Edit tour

Windows Analysis Report
EXTERNALRoger Moczygemba shared DIRECT MED CLINIC - CONFIDENTIAL with you.msg

Overview

General Information

Sample name:	EXTERNALRoger Moczygemba shared DIRECT MED CLINIC - CONFIDENTIAL with you.msg
Analysis ID:	1541368
MD5:	75cd3729a08eb18c272253dd5fcf8212
SHA1:	26bda580593e88dd077f8a090326af3dd7e966b4
SHA256:	40dbb73a2943d6dc66f88d18a3f0d64a26a04f528033af8ebaeab4b20ca46ad4
Infos:

Detection

Score:	23
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

AI detected landing page (webpage, office document or email)

HTML body contains low number of good links

HTML title does not match URL

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Stores large binary data to the registry

Submit button contains javascript call

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 1276 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\EXTERNALRoger Moczygemba shared DIRECT MED CLINIC - CONFIDENTIAL with you.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 7008 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "4530FE17-1FDA-4869-8DF0-FA4A6DA0AEE3" "293BB79E-D390-4222-9ACA-C0495A5F3ACC" "1276" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 6632 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6772 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1940,i,1121254362687578653,17294101860194272938,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3312 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1976,i,10383624024249622334,10590873044701604238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 1276, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9

HTTP Parser: Number of links: 0

Source: https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9

HTTP Parser: Title: Sharing Link Validation does not match URL

Source: https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9	HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))
Source: https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9	HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))
Source: https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9	HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))
Source: https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9	HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))

Source: https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9	HTTP Parser: No <meta name="author".. found
Source: https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9	HTTP Parser: No <meta name="author".. found
Source: https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9	HTTP Parser: No <meta name="author".. found
Source: https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9	HTTP Parser: No <meta name="author".. found

Source: https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9	HTTP Parser: No <meta name="copyright".. found
Source: https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9	HTTP Parser: No <meta name="copyright".. found
Source: https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9	HTTP Parser: No <meta name="copyright".. found
Source: https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	HTTPS traffic detected: 20.190.159.75:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.75:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.75:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49748 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75

Source: global traffic	DNS traffic detected: DNS query: medallusmedcom-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 20.190.159.75:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.75:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.75:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49748 version: TLS 1.2

Source: classification engine

Classification label: sus23.winMSG@29/28@14/197

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241024T1233210423-1276.etl

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\EXTERNALRoger Moczygemba shared DIRECT MED CLINIC - CONFIDENTIAL with you.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "4530FE17-1FDA-4869-8DF0-FA4A6DA0AEE3" "293BB79E-D390-4222-9ACA-C0495A5F3ACC" "1276" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1940,i,1121254362687578653,17294101860194272938,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "4530FE17-1FDA-4869-8DF0-FA4A6DA0AEE3" "293BB79E-D390-4222-9ACA-C0495A5F3ACC" "1276" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1940,i,1121254362687578653,17294101860194272938,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1976,i,10383624024249622334,10590873044701604238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1976,i,10383624024249622334,10590873044701604238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email	LLM: Page contains button: 'Open' Source: 'Email'
Source: Email	LLM: Email contains prominent button: 'open'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	3 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	unknown
www.google.com	142.250.185.228	true	false	unknown
medallusmedcom-my.sharepoint.com	unknown	unknown	false	unknown
m365cdn.nel.measure.office.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
142.250.110.84	unknown	United States	15169	GOOGLEUS	false
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
2.23.209.11	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.163	unknown	United States	15169	GOOGLEUS	false
74.125.71.84	unknown	United States	15169	GOOGLEUS	false
20.189.173.3	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.3	unknown	United States	15169	GOOGLEUS	false
2.23.209.39	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
142.250.181.234	unknown	United States	15169	GOOGLEUS	false
2.23.209.16	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
93.184.221.240	unknown	European Union	15133	EDGECASTUS	false
2.16.164.49	unknown	European Union	20940	AKAMAI-ASN1EU	false
52.109.32.47	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.19.126.143	unknown	European Union	16625	AKAMAI-ASUS	false
2.19.126.151	unknown	European Union	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
52.109.28.47	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.109.32.97	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541368
Start date and time:	2024-10-24 18:32:52 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	EXTERNALRoger Moczygemba shared DIRECT MED CLINIC - CONFIDENTIAL with you.msg
Detection:	SUS
Classification:	sus23.winMSG@29/28@14/197
Cookbook Comments:	Found application associated with file extension: .msg

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.109.28.47, 2.19.126.151, 2.19.126.160, 52.113.194.132, 52.109.32.47, 52.109.32.46, 52.109.32.38, 52.109.32.39, 93.184.221.240
Excluded domains from analysis (whitelisted): omex.cdn.office.net, eur.roaming1.live.com.akadns.net, wu.azureedge.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, login.live.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, wu-b-net.trafficmanager.net, a1864.dscd.akamai.net, ecs.office.com, ctldl.windowsupdate.com.delivery.microsoft.com, prod.configsvc1.live.com.akadns.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, osiprod-uks-buff-azsc-000.uksouth.cloudapp.azure.com, s-0005-office.config.skype.com, prod1.naturallanguageeditorservice.osi.office.net.akadns.net, uks-azsc-000.roaming.officeapps.live.com, nleditor.osi.office.net, prod-eu-resolver.naturallanguageeditorservice.osi.office.net.akadns.net, s-0005.s-msedge.net, config.officeapps.live.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: EXTERNALRoger Moczygemba shared DIRECT MED CLINIC - CONFIDENTIAL with you.msg

