZa9gOIIP+3jjEmXOS6y7IKpjxhSkjPLA5dq3682UcdH9uHjtICXzcU4eiLO1hKXfq/rBwoj8OB6p+EOFQD6BRkWq4TJEbgOSsMJt4oH8yLdVJcUUWGQOtgpkm01j2Wt0STSknxmWzhfOvLA4fFMTy2n7yxhKd3OdFQxaG2f02G8dS3t4z25Duy52Rj1qajhVjFYhQe7b962FzW1v+cPDvDlZF1UDTnBSrkf3APDCIDssEfI5I5SOlR02X7/v2+i8nKhmBuUWUEMiaI7Hw0TWI0dDVX/KkigV8huLZHB1SxtgYvG94igC9GpsSOPMncYwfWfYHeD3jHriEGwhiiK2zy8PfcMj6HfEsWmgpyB7WprqbGqcC3LVDmveFcTvzc0p1ABG00Q/L3B3BamDzNfKXjbNIVOeUh5LyK68UUQTWpp1Ye+HPN8jgwejAGSBYS9UDImI89mt99fqKFXXF5WHfsX797VhkJQ3kdvM1z0Xy/tgIMPWz6WiUNZYao7qDd4RRTYqoiEE/bc+R1zoUFH+eUTGaM1uLMD7ZpiLcMsdACFfPjIjAE0I1w2BbqVXUjmkOfx2YsmRsh75rfzxfGSw+5dje/4ilQvHmT5xT7tRFI+tYKx+Dir2znBx+No5UtdQVwQk2YZHddBH5Z42qWKgYRFOKeAra3WP56Kiwn+kWrSUXe4xP2z73bzQPOLPdqRW4QG5AvfXcBmN5R6OA4tN5zIFTlTT65u7b7+Oqzil7ag6ihMVsTBPx/IqhPU/RK67ieUsyLyx3muV/CFXaLB+rN6j0/cxOgudU2r6wJYKzIOwcejmG8/u52Z7lvOiXFdSHTezSbfHwKYciezgpxs=
MIME-Version	1.0

File Icon


Icon Hash:	46070c0a8e0c67d6

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report email.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt (copy)

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\35C5BC82.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\502ADF6E.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8SZEA0ME\940-CJV-000-GEN-MOS-00001_DRS (A) - Copy (002).xlsx:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\8SZEA0ME\~$940-CJV-000-GEN-MOS-00001_DRS (A) - Copy.xlsx

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{04AA47F8-4D19-44A1-B5E3-33F1447083B5}.tmp

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\Excel\1380790193167760279.C4

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\1924FFB3.png

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\358ED395.png

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\4923B0E4.png

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\4A1B1C92.png

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\72E293E6.png

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\8DE526AF.png

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\Diagnostics\EXCEL\App1729504271598345200_5C856275-EEE5-4A24-8349-DBC88E78744F.log

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\Diagnostics\EXCEL\App1729504271601968200_5C856275-EEE5-4A24-8349-DBC88E78744F.log

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\E9928739.png

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\FD3D4E18.png

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_32db\AC\Temp\mso8747.tmp

C:\Users\user\AppData\Local\Temp\79D18FE0.tmp

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241021T0550250967-6964.etl

C:\Users\user\AppData\Local\Temp\olkD368.tmp

C:\Users\user\AppData\Roaming\Microsoft\Excel\Excel15.xlb (copy)

C:\Users\user\AppData\Roaming\Microsoft\Excel\FC630000

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm (copy)

Windows Analysis Report
email.eml