Edit tour

Windows Analysis Report
Action Desk Support 01 Nov.msg

Overview

General Information

Sample name:	Action Desk Support 01 Nov.msg
Analysis ID:	1546654
MD5:	b46156130331c514a5f23b72a3ebf346
SHA1:	6c9f25af94c5caf9238eded0e6fab411e67a4868
SHA256:	7fa983146e0d8b853000e49a06997bab133e4b74ffde382c0fbfd8869a5ab53d
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

AI detected suspicious URL

Creates a window with clipboard capturing capabilities

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Office Macro File Download

Sigma detected: Suspicious Office Outbound Connections

Stores files to the Windows start menu directory

Stores large binary data to the registry

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6948 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Action Desk Support 01 Nov.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 2732 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D577D47D-FF30-4FC1-9130-2292C5071DAA" "B9F951CF-6A79-4035-B24A-ADF217EC6EF5" "6948" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 6416 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fir.nbaikp3.sa.com%2Fdelaw%2Flawn%2Fkoo%2Fsf_rand_string_mixed(24)/maximilian.mueller@scanlab.de MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 304 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1936,i,7756939770163540840,17739624062686689405,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fir.nbaikp3.sa.com%2Fdelaw%2Flawn%2Fkoo%2Fsf_rand_string_mixed(24)/maximilian.mueller@scanlab.de MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1816,i,13371701589847587670,5721659198532985322,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6948, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Office Macro File Download

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6948, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.16, DestinationIsIpv6: false, DestinationPort: 49734, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, Initiated: true, ProcessId: 6948, Protocol: tcp, SourceIp: 167.89.118.106, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Office Macro File Creation

Source: File created

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://ecoutura.sa.com/9o93/#Mmaximilian.mueller@scanlab.de

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 20.190.159.64:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.64:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.89.118.106:443 -> 192.168.2.16:49734 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 28MB

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.64

Source: global traffic	HTTP traffic detected: GET /delaw/lawn/koo/sf_rand_string_mixed(24)/maximilian.mueller@scanlab.de HTTP/1.1Host: ir.nbaikp3.sa.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /delaw/lawn/koo/sf_rand_string_mixed(24)/maximilian.mueller@scanlab.de HTTP/1.1Host: ir.nbaikp3.sa.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /delaw/lawn/koo/sf_rand_string_mixed(24)/maximilian.mueller@scanlab.de HTTP/1.1Host: ir.nbaikp3.sa.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ir.nbaikp3.sa.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ir.nbaikp3.sa.com/delaw/lawn/koo/sf_rand_string_mixed(24)/maximilian.mueller@scanlab.deAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.co.th
Source: global traffic	DNS traffic detected: DNS query: ir.nbaikp3.sa.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ecoutura.sa.com
Source: global traffic	DNS traffic detected: DNS query: u47331948.ct.sendgrid.net
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.190.159.64:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.64:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.89.118.106:443 -> 192.168.2.16:49734 version: TLS 1.2

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window created: window name: CLIPBRDWNDCLASS

Source: classification engine

Classification label: mal52.winMSG@31/42@18/197

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241101T0644010037-6948.etl

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Action Desk Support 01 Nov.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D577D47D-FF30-4FC1-9130-2292C5071DAA" "B9F951CF-6A79-4035-B24A-ADF217EC6EF5" "6948" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D577D47D-FF30-4FC1-9130-2292C5071DAA" "B9F951CF-6A79-4035-B24A-ADF217EC6EF5" "6948" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fir.nbaikp3.sa.com%2Fdelaw%2Flawn%2Fkoo%2Fsf_rand_string_mixed(24)/maximilian.mueller@scanlab.de
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1936,i,7756939770163540840,17739624062686689405,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fir.nbaikp3.sa.com%2Fdelaw%2Flawn%2Fkoo%2Fsf_rand_string_mixed(24)/maximilian.mueller@scanlab.de
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1936,i,7756939770163540840,17739624062686689405,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fir.nbaikp3.sa.com%2Fdelaw%2Flawn%2Fkoo%2Fsf_rand_string_mixed(24)/maximilian.mueller@scanlab.de
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1816,i,13371701589847587670,5721659198532985322,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fir.nbaikp3.sa.com%2Fdelaw%2Flawn%2Fkoo%2Fsf_rand_string_mixed(24)/maximilian.mueller@scanlab.de
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1816,i,13371701589847587670,5721659198532985322,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1271D5-2FF2-4EA4-9647-C67A82A2D85C}\InProcServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email	LLM: Page contains button: 'Verify Now' Source: 'Email'
Source: Email	LLM: Email contains prominent button: 'verify now'

AI detected potential phishing Email

Source: Email

LLM: Detected potential phishing email: The email claims to be from Microsoft but is sent from 'Service IT Center <linda@asib.com.my>', which is suspicious

AI detected suspicious URL

Source: Email

JoeBoxAI: AI detected Typosquatting in URL: URL: http://ir.nbaikp3.sa.com

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	3 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	1 Clipboard Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
www.google.co.th	142.250.185.227	true	false	unknown
ecoutura.sa.com	188.114.96.3	true	false	unknown
challenges.cloudflare.com	104.18.95.41	true	false	unknown
www.google.com	142.250.186.164	true	false	unknown
ir.nbaikp3.sa.com	82.197.65.139	true	true	unknown
u47331948.ct.sendgrid.net	167.89.118.106	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://ir.nbaikp3.sa.com/delaw/lawn/koo/sf_rand_string_mixed(24)/maximilian.mueller@scanlab.de	false	unknown
http://ir.nbaikp3.sa.com/favicon.ico	false	unknown
https://ecoutura.sa.com/9o93/#Mmaximilian.mueller@scanlab.de	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.74.206	unknown	United States	15169	GOOGLEUS	false
167.89.118.106	u47331948.ct.sendgrid.net	United States	11377	SENDGRIDUS	false
52.109.89.18	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.163	unknown	United States	15169	GOOGLEUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.227	www.google.co.th	United States	15169	GOOGLEUS	false
52.109.68.129	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
2.19.126.151	unknown	European Union	16625	AKAMAI-ASUS	false
188.114.96.3	ecoutura.sa.com	European Union	13335	CLOUDFLARENETUS	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
20.42.73.27	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
184.28.90.27	unknown	United States	16625	AKAMAI-ASUS	false
142.250.184.227	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
82.197.65.139	ir.nbaikp3.sa.com	United Kingdom	25577	C4L-ASGB	true
66.102.1.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546654
Start date and time:	2024-11-01 11:43:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Action Desk Support 01 Nov.msg
Detection:	MAL
Classification:	mal52.winMSG@31/42@18/197
Cookbook Comments:	Found application associated with file extension: .msg

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 52.109.89.18, 184.28.90.27, 52.109.68.129, 2.19.126.151, 2.19.126.160, 52.113.194.132, 142.250.186.163, 142.250.186.46, 66.102.1.84, 20.42.73.27, 34.104.35.123
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Action Desk Support 01 Nov.msg