LLM Input / Output

Input	Output
URL: Model: claude-3-5-sonnet-20240620	{ "explanation": [ "The email appears to be a legitimate file sharing notification from Microsoft 365.", "The sender's email domain (directmedclinic.com) matches the SharePoint link domain (medallusmedcom-my.sharepoint.com).", "The email contains expected elements of a file sharing notification, including the file name and access instructions." ], "phishing": false, "confidence": 8 }
Is this email content a phishing attempt? Please respond only in valid JSON format: Email content converted to JSON: { "date": "Thu, 24 Oct 2024 15:01:39 +0200", "subject": "[EXTERNAL]Roger Moczygemba shared \"DIRECT MED CLINIC - CONFIDENTIAL\" with you", "communications": [ "EXTERNAL EMAIL \n\nThis email originated outside of Cox Manufacturing Company, Inc. Please exercise caution when clicking on links or opening attachments.\n\n\n\n\n \t\n\t\n\nRoger Moczygemba shared a file with you \n\n\t\n\n\nHere's the document that Roger Moczygemba shared with you. \n\n <https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9> \n\n \tDIRECT MED CLINIC - CONFIDENTIAL \t\n\n \tThis link only works for the direct recipients of this message. \t\nOpen <https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9> \t\n\n\n\n\nThis email is generated through Direct Medical's use of Microsoft 365 and may contain content that is controlled by Direct Medical.\n\n <https://southcentralusr-notifyp.svc.ms:443/api/v2/tracking/method/View?mi=Dsr2I7NvaEqprJ0vSiGifw> \n\n <https://get.paubox.com/hbfs/Email%20folder/green_lock_v2.png> Secured by Paubox <https://www.paubox.com> - HITRUST certified\n" ], "from": "Roger Moczygemba <rogerm@directmedclinic.com>", "to": "\"althauss@coxmanufacturing.com\" <althauss@coxmanufacturing.com>" }
URL: Email Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Here's the document that Roger Moczygemba shared with you.", "prominent_button_name": "Open", "text_input_field_labels": "unknown", "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: Email Model: claude-3-haiku-20240307	```json { "brands": [ "Direct Medical", "Microsoft 365", "Paubox", "HITRUST" ] }

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.46753623069192
Encrypted:	false
SSDEEP:
MD5:	D7A87CE8CEF5EF291BFD6E47F27B9205
SHA1:	28E6F9A2BEA42D1DF1D7332326B9CEA3BF26B0FA
SHA-256:	9B4794BA8F6DA7D0F6EF1A55FC4913F6F6FB4B93197ED70FD3069D9F83D57598
SHA-512:	F7DA6C1FE58D42B48C06FAFE84F4D1F21DAEE1CFE5E49D23793334C7B9D2723CB6F07B4F4671E9D9F7105CA5C15DD0AAB3A16A39172F438EABF37FC5A0737F54
Malicious:	false
Reputation:	unknown
Preview:	p...... ........%.zs2&..(..................................................^SZ.. .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.382243197933759
Encrypted:	false
SSDEEP:
MD5:	0B3E5F29FF0F3614A02704A72676A5E5
SHA1:	55F35D7C98C5B5CC885F503EC2F0EA3695E009D9
SHA-256:	37347D1BB0345E94ED044B38277E9C099E8D9ECE83B6962A6171730DDFF4536D
SHA-512:	5FCA2842A3AEA6238395ED232243CB390EE6C41DBF2C4E8987056D3E7EAF0AC9DD084D058C7546B52AFA3E00CFA41A24DDA98751BE90D08A715D81FA6E976C1D
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ...Qf2&......SM01X...,.....Ff2&..........IPM.Activity...........h...............h............H..h..O......&K....h.........8..H..h\cal ...pDat...h...0.....O....hn#.............h........_`Pk...h.%..@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..............!h.............. h&M;..... .O...#h....8.........$h.8......8....."h(.......`.....'h..............1hn#..<.........0h....4....Uk../h....h.....UkH..h.`..p.....O...-h .......L.O...+h.#........O................. ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	unknown
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	10
Entropy (8bit):	2.521928094887362
Encrypted:	false
SSDEEP:
MD5:	EEB9873669A2B91658C63A31AEB28E48
SHA1:	3BC539F774E96571A7C4E1980E3198895FC052CE
SHA-256:	019876266837606D91545D2B7DFCA0C8D406C19657933CAD79390D9A615AFAEF
SHA-512:	98E3E449C494799FF9DAFF89EAE2E213EEA5FE16BF72F5C65A14F1D6B20AFEDF547F956FB19B722A146FF2068FB315A8858C4E5BCF7108C8173D5857A3751A2F
Malicious:	false
Reputation:	unknown
Preview:	1729787607

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\6A96AA54-05C1-4F8A-9152-E03B51ECBA76

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178267
Entropy (8bit):	5.290271622323849
Encrypted:	false
SSDEEP:
MD5:	D144FE00AC7E1F4A1CACFFDC5C8E6762
SHA1:	6C2FE1EEFD15CD64A0C03AD35FDBB8D3EC90567A
SHA-256:	3E9EBEB0C2C84C6E6303B1BBAF911183931A9D5D41C166E3A6DFBC8AFDA9C01F
SHA-512:	319FDE66665F0974F63196299AA8D02F16046FA891DE8CDA3B6AC6A71BF10FADE524A6B470FBDF291C99ADE212C48A8E7D2E01BD3ED5ABD1B98FAC598F3D8824
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-24T16:33:23">.. Build: 16.0.18209.40127-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09216609452072291
Encrypted:	false
SSDEEP:
MD5:	F138A66469C10D5761C6CBB36F2163C3
SHA1:	EEA136206474280549586923B7A4A3C6D5DB1E25
SHA-256:	C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
SHA-512:	9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13640804182083313
Encrypted:	false
SSDEEP:
MD5:	EF669C7F1747F8F227AC9E8D092DE2AC
SHA1:	FBD1A252ED51AA9F6BD2C0CF9F9B2CD85C58B5DD
SHA-256:	3A92EE596F22FABD76D889D4EBD43694D1E3A04A17A06C58CD067C1D84D6B409
SHA-512:	87A057AFD9040F48205E6D910847EB9D733E81CDD16B8D0DC2E2E84D0428513D9B851AD1B0656C54029F59838962A0FA77B807BC5F217415329C8E65ABE25FC8
Malicious:	false
Reputation:	unknown
Preview:	.... .c.......QK....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04470641479249482
Encrypted:	false
SSDEEP:
MD5:	EC9EF2475B15E140DB1E34CE6D68120C
SHA1:	2BB13F798DEB0817EB677B7BE2E5CADA9161243F
SHA-256:	0C7D2196605222C7FB12F6566C60CBA4F8103278A51BD721018D92B085B79152
SHA-512:	788205DE600B6910D17B5D6DE65BAC8AB9197DEC2E32441D74E96B752BF9D69B96EC25E8DF412FC81C97FC2A2C7F56503CD422DF2A305BD7296A175A23E6A3F7
Malicious:	false
Reputation:	unknown
Preview:	..-........................2/...k...A.]l...(.<...-........................2/...k...A.]l...(.<.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.39455870997357273
Encrypted:	false
SSDEEP:
MD5:	7767622B389670DC6DEBC33DD5DB37B1
SHA1:	C945EBDF65FBB2D8F397D018044390CCA4489ADB
SHA-256:	0BF5A5DC1F45F056E19C340FFBA363A189E4CAC3AF728BE7751E84760A07BA7B
SHA-512:	11E08B7413F64B00A1960DDAD51D1616BECA24365731BEF7F13CF5D921D8BD612A117BC8E426AD305E25690A1B5ECB25B66B806B780FAB3668B1C9CA47528A9E
Malicious:	false
Reputation:	unknown
Preview:	7....-..........k...A.]l...~..d........k...A.]lE....q.rSQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\318F169A.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2133
Entropy (8bit):	7.86298626930999
Encrypted:	false
SSDEEP:
MD5:	4DF1205B01187B26FF893615B19C65DE
SHA1:	13856C6DCE2C8C328153C9C6FD37643EDCC45B81
SHA-256:	5931FFF65F3CF45DA0DDD4F29D39BA23063A3735A8F99868DF6C23E26BD61788
SHA-512:	074239FBFE2D5B34EFDD6EC0255A459CFDDCA9538FDAE5F371F50414B4EC305D551461CBD852294E89197BD8375E7FC5C888657971281AFCCC06051AFA01FA1E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0...0.....W.......pHYs...%...%.IR$.....sRGB.........gAMA......a.....IDATx..ZOL.U..fkmM..%...p.S....M.<.....M!R....TL...x.=......<.5.......S6.R....U...K/.t...v.0.3........v.......}.B[.UU.D.Z..:>T..z..6...H.HQf..G.....O.H..x..p#...3.W"L....u.%c... 5.b.k.Q4....Zq.....BKKK.<?7G..iJOO...&.X.S..R......J<...{L..b....8....{C^..$..:.u.'nB.......?.H$B[.L&C.##.da.......FI.Tu_......GX=.O..uy.......).........n.ls.YP.A~gGG'.9{...../0....;l....ZZZimu.fggw......T..r..T... ..==B....{r`.gw.4Z...kimu\|n.U........fO~_+..h.....tv.#M[..~.`..B!ZXX....-.4.=...B.s.=...p.n-.}p.J.P0X....Jg...#Z^^&._..9joo.6>0.)....:.s.."!.X....k..........~...dR.<t.D......].pQ\...+........dxBr.@.=..m0..@....8......F_'`.pb...........#n&.._..Lf.$.HD.r]..\N...P.}...9.e..<....R..!q....K..Q.....T0.0.w...B.c...Tu$.....7..a..N0.^'.._.....<j._..V.........4...............[C..X.*.@....;...s.~....@.:...<.9##..ni.......".~M.s.) ....[I.H[...6....T.{<...\|.F..3..Q......1...+......K..3.-...T.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A1383E97.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2877
Entropy (8bit):	7.9028514706867385
Encrypted:	false
SSDEEP:
MD5:	1E13EE0ED09C4AF1ADFB6C0D280879B0
SHA1:	1192A79F7B4C4FF814583743F8C66ACA7ECB8ACF
SHA-256:	E2395FBA25D3FB8A971345CA65D144F7D9C9D933F70409165446E63D18C0958D
SHA-512:	4D86A41DE4B3CA8BB73BF641838953BE03FFF34A890B7BDDC506276186D42979BC99A7DC5553005F135AA1C02137C85C6A2623498C78A617CC195E28FD8B3C95
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...`......w8....sRGB.........IDATx..\}l.G..o..Z....$%i....4P5. Q.........@...nZ.wg.....%.$M........-.T>$..B.........MA..4Q...v...g..v....q..H.}......};o.D:h.4.....F.rC ..MBp..6.n@x..{(.?.6..1..z.............&....D....P.3A. ....).?.4...2...&..?.$...J.d...a&....M@5..^..A....".LBo.q.d.......B.a_I.....i....#...k.. 'h..-.;QmTG...1an...cN..i.."%....5...j...'bQ-...$.s.......T.8.. .$..N...Y..k..P...a..g....>`...Y[#.-..._M.m. .$.^Ed,.Z..}Y..}.2.c..X....c...$.e{..I.+.+.n.TH........7..k..wCm.....6.'..rd..U0.A..WT.vi.O@"..Jq'F...........NH`.:eb.9.gJ.5..=s.....\...F;.."@fH.i..%\..Z......N3.x..%.n...............}.i..a.....~.IL.c...7...b....j.!<...ufR.{.._....>..wc...b+.\..._....8.L..f..&..".0...@.%.g ..%...I.-R*D..3!^!..2.(k[..VS.......&.w.I......-..;.{.p..H.4..G.C./.z..UpB.S.2=.U.s.U..]....c...x.4P...c2.{.>.g..v....T.=G..`....:AqJb..{.v.4.......3h.R...3....$u......oVZ.7..a.)b.T..!........Z5.y.H.....h.UCgdr-.?...~..~yF.R,.{.$Hg.=..LB.3!.W...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B58A57AC.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 96 x 96, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	558
Entropy (8bit):	7.123275457405295
Encrypted:	false
SSDEEP:
MD5:	D9DCA1CAC67A8515C5E7572528BDD5A2
SHA1:	E758AF30B557F3E6DC91FCF3F114725BE898B4F4
SHA-256:	D03539CC6A66D43CFD2347316E7F93720B2D0D9228836EAA86726D87A5113D90
SHA-512:	1AF4329F527D2F0B01CD0C18AA614E439EF4B0A5ABC69658A6B04F7236F3CFE769E9C0E79C100C3C6AD721456D791E9BCC502F7EF84225A76BD84F9A79BC3F11
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...`......F..... cHRM..z&..............u0...`..:....p..Q<...iPLTE...#. .:z.:z.:z.:z.:z.:z.:z.:z.:z.:ze2`....................k..R....:z..w..F.................^....n.......tRNS.f/?o......_...R.....bKGD....H....IDATh....n.@..`Z.M..n.F.....R...4....n..h...%.I.5.$.....!@....h................o.!.....n....Y....?.V.......lN.........+u....\|..Z.7._.~;. . ..2..\|..z....gh@....]...}ue1-2.#A...U.....n..; J.B..\ ..w........2..P..h..f..I.m.c.......r.rG .%O......lQ..l..8.....0D.<....Q.0G{b.A.p..X`@.....W-....hT4.."D]....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{55B1C838-594D-472D-9490-C5FC98BB5F68}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	15372
Entropy (8bit):	3.641855905118936
Encrypted:	false
SSDEEP:
MD5:	3668254E41E0659D84F3186CC59E738B
SHA1:	84BD86423BFCF727F86A8B5E1BBB10BA42D6995E
SHA-256:	CC086A12CCE5DC479B417844E8A805FF4EBE37EA1A1C02E62CDC2378EAF2DCA7
SHA-512:	0A258F99F2AA5E83283E967E95D0D3047F0954F57639F414E946088C74148F55B8EF15D2E5DC65010B588F6B0D3E1F1A8CCD14FD4FCC184DB86A397B19BC8D04
Malicious:	false
Reputation:	unknown
Preview:	......E.X.T.E.R.N.A.L. .E.M.A.I.L... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................,................................................................................................................................................................................................................................................................................$..d............[$.\$.a$.....$..$.If....:V.......t.....6......4........4........a....*...$..$.If........!v..h.#v....:V.......t.....6......5.......4........4........a.........$.a$.....d,...-D..M..........