LLM Input / Output

Input	Output
URL: Model: claude-3-5-sonnet-latest	{ "explanation": [ "The email claims to be from Microsoft but is sent from 'Service IT Center <linda@asib.com.my>', which is suspicious", "The email contains a deceptive 'Verify Now' link using Google URL redirection to mask the actual malicious destination", "The message creates urgency about account deactivation, a common phishing tactic to pressure users into clicking malicious links" ], "phishing": true, "confidence": 10 }
{ "date": "Fri, 01 Nov 2024 11:36:00 +0100", "subject": "Action: Desk Support. 01 Nov", "communications": [ "\nMicrosoft\n\nThis is a notification to let you know that we are deactivating all Inactive accounts.\nPlease confirm maximilian.mueller@scanlab.de is still active by verifying account now\n\nVerify Now <https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fir.nbaikp3.sa.com%2Fdelaw%2Flawn%2Fkoo%2Fsf_rand_string_mixed(24)/maximilian.mueller@scanlab.de>\n\n\n\n\n\nPlease do not print this email unless it is absolutely necessary.\n\n\nThe information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer.\n\nInternet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nDear Shyam,\n\n\n\nKindly Rang and activate our pre-pack list in our new store panda 136 panda 7 as below :\n\n\n\n\n\n\n\nSupplier Site No.\n\n\nNew Location No.\n\n\nSKU\n\n\nDISCRIPTION\n\n\n920902\n\n\n89\n\n\n164350234\n\n\nNAQUA WHOLE COOKED SHRIMP (MEDIUM) PRE-PACK 200G\n\n\n315951\n\n\n492\n\n\n164350197\n\n\nNAQUA WHOLE COOKED SHRIMP (LARGE) PRE-PACK 200G\n\n\n\n\n\n493\n\n\n164350162\n\n\nNAQUA RAW PEELED SHRIMP (MEDIUM) PRE-PACK 200G\n\n\n\n\n\n164350242\n\n\nNAQUA PEELED TAIL-ON COOKED SHRIMP (LARGE) PRE-PACK 200G\n\n\n\n\n\n164350171\n\n\nNAQUA PEELED TAIL-ON COOKED SHRIMP (MEDIUM) PRE-PACK 200G\n\n\n\n\n\n164350146\n\n\nNAQUA RAW PEELED SHRIMP (LARGE) PRE-PACK 200G\n\n\n\n\n\n164350226\n\n\nNAQUA SEA BASS SKIN-ON FILLET PRE-PACK 200G\n\n\n\n\n\n164350200\n\n\nNAQUA SEA BASS STEAKS PRE-PACK 300G\n\n\n\n\n\n\n\n\n\n\n\n\n Mustafa Hasan Turdi\n Assistant Category Manager\n\n\n[X]<https://u47331948.ct.sendgrid.net/ls/click?upn=u001.sQR4LUcjFOothn2V4hzvtdA-2B8I7htBM9MLHVtzycy5b9fh0XcCqCRzzMOibwV-2FFJOCiV_uLkm3ENkUqhOek56w8rYVA5xiSmKF06X82j6-2F0pBi-2BXwWZQOagpJXaZ3Qi6h3EDXzgrPbW4ACHE-2BQ5uF0S4c8mMG1Z-2BuPZq63TQgaq1x-2BebCrU75ZQtEZPYW8ti-2FFq91B0lb7pLFp3EgSk1r8cNomribK7UQ4na9RwBlkaMDdfLNvG51lUrHWbRwUm-2BFRmM3GjpHplicFCBpANxn5zhFN-2FfBwc8vy0n9jnxy4WChUbZajZNPS55z59TRZGNa2ayUdX2cGK9fNNzAaxbXTpqo7gPf9wyQDyGgVMzsR-2BUyrF1u0eU-2BTu7GIGRP-2BltRdZUYXl8kmTDUWgtdYpeZhI-2BlHfskQOFUHBqMvsarLgb3D-2BLSWDTpBYNqRMi1thZS1MTbuKlov-2F4ZIeF0kFIqJHwf07TBJsO56tr2iKUWx251aJNeHFmLiOO-2F2leAhvp1VHkD3eaa-2BOlaX-2B7ST-2FTtqhF6vAJRE4IMgPzAfQMsjjvCK3zv-2BF0YCKbzKyBnhKcd60YSBWHIank1U3c4T5D7UkFAvHnrRBCRfUhcMxzMOCgmyrA7kzbpppMDGF4jHRweCsZFXxu5FfDkuPRbMtJDuh4qx23bYXulPT1vzDykS78p4NdOuQFBtwkHGTf0v-2BEBwxnoRCyLPRAspuAWYDILmefyJy7QzNM-2BqxRuV-2BJ-2FCNxBKN6jx-2BU-2FMcqqDRDGNTF6OIIJ7r9QtdUXzAuVEPTcdonlawJe5lt45bMWu-2BtCCll-2FCJS-2BYU7ACSP-2Ff6FiJAigr3221rIn5c5r5o2tIB7ECKvEe7nLkWzwXeCjKTJP72CklNtf0QFtrb81uaCxOFEq2bxvvpTfBQelLYkxMmu9aJk5-2FFsmtEO0MeIVDrqKWZ6APla0s08EiMKspwT7w198opxl>\n\n\n[X]<https://u47331948.ct.sendgrid.net/ls/click?upn=u001.fhKXagHlmQAT9HRnG1lGrw4KthsAOqoNAb5GVyk0igRdKwPB8poUh5jzlcKJSHNVECoh_uLkm3ENkUqhOek56w8rYVA5xiSmKF06X82j6-2F0pBi-2BXwWZQOagpJXaZ3Qi6h3EDXzgrPbW4ACHE-2BQ5uF0S4c8mMG1Z-2BuPZq63TQgaq1x-2BebCrU75ZQtEZPYW8ti-2FFq91B0lb7pLFp3EgSk1r8cNomribK7UQ4na9RwBlkaMDdfLNvG51lUrHWbRwUm-2BFRmM3GjpHplicFCBpANxn5zhFN-2FfBwc8vy0n9jnxy4WChUbZajZNPS55z59TRZGNa2ayUdX2cGK9fNNzAaxbXTpqo7gPf9wyQDyGgVMzsR-2BUyrF1u0eU-2BTu7GIGRP-2BltRdZUYXl8kmTDUWgtdYpeZhI-2BlHfskQOFUHBqMvsarLgb3D-2BLSWDTpBYNqRMi1thZS1MTbuKlov-2F4ZIeF0kFIqJHwf07TBJsO56tr2iKUWx251aJNeHFmLiOO-2F2leAhvp1VHkD3eaa-2BOlaX-2B7ST-2FTtqhF6vAJRE4IMgPzAfQMsjjvCK3zv-2BF0YCKbzKyBnhKcd60YSBWHIank1U3c4T5D7UkFAvHnrRBCRfUhcMxzMOCgmyrA7kzbpppMDGF4jHRweCsZFXxu5FfDkuPRbMtJDuh4qx23bYXulPT1vzDykS78p4NdOuQFBtwkHGTf0v-2BEBwxnoRCyLPRAspuAWYDILmefyJy7QzNM-2BqxRuV-2BJ-2FCNxBKN6jx-2BU-2FMcqqDRDGNTF6OIIJ7r9QtdUXzAuVEPTcdonla3ZJVP8jmpceh9jTMaKC7n1S9RX4Cz2BqsHRFYaK6mpjJLEDkfHxtxmSWfeyvwg9AHDPmV25djRJFdKOjoiO37AIUwp5TiwgORyg9CvP5nPRyQdxS-2FuEwNFXSQ-2FL-2FiwdTSY-2FgHB7spnYo4mjtUoUiZboltIKKjdRHGr5rnw7gsUE>\n\n\n T. +966 13 8686700 Ext. 175\n M. NULL\n E. mturdi@panda.com.sa<mailto:mturdi@panda.com.sa>\n\n\n\n\n\nPartnering with our communities for a better life [X] <https://u47331948.ct.sendgrid.net/ls/click?upn=u001.sQR4LUcjFOothn2V4hzvtYZ97J1E-2FBvojSzfB2TFC4LGF7uPFHfkgpmB-2BlYz9yS0s7OykSk6iAwhoUKLejFHpIWiEIv9XU-2FUBS3PiP1gKsk-3DDB8W_uLkm3ENkUqhOek56w8rYVA5xiSmKF06X82j6-2F0pBi-2BXwWZQOagpJXaZ3Qi6h3EDXzgrPbW4ACHE-2BQ5uF0S4c8mMG1Z-2BuPZq63TQgaq1x-2BebCrU75ZQtEZPYW8ti-2FFq91B0lb7pLFp3EgSk1r8cNomribK7UQ4na9RwBlkaMDdfLNvG51lUrHWbRwUm-2BFRmM3GjpHplicFCBpANxn5zhFN-2FfBwc8vy0n9jnxy4WChUbZajZNPS55z59TRZGNa2ayUdX2cGK9fNNzAaxbXTpqo7gPf9wyQDyGgVMzsR-2BUyrF1u0eU-2BTu7GIGRP-2BltRdZUYXl8kmTDUWgtdYpeZhI-2BlHfskQOFUHBqMvsarLgb3D-2BLSWDTpBYNqRMi1thZS1MTbuKlov-2F4ZIeF0kFIqJHwf07TBJsO56tr2iKUWx251aJNeHFmLiOO-2F2leAhvp1VHkD3eaa-2BOlaX-2B7ST-2FTtqhF6vAJRE4IMgPzAfQMsjjvCK3zv-2BF0YCKbzKyBnhKcd60YSBWHIank1U3c4T5D7UkFAvHnrRBCRfUhcMxzMOCgmyrA7kzbpppMDGF4jHRweCsZFXxu5FfDkuPRbMtJDuh4qx23bYXulPT1vzDykS78p4NdOuQFBtwkHGTf0v-2BEBwxnoRCyLPRAspuAWYDILmefyJy7QzNM-2BqxRuV-2BJ-2FCNxBKN6jx-2BU-2FMcqqDRDGNTF6OIIJ7r9QtdUXzAuVEPTcdonla8U0KxPqzsXr8L4-2FzQ4qo3GP-2FkqqfbnInM32plVMg8VTZjbDa5MZ-2F4vel-2BmiypqqeCmaV8bM3f5tNfzIY3DFgnhQOMDVkYfXewWFx6s9gpTUNcqbxsrXig-2FCXdutjr4LImihif1PRzRjXhv4T5QNNcy-2FrbKd3sGRUGfGYNt41Iie> [X] <https://u47331948.ct.sendgrid.net/ls/click?upn=u001.sQR4LUcjFOothn2V4hzvtcetLm5fm80vX9Vviy6mCtX8f-2FwyM9MxI05NVNWN3CCeoGroe0nZx149V9NfyNz1Bg-3D-3Dm8NM_uLkm3ENkUqhOek56w8rYVA5xiSmKF06X82j6-2F0pBi-2BXwWZQOagpJXaZ3Qi6h3EDXzgrPbW4ACHE-2BQ5uF0S4c8mMG1Z-2BuPZq63TQgaq1x-2BebCrU75ZQtEZPYW8ti-2FFq91B