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729787601637731000_EEDEA560-6153-4FCF-BACA-4C5F90C523B6.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.00889284756401776
Encrypted:	false
SSDEEP:
MD5:	0B1D6053224DCD08DF936A41470DBA17
SHA1:	10CB6264644E45959D2310E551A8C4375BF14B61
SHA-256:	0F80A7D1B08707330F612DE4E4694B8A66416B5975BC0023CCC4B8D67EEB8021
SHA-512:	59F3DFB9F765BF6384DDE700D9D7FB7F70AB9FA02FD634C5745A949A1B8697B27EC813483C9071C61AB9CFAA24A9ECBCB28E7261558A64E82BB4A56DEABD28B2
Malicious:	false
Reputation:	unknown
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/24/2024 16:33:21.679.OUTLOOK (0x4FC).0x3A8.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.System.GracefulExit.GracefulAppExitDesktop","Flags":33777014402039809,"InternalSequenceNumber":17,"Time":"2024-10-24T16:33:21.679Z","Data.PreviousAppMajor":16,"Data.PreviousAppMinor":0,"Data.PreviousAppBuild":16827,"Data.PreviousAppRevision":20130,"Data.PreviousSessionId":"C1634649-AB74-4B5D-9992-E9729347A4F3","Data.PreviousSessionInitTime":"2024-10-24T16:33:03.490Z","Data.PreviousSessionUninitTime":"2024-10-24T16:33:06.771Z","Data.SessionFlags":2147483652,"Data.InstallMethod":0,"Data.OfficeUILang":1033,"Data.PreviousBuild":"Unknown","Data.EcsETag":"\"\"","Data.ProcessorArchitecture":"x64"}...10/24/2024 16:33:21.695.OUTLOOK (0x4FC).0x1B04.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":22,"T