0lb7pLFp3EgSk1r8cNomribK7UQ4na9RwBlkaMDdfLNvG51lUrHWbRwUm-2BFRmM3GjpHplicFCBpANxn5zhFN-2FfBwc8vy0n9jnxy4WChUbZajZNPS55z59TRZGNa2ayUdX2cGK9fNNzAaxbXTpqo7gPf9wyQDyGgVMzsR-2BUyrF1u0eU-2BTu7GIGRP-2BltRdZUYXl8kmTDUWgtdYpeZhI-2BlHfskQOFUHBqMvsarLgb3D-2BLSWDTpBYNqRMi1thZS1MTbuKlov-2F4ZIeF0kFIqJHwf07TBJsO56tr2iKUWx251aJNeHFmLiOO-2F2leAhvp1VHkD3eaa-2BOlaX-2B7ST-2FTtqhF6vAJRE4IMgPzAfQMsjjvCK3zv-2BF0YCKbzKyBnhKcd60YSBWHIank1U3c4T5D7UkFAvHnrRBCRfUhcMxzMOCgmyrA7kzbpppMDGF4jHRweCsZFXxu5FfDkuPRbMtJDuh4qx23bYXulPT1vzDykS78p4NdOuQFBtwkHGTf0v-2BEBwxnoRCyLPRAspuAWYDILmefyJy7QzNM-2BqxRuV-2BJ-2FCNxBKN6jx-2BU-2FMcqqDRDGNTF6OIIJ7r9QtdUXzAuVEPTcdonlay0DkXuQQt4wZOl-2FNkLkHlyIwQLinjU4Jtib8bIwt7L4EJmprQMzA6lAJnrJDrhzNte5k4a-2FhPili8WQ10RhBLjh-2BeWhvB-2BQNL7VDkPw45DxLh-2B9YFuPbqj88eB04ONbq2M3rD7ZuNEr8l6PsrdUVH4l2hv7S5T-2BON-2BHHBwgVCB8> [X] <https://u47331948.ct.sendgrid.net/ls/click?upn=u001.sQR4LUcjFOothn2V4hzvtR8JYsIrolYRlNrL3cWKd9fYWf8cPAaTUENswtY3y9mog4nq_uLkm3ENkUqhOek56w8rYVA5xiSmKF06X82j6-2F0pBi-2BXwWZQOagpJXaZ3Qi6h3EDXzgrPbW4ACHE-2BQ5uF0S4c8mMG1Z-2BuPZq63TQgaq1x-2BebCrU75ZQtEZPYW8ti-2FFq91B0lb7pLFp3EgSk1r8cNomribK7UQ4na9RwBlkaMDdfLNvG51lUrHWbRwUm-2BFRmM3GjpHplicFCBpANxn5zhFN-2FfBwc8vy0n9jnxy4WChUbZajZNPS55z59TRZGNa2ayUdX2cGK9fNNzAaxbXTpqo7gPf9wyQDyGgVMzsR-2BUyrF1u0eU-2BTu7GIGRP-2BltRdZUYXl8kmTDUWgtdYpeZhI-2BlHfskQOFUHBqMvsarLgb3D-2BLSWDTpBYNqRMi1thZS1MTbuKlov-2F4ZIeF0kFIqJHwf07TBJsO56tr2iKUWx251aJNeHFmLiOO-2F2leAhvp1VHkD3eaa-2BOlaX-2B7ST-2FTtqhF6vAJRE4IMgPzAfQMsjjvCK3zv-2BF0YCKbzKyBnhKcd60YSBWHIank1U3c4T5D7UkFAvHnrRBCRfUhcMxzMOCgmyrA7kzbpppMDGF4jHRweCsZFXxu5FfDkuPRbMtJDuh4qx23bYXulPT1vzDykS78p4NdOuQFBtwkHGTf0v-2BEBwxnoRCyLPRAspuAWYDILmefyJy7QzNM-2BqxRuV-2BJ-2FCNxBKN6jx-2BU-2FMcqqDRDGNTF6OIIJ7r9QtdUXzAuVEPTcdonlaxCpdv62woD5EXs7j8ROfp4JsRSTCtbSLGLIsgqi-2Brqd2yUplCLbFl38HfBn3I2kluwOgWwb7rhNJ0sTrJ-2BwphIZMpwx10jtWj2IySt9L3Xuahd9u-2B2cfNoFeopueKOaWK81Ig5Ou81WiEkRZZj0vmqmhoP5MTFs1RmbW5YjQ4sK> [X] <https://u47331948.ct.sendgrid.net/ls/click?upn=u001.sQR4LUcjFOothn2V4hzvtTIWZe7BGx8-2FHzX4BdIx6Bid7PnRlXSvbCknDxtdtxQbhjYX_uLkm3ENkUqhOek56w8rYVA5xiSmKF06X82j6-2F0pBi-2BXwWZQOagpJXaZ3Qi6h3EDXzgrPbW4ACHE-2BQ5uF0S4c8mMG1Z-2BuPZq63TQgaq1x-2BebCrU75ZQtEZPYW8ti-2FFq91B0lb7pLFp3EgSk1r8cNomribK7UQ4na9RwBlkaMDdfLNvG51lUrHWbRwUm-2BFRmM3GjpHplicFCBpANxn5zhFN-2FfBwc8vy0n9jnxy4WChUbZajZNPS55z59TRZGNa2ayUdX2cGK9fNNzAaxbXTpqo7gPf9wyQDyGgVMzsR-2BUyrF1u0eU-2BTu7GIGRP-2BltRdZUYXl8kmTDUWgtdYpeZhI-2BlHfskQOFUHBqMvsarLgb3D-2BLSWDTpBYNqRMi1thZS1MTbuKlov-2F4ZIeF0kFIqJHwf07TBJsO56tr2iKUWx251aJNeHFmLiOO-2F2leAhvp1VHkD3eaa-2BOlaX-2B7ST-2FTtqhF6vAJRE4IMgPzAfQMsjjvCK3zv-2BF0YCKbzKyBnhKcd60YSBWHIank1U3c4T5D7UkFAvHnrRBCRfUhcMxzMOCgmyrA7kzbpppMDGF4jHRweCsZFXxu5FfDkuPRbMtJDuh4qx23bYXulPT1vzDykS78p4NdOuQFBtwkHGTf0v-2BEBwxnoRCyLPRAspuAWYDILmefyJy7QzNM-2BqxRuV-2BJ-2FCNxBKN6jx-2BU-2FMcqqDRDGNTF6OIIJ7r9QtdUXzAuVEPTcdonla-2FIWCuZzRYpX-2B-2FfeR-2BL3K3EvjVpJoYFjnFlQA8XL2EgrPY23PBPo3oFBOx-2B9uhEBieg6iPQJi91b1uxKsfDxYkd5xzjH-2FGMTEZLS1fPqYuZ-2B0y0n8BTcpAVEZO-2F-2B4UVxTULmaPiMtWuv2228l9aeqw2gqKDQZ3Fq3ALCYj1HTv14> [X] <https://u47331948.ct.sendgrid.net/ls/click?upn=u001.sQR4LUcjFOothn2V4hzvtfN5j9wkLgqAz9LpXsjBwOXQvS-2BFcFGdrZ6ODgCooQ59ZSL3_uLkm3ENkUqhOek56w8rYVA5xiSmKF06X82j6-2F0pBi-2BXwWZQOagpJXaZ3Qi6h3EDXzgrPbW4ACHE-2BQ5uF0S4c8mMG1Z-2BuPZq63TQgaq1x-2BebCrU75ZQtEZPYW8ti-2FFq91B0lb7pLFp3EgSk1r8cNomribK7UQ4na9RwBlkaMDdfLNvG51lUrHWbRwUm-2BFRmM3GjpHplicFCBpANxn5zhFN-2FfBwc8vy0n9jnxy4WChUbZajZNPS55z59TRZGNa2ayUdX2cGK9fNNzAaxbXTpqo7gPf9wyQDyGgVMzsR-2BUyrF1u0eU-2BTu7GIGRP-2BltRdZUYXl8kmTDUWgtdYpeZhI-2BlHfskQOFUHBqMvsarLgb3D-2BLSWDTpBYNqRMi1thZS1MTbuKlov-2F4ZIeF0kFIqJHwf07TBJsO56tr2iKUWx251aJNeHFmLiOO-2F2leAhvp1VHkD3eaa-2BOlaX-2B7ST-2FTtqhF6vAJRE4IMgPzAfQMsjjvCK3zv-2BF0YCKbzKyBnhKcd60YSBWHIank1U3c4T5D7UkFAvHnrRBCRfUhcMxzMOCgmyrA7kzbpppMDGF4jHRweCsZFXxu5FfDkuPRbMtJDuh4qx23bYXulPT1vzDykS78p4NdOuQFBtwkHGTf0v-2BEBwxnoRCyLPRAspuAWYDILmefyJy7QzNM-2BqxRuV-2BJ-2FCNxBKN6jx-2BU-2FMcqqDRDGNTF6OIIJ7r9QtdUXzAuVEPTcdonlawBPiD7VqKxHXdjMMPdn4-2Bm3tjCcDr3Ze-2BHbgwMjq-2BOACEOWUDmIilbFQ-2BBGGX-2B-2B9-2FBXlFmswfKxZB6OhNaN1huu2BHbBK2jbieTGpoSlutyObi7qT06hLkbuCtN5B0EpFcpqFW7wWSrRnAXR-2FhEr2FNmp7uhmcHUB9o4KF182yD>\n\n\n", "From: Philip Grumo Cervantes <pcervantes@naqua.com.sa<mailto:pcervantes@naqua.com.sa>>\nSent: Wednesday, October 30, 2024 10:27 AM\nTo: Mustafa Hasan Turdi <mturdi@panda.com.sa<mailto:mturdi@panda.com.sa>>\nCc: Sarfaraz Ahmed <sarfarazahmed@naqua.com.sa<mailto:sarfarazahmed@naqua.com.sa>>; Sanath Tissa Kumara Liyanaarachchige <s.kumara@naqua.com.sa<mailto:s.kumara@naqua.com.sa>>; Syed Muaaz Ali <muaaz.ali@naqua.com.sa<mailto:muaaz.ali@naqua.com.sa>>; Prudencio M. Pagsuyuin Jr. <p.pagsuyuin@naqua.com.sa<mailto:p.pagsuyuin@naqua.com.sa>>\nSubject: 69434 - Alam Al Qemma Consumer Pack opening in Panda System Branch\nImportance: High\n\n\n\nGood day.\n\n\n\nBelow branches consumer pack is not open in their system, can we open it and include also RTV? For which I see these stores have a good potential.\n\n\n\n\n\nNAME\n\n\nLOCATION\n\n\nPANDA 428\n\n\nDAMMAM\n\n\nPANDA 429\n\n\nDAMMAM\n\n\nPANDA 411\n\n\nJUBAIL\n\n\n\n\nThank you so much for your warm support with this project.\n\n\n\n\n\nSincerely,\n\n\n\n\n\n\n\n\n\nDisclaimer:\nThis message may contain privileged or confidential information intended for the recipient only. If you have received this message by mistake, please inform us immediately. Kindly delete the message and do not forward it or any part of it to anyone else.\nComputer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The organization accepts no liability for any damage caused by any virus transmitted by this email. Email transmission cannot be guaranteed to be secure or error-free, as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender, therefore, does not accept liability for any errors or omissions in the contents of this message which arise as a result of email transmission.\n" ], "from": "Service IT Center <linda@asib.com.my>", "to": "maximilian.mueller@scanlab.de", "attachements": [] }