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729787601638553600_EEDEA560-6153-4FCF-BACA-4C5F90C523B6.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241024T1233210423-1276.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	118784
Entropy (8bit):	4.677126248420874
Encrypted:	false
SSDEEP:
MD5:	FA522F424B1E489E0969552685F304E4
SHA1:	DFEBFC82F5001B381A7EE4FEC4702BF766FCFEB9
SHA-256:	2A69D8C5D9A14A90D61DEAFB734E8C9FF984750603322FC8713E71240472F34F
SHA-512:	E538FE2AF3F1D2E35B5810B97D625143207C19FAE6C0F38AD20C8F8E2DD0376E438697084EB0F3F9E1B707309E5197CAAE966520633E8B6813974141DBE7B845
Malicious:	false
Reputation:	unknown
Preview:	............................................................................^.............pp2&..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................P..&.Y............pp2&..........v.2._.O.U.T.L.O.O.K.:.4.f.c.:.4.a.9.3.0.a.8.9.1.9.1.5.4.a.e.0.b.7.8.4.a.e.0.8.d.a.e.0.3.a.c.d...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.2.4.T.1.2.3.3.2.1.0.4.2.3.-.1.2.7.6...e.t.l.........P.P...........pp2&..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFDE0F4CEC66F1A70E.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	0.42573912037035566
Encrypted:	false
SSDEEP:
MD5:	32F4A4F5474765325A76C4D7CA665E2C
SHA1:	6CC214299E11CF141083ECEAA9068F3D7732C4A8
SHA-256:	E51A7408A5EFAE3AE2C924DA27074173D7BF67274001EDE41342E2376F7D2C0B
SHA-512:	DCDEBF0BC6617C37FAA4AC69891A5D95AA5D565C7E4B5D985C04D3BB7929D068D4AED5B9AF050AA208836D33FC01C5617754AAD9F4610A810CB1B71F51EBFAF7
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:
MD5:	D0EE05668332DF3EC71280F44F786042
SHA1:	72A50C00E977C8EBE4B15F2C527BA298A15268A9
SHA-256:	F693A249BA9D209248BFD0750838C9DD781B096A51CD772CAEAE0701062A50ED
SHA-512:	0CC6D0466432671E1A95CC4CBFE6A8277547BBD629166D73C7593EBAAFE77F607C56BC00539B16A1100E20137E998E5915B0AF21D7076CF26C8978376D7E5040
Malicious:	false
Reputation:	unknown
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.668445129584144
Encrypted:	false
SSDEEP:
MD5:	B10348F1B8CA31EC264DE93F3EADB585
SHA1:	738F422C438B7AFACD4012362DE0348EE2CCCFAC
SHA-256:	6E66590D89196E2603133128F5F487BC2EE14B3C9C0ABD1DF589B131553E9B97
SHA-512:	38286B7472427B4F5500784C12BA5D3F96167CEE5242185A16AF0AC7CCC880306357FD431F251CCDB2D465229B75347322A6F95185DA08646FF8E8ADC3B6EECB
Malicious:	true
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	2.699513850319966
Encrypted:	false
SSDEEP:
MD5:	C5A12EA2F9C2D2A79155C1BC161C350C
SHA1:	75004B4B6C6C4EE37BE7C3FD7EE4AF4A531A1B1A
SHA-256:	61EC0DAA23CBC92167446DADEFB919D86E592A31EBBD0AB56E64148EBF82152D
SHA-512:	B3D5AF7C4A9CB09D27F0522671503654D06891740C36D3089BB5CB21E46AB235B0FA3DC2585A383B9F89F5C6DAE78F49F72B0AD58E6862DE39F440C4D6FF460B
Malicious:	false
Reputation:	unknown
Preview:	..c.a.l.i.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:33:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.987763208342518
Encrypted:	false
SSDEEP:
MD5:	A2E404CEB1BAF507D5C4FEAC16D86FC7
SHA1:	6DE83E86CC5BBD3C2A98C4A79828A3AB173C1365
SHA-256:	A2CC48D5AD845791B70D2DE2F2835D4A508F90076C886788667C9C766C24B803
SHA-512:	7FCA11B2C5F95E696EFCD0D365619326EFA4726E7EBA853C1F6B880C5D7E4158D29F80946C10F178A02E95011F7E4E87E8D17D9C7D80D43FA996B3381B2145C1
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....r..w2&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXY!.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY0.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY0.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY0............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY1............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............:.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:33:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.002793606434128
Encrypted:	false
SSDEEP:
MD5:	D8C45DE105BE1536435F610B06126959
SHA1:	5E497CEB1EC09FCA303A5D089017140CE43CBE6F
SHA-256:	EB8DD256221062368437BAB6A1FEE9B10EDD5680F18EF31033024E234D90CB0B
SHA-512:	0D311EDD7AF9860420B06F6005CF8E63AB8AE7520C2F3966281823D000DA5702331CD3FA991EA63026539440A75185EB7E06AFF675239C92CF2BBD99126500ED
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....H..w2&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXY!.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY0.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY0.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY0............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY1............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............:.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.013371954359498
Encrypted:	false
SSDEEP:
MD5:	0E8D69AAB62B382DFCC37B312A9A16F6
SHA1:	041FEE3B882EC0624BAEB78490A7A613FBADCADB
SHA-256:	FB5C39A953132E72B127F7B890E1D2E99339AC259D89B4B96082F422347ACAC0
SHA-512:	4711552672AD43C9FC16B3CFD9A44A164B78437E4903A55CEBA8750526BEC3148EF290D86068EC33CF24252F3B18661476E50E6F102EA960C093C075115CB36A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXY!.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY0.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY0.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY0............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............:.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:33:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.001816757769585
Encrypted:	false
SSDEEP:
MD5:	EB313725B2A1C63591E5A5382EF652B1
SHA1:	046914025699FC9FFA81865F5DEBAAADD3877B48