URL: Email Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Please confirm maximilian.mueller@scanlab.de is still active by verifying account now", "prominent_button_name": "Verify Now", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: Email Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft" ] }
	```json { "brands": [ "Microsoft" ] }
URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": true, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: URL: http://ir.nbaikp3.sa.com

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.396753954617689
Encrypted:	false
SSDEEP:
MD5:	C65D56A74A915ABC16D9B7E51F089946
SHA1:	860239095B0D1B943BD15C3CEA1F09CEAB3AF5D9
SHA-256:	25DE0B1A77F17908F1BB04B819C48B60706A8FAD7489E10CE7CA08C98C9F85C8
SHA-512:	E1CE44159E0A26E13D2FEE92DE0EEE06D343F85989DDF50AA018682B4E524261ABFD22BF0C57584B0A3046DB13D4976BCD3BC3A68896831A5507047FCDAF75A2
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ...X.J,......SM01X...,....*J.J,..........IPM.Activity...........h...............h............H..hl.......Z......h......... ..H..h\cal ...pDat...h....0.........h"..............h........_`Pk...h^...@...I.lw...h....H...8.Uk...0....T...............d.........2h...............kd.o...........!h.............. hg...........#h....8.........$h. ......8....."hp...........'h..............1h"...<.........0h....4....Uk../h....h.....UkH..h(`..p...l.....-h .............+h.......`........... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.085339147334017
Encrypted:	false
SSDEEP:
MD5:	EA711F15A466DDE705871174849EED38
SHA1:	B830E7C1CEBA79A8B774CB37E5437BC17302DC37
SHA-256:	612162819994166D0680B22A97CCB3849A9DD71462BF581AFFC8E11E096EC7BA
SHA-512:	0425EA467053C6110B26A01132EDC8B521B4C1AF8678FE6DD88DE458D7A2A42DD33470BD127CE356079928557F889BD68B3ACEA99EA8E6EDB414F353C49DC430
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-11-01T10:44:03Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-06T09:25:29Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:25:29Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:25:29Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Reputation:	unknown
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Reputation:	unknown
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	unknown
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.6464393446710157
Encrypted:	false
SSDEEP:
MD5:	61D577713D2C88F82E2049F2B7F2F99D
SHA1:	10516A999E3CB472DC801789CD64D45D11CCD06E
SHA-256:	14E694AE84F414199B8AA5B7B46577F62623A3E97E65353F26FD9ACD2251980F
SHA-512:	D7C24247E14C0F44442A49DD8D4173EA20A63422AF604C6024142858296E4B861D5ABA5F65599B658E3A7DA9B68A0B85627389EC9428AD96FB8D93EFBA43E030
Malicious:	false
Reputation:	unknown
Preview:	1730457844

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\718D6FE6-9275-4AB0-A21A-CE0798AF029E

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	180288
Entropy (8bit):	5.290993531868587
Encrypted:	false
SSDEEP:
MD5:	B27D2C7441BD76FC51C2B47321C6C24D
SHA1:	0A85695ABFB82339BC84399696D485DB35DC9F85
SHA-256:	D3D18767B67FDE512EFEFBE7F1BDD75103E1D892AF02A26787E67D7AD1BE043B
SHA-512:	F6FE81692EDD81B1C1B91C4CF8258791DDFE1AB61A8E87D8A64FC2C99AEA3290BC1CC4C6BDC0B53FCC1D83C103645624BF692228E3183FB8EC49994FC3AD14FB
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-11-01T10:44:03">.. Build: 16.0.18223.40125-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09216609452072291
Encrypted:	false
SSDEEP:
MD5:	F138A66469C10D5761C6CBB36F2163C3
SHA1:	EEA136206474280549586923B7A4A3C6D5DB1E25
SHA-256:	C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
SHA-512:	9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13760166725504608
Encrypted:	false
SSDEEP:
MD5:	A1FC724A232BDBA3CD4162ACF39748C1
SHA1:	4CF394CA4094238725A643BD04DB2669E1DCA98B
SHA-256:	4C8743CA2632C89A752117976717B8F81897BDC538699846A70FB213156A0A08
SHA-512:	8173CAD1A1610103C171D18E07FE824E3201181E6A7C4B95E883C3DC1C2D53B9847978E0D6294EFC083AC552326EF23DBEFBC1860C9C0351F6E333BC91384D02
Malicious:	false
Reputation:	unknown
Preview:	.... .c......l.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04495055541749482
Encrypted:	false
SSDEEP:
MD5:	7012DC79E10757DDDEB9765C5160DE8F
SHA1:	60C54338B1638424545E05E77E3B66797F8E5399
SHA-256:	3B60EE9D33CA8EC643EB69AFCA26B0303D233B4E79B44E1005F2A127AA7E846F
SHA-512:	C0725FBE1415E70A6E58B223897E531752459A3ECAF7C70023F715565DC0B4A2F27CF0AE5F4B649F5CB66E71949482DBF2BF27DEB8705C5CB0B909116D822581
Malicious:	false
Reputation:	unknown
Preview:	..-.....................a.;+.L.CO..(.Dxo!I...P..-.....................a.;+.L.CO..(.Dxo!I...P........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	45352
Entropy (8bit):	0.39396383940903223
Encrypted:	false
SSDEEP:
MD5:	D6EE3629214C65232C2870D1F97874B8
SHA1:	D4AC738CCF13D685D14E083E1EB5DBB5A658A433
SHA-256:	7F85A1EBE1CD50FA5893B28BEECF6AFE8BBAE7B0DB8CFE2DB417C611D07C6A3B
SHA-512:	C706B72856D0312FDD56621C46A2AC2DB380B1E6F551D83AC748802924264272F45910E09DD80B65E464C19E70AC683AA1AD0A9A26933AD2CB58A2009B2C32CB
Malicious:	false
Reputation:	unknown
Preview:	7....-..........O..(.D...b.g..........O..(.D.>.....-SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\23767060.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 10 x 18, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	312
Entropy (8bit):	7.069445468893941
Encrypted:	false
SSDEEP:
MD5:	70E908B6181A2E44485B055F67BC0C5A
SHA1:	A81F660555CB0C1BDE19B1246DB42CB57D2D0710
SHA-256:	AB5F7E544F0B0E1ACE8EEBAD51DBCDF44D43B97C74B345B862466A700398CFE9
SHA-512:	DCA1C33CB631DA8E17417BDB2278C64C4CB98279FA682AE28B3712BB09408E709BABA7DC84514879FA9898B23140D2C6D5C5E4BFD1F1AB514D21B4CC0225AB75