SHA-256:	BB1305721D1A4A9CB23C2B83FB1FABD66E0F4DB4C8A085D69D89C20FBF435994
SHA-512:	82180FF6BF2FA617668A2F1448FCC3D020F46C0B82159FB1253B628B801CB02E3672DECD140A5F8191BE1C6F0C3249FB4076949DF0B384C7CAF57138356E700A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....G.w2&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXY!.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY0.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY0.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY0............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY1............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............:.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:33:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9905318470852618
Encrypted:	false
SSDEEP:
MD5:	05B8BACF5364917AAF7F74E44F979366
SHA1:	85B2528B3536A4D0BAB14DB789BCAA6AEBE0CDD2
SHA-256:	4C652F8932D50810037FDACED253F21D7B5EED81792D732D9F608FF20FCF208B
SHA-512:	72968824626BF1A061D53DA6E81CCD67BED46D8DD8ECDCFFB0D08C7123A346CA7B1F35E6412CEBE0D6D709AC815BB84A477499A47E029CDF89EC7BAD2C9E745E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....4..w2&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXY!.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY0.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY0.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY0............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY1............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............:.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:33:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9973991696208406
Encrypted:	false
SSDEEP:
MD5:	B14A4B9753211C7E45E51AFC9D9BBFFA
SHA1:	EF6C0F7CDF5E80CD81DC2B1FC4457A178EE5B56B
SHA-256:	9AB37276B2B9146AEF456A4942A1424FC542E6CE15AA09983A95C610D4BAF23C
SHA-512:	AECEF102F0DB69EEF810609BC73676A23B92DF8215BD3B60B740460DE47C9849B396057B64C4156BFBF54760ACA8279C951BE6A731E7F24ABC6EA1FC6CACC186
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....n..w2&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXY!.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY0.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY0.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY0............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY1............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............:.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	1.4768909017267362
Encrypted:	false
SSDEEP:
MD5:	63DF77A2BC84AE55307863FE38783F4E
SHA1:	D934155AE7292B3F7144597DBE6EE38DBFBDFB07
SHA-256:	E7E24F8396AF322A480FFFB228130267E0F33A5FA1B1E7A31821D50772A408F3
SHA-512:	7934FE42C9EAB3D7388613D8AD893ED5FA468D65C0D2297FBF9EEFB472912D24A2AD41A9374629474161E4D01604711EB7A5EF0535F42C12B0792C42CCE4FCBA
Malicious:	true
Reputation:	unknown
Preview:	!BDN...!SM......\.......................\................@...........@...@...................................@...........................................................................$.......D.......A..........................................................................................................................................................................................................................................................................................................................H........ z........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.8521874128460207
Encrypted:	false
SSDEEP:
MD5:	95EA4D90559B9E76A034F3AFECF14B5F
SHA1:	B0D0682FED6EB2A5F77E2DCB68031B0544293380
SHA-256:	EEDCAB3A3E0CC957DD7C5452E547498C4366B99F9F410811AFB036843ABD8270
SHA-512:	9FFF91125BB3F98EE62A87AD026A8A94C336AB207B005DE2E6E19C8CE28F5476D7B57EDC4849E832E7EB3BCE94DE625B5546210242EEA54B3C971F416F555717
Malicious:	true
Reputation:	unknown
Preview:	Z..C...I.............Qp2&....................#.!BDN...!SM......\.......................\................@...........@...@...................................@...........................................................................$.......D.......A..........................................................................................................................................................................................................................................................................................................................H........ z......Qp2&.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	4.299435851131418
TrID:	Outlook Message (71009/1) 45.36% Outlook Form Template (41509/1) 26.51% ClickyMouse macro set (36024/1) 23.01% Generic OLE2 / Multistream Compound File (8008/1) 5.12%
File name:	EXTERNALRoger Moczygemba shared DIRECT MED CLINIC - CONFIDENTIAL with you.msg
File size:	124'416 bytes
MD5:	75cd3729a08eb18c272253dd5fcf8212
SHA1:	26bda580593e88dd077f8a090326af3dd7e966b4
SHA256:	40dbb73a2943d6dc66f88d18a3f0d64a26a04f528033af8ebaeab4b20ca46ad4
SHA512:	5ae7fd04bfc0f33adbc73b2dc54b9a6e98910ea32836e9da4bb448fcd9adb701d30fcfee7649985ec5ac7cb9b6147e52e6d86985bbe8c2882a59759995ce5c96
SSDEEP:	1536:lMJor7y7SSuSBqWGWjOSK9JWU2EI7QcPNMo8v3IO9WDvJ45qr:lMJor7OuSsSsl2nQcPNMo8gOOvDr
TLSH:	54C312143AEA1119F3739F358BE290A79936FC53AD159A5F2191330E0672E41EC63B3B
File Content Preview:	........................>.......................................................y..............................................................................................................................................................................

Static Mail

General

Subject:	[EXTERNAL]Roger Moczygemba shared "DIRECT MED CLINIC - CONFIDENTIAL" with you
From:	Roger Moczygemba <rogerm@directmedclinic.com>
To:	"althauss@coxmanufacturing.com" <althauss@coxmanufacturing.com>
Cc:
BCC:
Date:	Thu, 24 Oct 2024 15:01:39 +0200
Communications:	EXTERNAL EMAIL This email originated outside of Cox Manufacturing Company, Inc. Please exercise caution when clicking on links or opening attachments. Roger Moczygemba shared a file with you Here's the document that Roger Moczygemba shared with you. <https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9> DIRECT MED CLINIC - CONFIDENTIAL This link only works for the direct recipients of this message. Open <https://medallusmedcom-my.sharepoint.com/:o:/g/personal/rogerm_directmedclinic_com/EgOiuNNiV0lGmucF5ExLSGoBM4E3jL5a7YmPGl10fE2eEw?e=5%3a53h8sN&at=9> This email is generated through Direct Medical's use of Microsoft 365 and may contain content that is controlled by Direct Medical. <https://southcentralusr-notifyp.svc.ms:443/api/v2/tracking/method/View?mi=Dsr2I7NvaEqprJ0vSiGifw> <https://get.paubox.com/hbfs/Email%20folder/green_lock_v2.png> Secured by Paubox <https://www.paubox.com> - HITRUST certified
Attachments:	AttachedImage AttachedImage AttachedImage