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............b.OK....IDAT(Sc....D.F.....a......b.Ye....P.b..o..J...~..w...>.....glY..x.X...........8C..'..%...o^.Vxl.:.E.9..(V7..g..e)X.....2"...s............>C.".......ij.P.....&....+XC.$4..8$..p..y..^>a.p.*..w..\|-]..9..".\|..5.Q=C.0;...i..1.>....VTOa.....3..%....Z....<....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\2EAC156E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 20 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	588
Entropy (8bit):	7.433380995533628
Encrypted:	false
SSDEEP:
MD5:	5C52227F30DF2F7FF75F9D079A929960
SHA1:	F0F542D47D551DF0BFA6F04CE59DF11EB1F383EC
SHA-256:	AB6A01CC5FA66E14FA71BB0512AD87684EC6B727627442BF6A4C5A1FC9AA96CC
SHA-512:	546A4EE3FC9A7A0EC604334E6DBF8CFC66CC1DC651BA0DCAC15FF76A61A5F200419248C47377A9CDD6B78B3F9514DA873914AE021A3F5C91FD4FCD86F9E9D248
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............._.....IDAT8Oc....T..0..........5..1,.........Z...)..Bb.G..f..5c`ddd....W..j...nb......2t..."'..................0.*?....g...Y...1..L.p..>.`0..d...7.e.....@...og...B......1..M9..l.x.O3G..v..S7.2..'cu.........."`y..._?.........F.6v.=EM..Nn.}..b5.Z.aM........\|....2<x...8...b...i`...6/&.0...".T.(L.......U.p......dr\|.z.yq.L.A"{..eh[6....D..ab.0...E-<.A.w.?b.g...3A....eO.2.E.Y.....FL..9....`x..=V....yfA......<..A...\|bX.g......\|......'e7..s.j......1L......=.....u..2.%.1.J+.........p..)p......(.....(..+i..=........2A.........?`.c....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\397713AC.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 18 x 17, 8-bit/color RGBA, non-interlaced
Category:	modified
Size (bytes):	525
Entropy (8bit):	7.449110824811501
Encrypted:	false
SSDEEP:
MD5:	3E7573B77C8A9D8B638AF246F49E7B05
SHA1:	C70AC64CE63F2E15091A8BD40DE61E756B7F3A83
SHA-256:	0F5740A5455F56605FE0FA0F8C03710B61A6C4C945F40CCD629A304007D38DF8
SHA-512:	4CF94EA04672E2EAAC730522FC6860FF78B15658A39FCCEB9D6FD4A60166E376A01E51EA3011146BE7CB24BE3F88E9027EA448FA5BAFBF7F802C606B399950CE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............Z......IDAT8Oc....T......y.........j<3.3.........<...2...1..t.(.9.Z3.,hg.......T8..a..Mx.aafa...a8p....K'."....2j......A#...._x....g85y...;...3p..3.Zp...h..E/.b0...0.........O.gx..5...4...o.....V.y....~!....2,,.c.b..k....CLG....P,.8s.....n..LX.,).....{..%a(b.glg....n........*..Q.(I..A ....eP.Bu..G...J#I..1..~..h:....CtG>...I3..Z\P.......v.9....[........0"6....NG..0..."Rv.V..{...=`...B...Q..(...W0.p.(.\.m.y..... ...w.2\.w....?X.dcee...~#...y.b.(.`Q......-.I.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3D990608.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 75 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3643
Entropy (8bit):	7.936599591651457
Encrypted:	false
SSDEEP:
MD5:	F8775138C10837978D4F5E9922B0FF06
SHA1:	4B2680FF6C34820C052471539F53EB2E306A2324
SHA-256:	BE13201592AC6684A2A36BB5948B99C3054A18BF6654DA2D270BEC8605E65E17
SHA-512:	ECD98144CA996F68DF4613C0E79D673DBC3810D25BA227644D13528A289967E97D078D12528058CDD84413EF7F0BAD897ED4C719A885A2FE710841DE75742E95
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...K...2......c&.....IDAThC.[.xSU......J..B......,..Eq..$-.(...:\|:.....;2....},i.QQ.e.l.4..R...dh..].6.{w..Hx..yi....~M.;..s.{.9.{B./....'...S.....{.g..4iK09.x8...q.W.dR$.{.....\9[.,.+..'..V".vz.<.\.......S...?'..@I....k.X..d#.M..L....)'.......5W........W.r....%.m..}M...d.:....<rp...T/.....x.6W....r.#3i.%JP!.jw...j.....tN.-.Bp...%.<.x.j.....s..%..7.H8...~._.0....6m.C.\|..0c....@...h....ef..o......s\.)R......9...^q.L!../...9#8'.......>.'..@.g.....K...7..^L..%..KW.~T!\|~.j.i.?..oD...l{..X...^&........S.4.3._(Q:.J....(e.}...`U.z'..a......x..o....l...Zc../1kL.EN......{....lE.s..ct............X.[@{..>H9.....V.........7.e.....A..8.!..i..DV.`..u.n....r.R......V.[\|..J.Yfx...RN^.............f.a.,c.<...v;C.......s7........Xu........ac..CI{..8..X...V...?.KI.....'-9.l.L..g...#$..v..N..\...bq...?;...9.a./.LT....n.I.......?IO..y.}..~.`}......N./.4]..?4g"...$X+.l.t{B..g.Y....07....X..8}S.".tJ..H.{r..(S..b!...U./b.....6...J..p.m

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B2094156.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 10 x 115, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	177
Entropy (8bit):	6.465685701277812
Encrypted:	false
SSDEEP:
MD5:	4940BAE1F98CCB6405D112FBF0E14A29
SHA1:	2553B4E39BF367D50DCE44E7B5C62B126B781093
SHA-256:	C31CE2319BE47A678B1FE8265A3BEF65854B66F9FDE32A0E88364FD371CFC996
SHA-512:	7A12FA59CCAFCBB2A03D45D01374327E60AED1F5952A1F6B8666335A7FC45D231FB838C9948D4A25ACE0E4C86D3D5A7B17B29A32BDE47393CF10B4392A66D5E8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......s............xIDATXG.A..0....Y.c}..7.."..b.\.....eg)..<..IZ...m........Pjo........*.....W...BA(..@..@.....'u.A?..c.~....Y..%&...u.:.`R......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\DF736902.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 20 x 14, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	482
Entropy (8bit):	7.395511283685034
Encrypted:	false
SSDEEP:
MD5:	2D9E1BD72730B2882124063F93F8A903
SHA1:	EF2746200A1115D790C0BAC7E25E5FBAFE397716
SHA-256:	1854CD154B080EFA4582824C71188F40532965DDB5649E18737E3FE5D38CB85E
SHA-512:	BCFFCDE8FC68A15CE04FFDE7B3153D9C9B5FABE06EC5E2905C9C7EEFDEF1708DA74ED0A307DCD9B6095E5F736BA13F040A8AC7685D9CE79519823EC5E4225750
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR............./.<.....IDAT8O...K.a...=.C.a...B. ..Z......hh.......jiM..4...F.4..0M...s:.....{.........Z<_t6D.a.T...$<.....~......T".".\|...A.:...25u./:.!....M.......z.....>.I=.\........[._..p....D.......x.j.....!...0m.$..n.Uu.*q:... c1.H..m-.I..}D.e..V+9...\.K.B.UA,...jAW..C6...1n..9.e..].>mn..G.0...e.o.m4...^;!..(....0U...U...0..../z<5fU.......3p......Ap..d7P.djh.sg...,..I.<M.<+.. .R/..L.8.. 4.F...Q".V...5$=7 ..8U1....a..k.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E0806FD4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	514
Entropy (8bit):	7.37188875616014
Encrypted:	false
SSDEEP:
MD5:	5CAF801C8FFE1707B0245981312CF68B
SHA1:	46301CC2C53D930FA38F7F16618CAA3C40D9BE8A
SHA-256:	F1654631075B224E7A54674F1946A4F88C1F7622EB9FBBB6FA42D902792472CD
SHA-512:	EB65461BBEDB163CE40E6F9DD24A66CF1AABC6EAC60330AB56317599B0E1E450BFDB41DD9A7416408F9580E32CEE75F9D83B03D489531A9F580239803BBA9501
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................IDAT8Oc....T..45p.].7..e.p.c...&..p.n:..!}B%..YQI..62031.l(...5..zV.......pk....Nn..\|..9CpS:.c ....P.[@.a`. G......\|.....K.a(..}..a...`.D...2}c...}.0w.J....8...+..M.........`.e........w..{..e....K(I.1.........^..p.?..2<z.....Z..k.f...................q.....n.U......Aq!HuiX:C^@.0.]...'.!.....>......pg.!.vVv..........s....".I3P........+...d.z0?.?..&*.4..x........f.1,.n...l(r!6......<{..t..p....2d..s..m..b..P.....g.2..s...4fp.@...J..T/..g.9..i.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{08E65AE4-42BE-4DDE-89F4-2EFBEAAA91F8}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	74844
Entropy (8bit):	4.11658942713846
Encrypted:	false
SSDEEP:
MD5:	1874D5137199455D7A2CD8EB5F57D0D1
SHA1:	214FFB892862D747861624F745270D9AB2F0DEF1
SHA-256:	6BEC9E36B3FEF320D5677C60EC8B0F9E57BD05F0C8F8B1E56A504D0AA418E68E
SHA-512:	A7EC1226FC5FA4B69E2282E0765BC3B188EE9F544B1F6CB5DFC15DCB585B698E4B83AB7D412DA29A3A1EFA0C3077E516FDB905FCD54C84F721AFEF76B50CFC1E
Malicious:	false
Reputation:	unknown
Preview:	......M.i.c.r.o.s.o.f.t. ...T.h.i.s. .i.s. .a. .n.o.t.i.f.i.c.a.t.i.o.n. .t.o. .l.e.t. .y.o.u. .k.n.o.w. .t.h.a.t. .w.e. .a.r.e. .d.e.a.c.t.i.v.a.t.i.n.g. .a.l.l. .I.n.a.c.t.i.v.e. .a.c.c.o.u.n.t.s.....P.l.e.a.s.e. .c.o.n.f.i.r.m. .m.a.x.i.m.i.l.i.a.n...m.u.e.l.l.e.r.@.s.c.a.n.l.a.b...d.e. .i.s. .s.t.i.l.l. .a.c.t.i.v.e. .b.y. .v.e.r.i.f.y.i.n.g. .a.c.c.o.u.n.t. .n.o.w.............................................................................................................................................................x...............T...X...\...`...d...h...l...p...t...x...\|...............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{6C910AC0-F529-4485-9E2E-344218171E5C}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.03351732319703582
Encrypted:	false
SSDEEP:
MD5:	830FBF83999E052538EAF156AB6ECB17
SHA1:	9F6C69FA4232801D3A4857C630BA7A719662135A
SHA-256:	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
SHA-512:	A83E2E9D5274F0065A26C306F355E9590D6126297EAD87AF053CC78FB64CB31694C533139F72686C77FC772148181D8AAE973E65978D04E5F20F6F6C6BA0A013
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\open[1].gif

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	GIF image data, version 89a, 1 x 1
Category:	modified
Size (bytes):	43
Entropy (8bit):	3.0314906788435274
Encrypted:	false
SSDEEP:
MD5:	325472601571F31E1BF00674C368D335
SHA1:	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
SHA-256:	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
SHA-512:	717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730457841273974300_03117D69-347F-480A-BCC5-CDB3955EAA70.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.013331224442796816
Encrypted:	false
SSDEEP:
MD5:	77BDDB3E1C47C68D26D528686BAA73BF
SHA1:	57BD041209718DDC30ED1AC4AE8FB3B6083509B0
SHA-256:	CD1FCCC794D7B9EF11276067C0F934587DE39C97B9358DBD4F44A68ED54B0DE7
SHA-512:	30888320E3E1654665FAF551D047CA66F753CE7363A336B8C71DE2CC171D4005F66222B70A03B73F782DD5EBE6D9A1E2E56278772699EC9161853EF6999389DE
Malicious:	false
Reputation:	unknown
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..11/01/2024 10:44:01.308.OUTLOOK (0x1B24).0x1B28.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.System.GracefulExit.GracefulAppExitDesktop","Flags":33777014402039809,"InternalSequenceNumber":17,"Time":"2024-11-01T10:44:01.308Z","Data.PreviousAppMajor":16,"Data.PreviousAppMinor":0,"Data.PreviousAppBuild":16827,"Data.PreviousAppRevision":20130,"Data.PreviousSessionId":"0FA3F94D-6D13-4D1E-A2E3-D66C603643F3","Data.PreviousSessionInitTime":"2024-11-01T10:43:41.536Z","Data.PreviousSessionUninitTime":"2024-11-01T10:43:44.646Z","Data.SessionFlags":2147483652,"Data.InstallMethod":0,"Data.OfficeUILang":1033,"Data.PreviousBuild":"Unknown","Data.EcsETag":"\"\"","Data.ProcessorArchitecture":"x64"}...11/01/2024 10:44:01.324.OUTLOOK (0x1B24).0x1A88.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":22

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730457841274734000_03117D69-347F-480A-BCC5-CDB3955EAA70.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241101T0644010037-6948.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	122880
Entropy (8bit):	4.66295267658057
Encrypted:	false
SSDEEP:
MD5:	34ED8B1308A99FAE11967F249EF2A889
SHA1:	A4E4C8CA069F39028D79A088167681C73D3A24C3
SHA-256:	7985B2412F0748BE568F37E602FB7C62112F34922A662BDB83B8A05868B1E22C
SHA-512:	437D0A47A6765194F1EF189EEB5F3F38E5E4CBAE788916B056E50F6BC67E22A1EC1EEE7E5535EB14E30517762E63BFAB5939A0B955B82FB511D0ECA36A5409B3
Malicious:	false
Reputation:	unknown
Preview:	............................................................................`...(...$...#.a.J,..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................N.".Y..........#.a.J,..........v.2._.O.U.T.L.O.O.K.:.1.b.2.4.:.2.0.c.a.3.a.8.0.e.0.0.0.4.7.3.4.9.2.a.4.e.b.d.9.c.c.1.c.5.4.f.0...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.1.0.1.T.0.6.4.4.0.1.0.0.3.7.-.6.9.4.8...e.t.l.......P.P.(...$...EXd.J,..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF3F6AA47A4B6E8DBE.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	172032
Entropy (8bit):	0.4006562032531226
Encrypted:	false
SSDEEP:
MD5:	28B1CBA7F4710CADC524F369BAF1E193
SHA1:	1A35288F918CDA27C7E1F9EB84D224057633AB6D
SHA-256:	9F42F62867C2679D436AC5DDE7FB5986DD4A270022A1BD8978E5B27C460F45CC
SHA-512:	2567D5287965872A0C28181EDA05067B5B7DDEFA51C63567F64183B5D5295C84FAD1C986479545A63B1442E10F56958534196C0FF2C7EA612DE8B6A485FAD872
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:
MD5:	9ABB7B71BF874C04692D7FC01EFBBE5E
SHA1:	D4BB6B70492306ABC95A8E685A04C31A41CD6E71
SHA-256:	29BC8A1A716B7F213CEDF65EFDBF787C1480E1C0F8B6432E57A119DF524AC450
SHA-512:	BD9B2D043E9DDBAD6547A57F498D8C72381677C48C53EFE2DA480218CE3749CB3A933390897D4EAC0CF4B9BE43379AD4F51BA4DACAAE5246416D6C13E511EA45
Malicious:	false
Reputation:	unknown
Preview:	....4.........................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.0214041391379345
Encrypted:	false
SSDEEP:
MD5:	50548BB4ECF0D1DC85492925575F30BF
SHA1:	163193EF9CC511C3F8E4C0D464079E25FEDF2A39
SHA-256:	851C4A204DF25B8F978380A5C06343CDCFEFB19CAD4CAD935B1ED31CDB2D9D28
SHA-512:	351A4F2B89B66D1900E2D1F39D2D4314D1AD8CF8B47663171F516B1ECEEB62DF83F5684DB347398F1083E61890BCF0BD2A00A3C6CC57F4DC73B719940290B1FE
Malicious:	true
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	19657DA295CAFAEFE41E5F6C6FCEC166
SHA1:	51A0B6D11EA6550A623AC994BC6D662203B32F0E
SHA-256:	EFE5C7ABD9680A064AF05646D519D06621E5AF09D36C67D376FB9B95B621FE8B
SHA-512:	04AA57123A8175721E4313FB53A1D461377BC6AB121715012FE05D0610EE1D15AC5DE5762425A2D8530B6315B9137FA530049792319D0F0AFEE6E7863763F7EE
Malicious:	true
Reputation:	unknown
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	3.6731217372481435
Encrypted:	false
SSDEEP:
MD5:	C62C29888756EF7561B538BD825DEAAF
SHA1:	8E5E24054C4290F6AC4521F859D03EC8EAD33ACC
SHA-256:	643F095931BCAA244FADFE686A294860E01F844E606E1C60D444D5F101DA393C
SHA-512:	30250637DE9FE37C00FC89A5A04DCD22C1536F96D003B647A3F254F5F1BA733199DB9AB0BFFDF049AA2A9BB72650C0D1F837619B35E391E1DFF3EC8C11B30B44
Malicious:	true
Reputation:	unknown
Preview:	.user...................................................c.a.l.i....E...<.u.....N..p...[..Xz.dM...(F....xb.....N..p...l....T.........M................N...[...l..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19611
Entropy (8bit):	7.477099902457838
Encrypted:	false
SSDEEP:
MD5:	19657DA295CAFAEFE41E5F6C6FCEC166
SHA1:	51A0B6D11EA6550A623AC994BC6D662203B32F0E
SHA-256:	EFE5C7ABD9680A064AF05646D519D06621E5AF09D36C67D376FB9B95B621FE8B
SHA-512:	04AA57123A8175721E4313FB53A1D461377BC6AB121715012FE05D0610EE1D15AC5DE5762425A2D8530B6315B9137FA530049792319D0F0AFEE6E7863763F7EE
Malicious:	false
Reputation:	unknown
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 09:44:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9796009641726653
Encrypted:	false
SSDEEP:
MD5:	2E2CA8279388F7803B1B8758AE112AC7
SHA1:	8C58C0E9B302EEDF41C0023E1300736708850B46
SHA-256:	13C50910E13B2D4F2628605F195E9DDBC67ABCF7BA5D645A40C039DD5199998C
SHA-512:	D47D712C51BDFCD0298DC491BA4BD84D5C7BF6EB5B74F63AEC7D08E28ED1078731B105EEBA762EB2EA5EC45E59515D6F889E5E307BC1B5E39392791DDD9FC704
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....:.J,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYtU....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY.U....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaY.U....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaY.U..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaY.U...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R..I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 09:44:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9976330434354357
Encrypted:	false
SSDEEP:
MD5:	7C3CAE40A1B5211711988A70600BDFC8
SHA1:	4A9E0C0058DA08B3413E4AE6AC8D05F8461CA0A9
SHA-256:	8E71C27A99DCBD60FB0D49A5C80962B0FA31D60AEAF8BA4BAE3B14D4124BFA73
SHA-512:	1BB155ED16B2BDAD7BD11F2B59473D819489ADFD7D46D48114748EFC4655387BC8D2E25B3C8F75A0DA85402FB3E39F8716017859B33CFC929FF8263A46A35899
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........J,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYtU....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY.U....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaY.U....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaY.U..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaY.U...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R..I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.003624164046087
Encrypted:	false
SSDEEP:
MD5:	105F818EEAB2DA4086A7F96CAE0F48C0
SHA1:	BF9FE104083FB694F80BA5C43CE9D5DC090D263F
SHA-256:	C1B4E5E0751A49FAE6945352B6C803D4E1AF7442D3EB5774F45D9ADE9697C8EE
SHA-512:	8148B48A7C3ADF18F812F7DF4A3878DD8F8228277C5620467EFB70877FDBE8A5768F26B208122DC1906E0AEE78B3A37D8B68E4D77CAD3C50FD1CCCDD55A7AC8F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYtU....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY.U....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaY.U....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaY.U..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R..I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 09:44:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.995518499673972
Encrypted:	false
SSDEEP:
MD5:	426E6A9DAC254360066713C2651F5B38
SHA1:	7B3930BEA679872F747188B822D6D43E970A9073
SHA-256:	AD046A7441869D0C0269738889B3E0F724F12F1CA9625EEE47E63D255214801F
SHA-512:	579B4E5B52D49A1656DEABC7496722838A2943C6107C211CA682D2EDF4C16F900FE7CAA063B4BD2A561BFFF3B1B9E22205BFF18AB6F67E403D223660056FD0FA
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....#...J,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYtU....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY.U....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaY.U....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaY.U..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaY.U...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R..I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 09:44:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.983026421980041
Encrypted:	false
SSDEEP:
MD5:	15DDD2ADFA52D6A19E2ADB1CC1C02C12
SHA1:	6AA88309790C13A86C19C5779E7BAFD08D36F311
SHA-256:	E9AD401DCFD5DBCA2BA5B9B59E1BEAB0AE2AAD3FE8790E53C79C59DF87F4661D