Headers

Key	Value
Received	from MW5PR13MB5582.namprd13.prod.outlook.com
13	01:59 +0000
ARC-Seal	i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
ARC-Message-Signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
h=From	Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
ARC-Authentication-Results	i=1; mx.microsoft.com 1; spf=pass
by PH7PR20MB6619.namprd20.prod.outlook.com (2603	10b6:510:26b::22) with
2024 13	01:59 +0000
(2603	10b6:610:10e::15) with Microsoft SMTP Server (version=TLS1_2,
Transport; Thu, 24 Oct 2024 13	02:07 +0000
Authentication-Results	spf=pass (sender IP is 52.25.230.42)
Received-SPF	Pass (protection.outlook.com: domain of directmedclinic.com
via Frontend Transport; Thu, 24 Oct 2024 13	02:06 +0000
for <althauss@coxmanufacturing.com>; Thu, 24 Oct 2024 13	02:03 +0000 (UTC)
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=directmedclinic.com;
h=From	To:Subject:Date:From;
Authentication-Results-Original	outbound11-encrypted-mta.paubox.com;
by BL3PR13MB5124.namprd13.prod.outlook.com (2603	10b6:208:353::24) with
([fe80	:f85c:6c8d:669e:9955%5]) with mapi id 15.20.8093.014; Thu, 24 Oct 2024
From	Roger Moczygemba <rogerm@directmedclinic.com>
To	"althauss@coxmanufacturing.com" <althauss@coxmanufacturing.com>
Subject	[EXTERNAL]Roger Moczygemba shared "DIRECT MED CLINIC - CONFIDENTIAL"
Thread-Index	AQHbJhTdvRa9ZlE9l0eJjMZS9g/sNQ==
Date	Thu, 24 Oct 2024 13:01:39 +0000
Message-ID	<Share-ac0c5da1-90e2-6000-9ec7-439f9f6c37aa-07d95402-fb3b-4999-896c-4c2f4e8b616f-r0-SendEmail@odspnotify>
Accept-Language	en-US
Content-Language	en-US
X-MS-Has-Attach	yes
X-MS-TNEF-Correlator	Authentication-Results-Original: dkim=none (message not signed)
x-ms-traffictypediagnostic	MW5PR13MB5582:EE_\|BL3PR13MB5124:EE_\|CH2PEPF00000146:EE_\|PH7PR20MB6619:EE_\|CY8PR20MB5545:EE_
X-MS-Office365-Filtering-Correlation-Id	6c836f0d-c5f2-4bbe-1dfd-08dcf42c1040
x-ms-exchange-senderadcheck	1
x-ms-exchange-antispam-relay	0
X-Microsoft-Antispam-Untrusted	BCL:0;ARA:13230040\|376014\|366016\|69100299015\|1800799024\|8096899003\|38070700018;
X-Microsoft-Antispam-Message-Info-Original	=?us-ascii?Q?iJbOwkaPIABOjBHh1NLqKh0arazL3viZdWgZTxZwx1fZNl7GTnQUkyNC7Jia?=
X-Forefront-Antispam-Report-Untrusted	CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MW5PR13MB5582.namprd13.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(69100299015)(1800799024)(8096899003)(38070700018);DIR:OUT;SFP:1102;
Content-Type	multipart/related;
MIME-Version	1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped	PH7PR20MB6619
X-Encrypted-Email	This email was sent using 256-bit AES encryption by Paubox
Return-Path	rogerm@directmedclinic.com
X-MS-Exchange-Organization-ExpirationStartTime	24 Oct 2024 13:02:06.8143
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	6c836f0d-c5f2-4bbe-1dfd-08dcf42c1040
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	c6c38305-3244-469b-8486-bf030d22f9f9:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-Exchange-Transport-CrossTenantHeadersStripped	CH2PEPF00000146.namprd02.prod.outlook.com
X-MS-PublicTrafficType	Email
X-MS-Exchange-Organization-AuthSource	CH2PEPF00000146.namprd02.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Office365-Filtering-Correlation-Id-Prvs	c63a11d1-2c90-42af-491b-08dcf42c0bc2
X-MS-Exchange-AtpMessageProperties	SA\|SL
x-ms-reactions	disallow
X-MS-Exchange-Organization-SCL	1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|14143499003\|69100299015\|35042699022\|8096899003;
X-Forefront-Antispam-Report	CIP:52.25.230.42;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:outbound11-encrypted-mta.paubox.com;PTR:outbound11-encrypted-mta.paubox.com;CAT:NONE;SFS:(13230040)(14143499003)(69100299015)(35042699022)(8096899003);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	24 Oct 2024 13:02:06.5956
X-MS-Exchange-CrossTenant-Network-Message-Id	6c836f0d-c5f2-4bbe-1dfd-08dcf42c1040
X-MS-Exchange-CrossTenant-Id	c6c38305-3244-469b-8486-bf030d22f9f9
X-MS-Exchange-CrossTenant-AuthSource	CH2PEPF00000146.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-EndToEndLatency	00:02:27.6135369
X-MS-Exchange-Processed-By-BccFoldering	15.20.8093.014
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	=?us-ascii?Q?F/HCEeDQu5f3bc5dxvNhDFMQyGjCt02p0b0YtvPwUzGOV/6oXhnw8HfqW850?=
date	Thu, 24 Oct 2024 15:01:39 +0200

File Icon


Icon Hash:	c4e1928eacb280a2

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EXTERNALRoger Moczygemba shared DIRECT MED CLINIC - CONFIDENTIAL with you.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\6A96AA54-05C1-4F8A-9152-E03B51ECBA76

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\318F169A.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A1383E97.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B58A57AC.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{55B1C838-594D-472D-9490-C5FC98BB5F68}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729787601637731000_EEDEA560-6153-4FCF-BACA-4C5F90C523B6.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729787601638553600_EEDEA560-6153-4FCF-BACA-4C5F90C523B6.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241024T1233210423-1276.etl

C:\Users\user\AppData\Local\Temp\~DFDE0F4CEC66F1A70E.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Static File Info

General

Static Mail

General

Headers

Windows Analysis Report
EXTERNALRoger Moczygemba shared DIRECT MED CLINIC - CONFIDENTIAL with you.msg