SHA-512:	CB572A93641533D540AC9AA5B4F6D9838767F5666BEF25E41CC3D885EF41A8478C86E73C9A7C8F7EF0D5B89773EABD03B40FFB849420FE9B58F4DF41E6EB8AF1
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......J,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYtU....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY.U....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaY.U....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaY.U..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaY.U...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R..I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 09:44:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.989225416460106
Encrypted:	false
SSDEEP:
MD5:	3D2471FC2D07B39B544ABEE8C07042FE
SHA1:	F206F775AF3539DDED2AFED1897587E47304DD04
SHA-256:	CE4017FA3590D6E20C08F21584BF8A2DF06A87FCE16849CACB57A94C8F588344
SHA-512:	9387CE7F9477823442A329F6F431E59E31C0AE168B2645899BBF7F40BC6E2B09A086BD88D95C5CAC3105B009DB1801745846457C52912866AD78183F21885FB5
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........J,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYtU....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaY.U....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaY.U....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaY.U..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaY.U...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R..I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Desktop\Action Desk Support 01 Nov.msg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	CDFV2 Microsoft Outlook Message
Category:	dropped
Size (bytes):	235008
Entropy (8bit):	5.500182670195261
Encrypted:	false
SSDEEP:
MD5:	7DF3EB650296D6D43DCCE78F6ECAE6E7
SHA1:	5F490AD809160C4BE380A4BA9D3C47F5551F146F
SHA-256:	B4F50E0232D324E3B510BE7DAD29C3162B96FE8D74F01FA9DE70D0F86FA313B5
SHA-512:	45DC85FB6C8568763FC3AE554C3CB32EAF93B8E37D503E813CE1A9117A3A38EBEBB5AF283A9F381D4C2F83F0894A09CD67F5E1E5B63D759E4ED71DB25DDB2C13
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................}................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	1.4030209783580545
Encrypted:	false
SSDEEP:
MD5:	AF26C104E8D52909EC2221DBC79F66BF
SHA1:	E063BDD4C0BC626E2BD345F73AEA44912A1A1BB9
SHA-256:	BA91281B7109754B363CE7FE8A77C124A64A9960902C438CD5560BBDF9BD5E33
SHA-512:	E2F5578BE805334CD06AF8E412F2054241F2D0712AB366AAB2833A83566B03D74548FB8DDB564B6900E2F8FD198FCB08D8EB82FDF0591CB88020D65CFD1CD789
Malicious:	true
Reputation:	unknown
Preview:	!BDN2...SM......\.......................]................@...........@...@...................................@...........................................................................$.......D.......A..........................................................................................................................................................................................................................................................................................................................H........qJ..Q&.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	1.6462101161629112
Encrypted:	false
SSDEEP:
MD5:	D2DD68A6FE39E7891956110927D43D03
SHA1:	E7E528EA48ED15A9B51C93F6F80BD51B4CF94CC4
SHA-256:	E073BD176829BB4875DA5C876153485B99AC4D17766FC7C41817C4BBF2594020
SHA-512:	8FAB02FEBCB5BF3C4A1FF4FDE4DFC40193633F6A40909D74545E3B028E07BFB9248502EB098A2125BF98F3005CECC858DB2C80B124B087A65E2D70FE5A2DCA69
Malicious:	true
Reputation:	unknown
Preview:	..P.C...8.......$...(.@.J,....................#.!BDN2...SM......\.......................]................@...........@...@...................................@...........................................................................$.......D.......A..........................................................................................................................................................................................................................................................................................................................H........qJ..Q&.(.@.J,.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47671)
Category:	dropped
Size (bytes):	47672
Entropy (8bit):	5.401921124762015
Encrypted:	false
SSDEEP:
MD5:	B804BCD42117B1BBE45326212AF85105
SHA1:	7B4175AAF0B7E45E03390F50CB8ED93185017014
SHA-256:	B7595C3D2E94DF7416308FA2CCF5AE8832137C76D2E9A8B02E6ED2CB2D92E2F7
SHA-512:	9A4F038F9010DDCCF5E0FAF97102465EF7BA27B33F55C4B86D167C41096DB1E76C8212A5E36565F0447C4F57340A10DB07BB9AE26982DFFF92C411B5B1F1FB97
Malicious:	false
Reputation:	unknown
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,l,g){try{var h=e[l](g),u=h.value}catch(f){n(f);return}h.done?r(u):Promise.resolve(u).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);function g(u){Ht(l,o,c,g,h,"next",u)}function h(u){Ht(l,o,c,g,h,"throw",u)}g(void 0)})}}function V(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):V(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	1249
Entropy (8bit):	5.242453121762845
Encrypted:	false
SSDEEP:
MD5:	F58515DFE987F7E027C8A71BBC884621
SHA1:	BEC6AEBF5940EA88FBBFF5748D539453D49FA284
SHA-256:	679E7E62B81267C93D0778083AE0FD0EFE24172FF0AC581835B54165B3D9ED43
SHA-512:	F085346A38318F7935D76909DB0367862924CC9B0D96256F7FF4E8999C041E610BBCDE8CA56C92673BDE0991C85E9C9D9B6726ABD91D0C3177462C80D4A99140
Malicious:	false
Reputation:	unknown
URL:	https://ecoutura.sa.com/favicon.ico
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">.<title> 404 Not Found..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1>.<h2 style="margin-top:20px;font-size: 30px;">Not Found..</h2>.<p>The resource requested could not be found on this server!</p>.</div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 23 x 78, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.9370115897867
Encrypted:	false
SSDEEP:
MD5:	2E961A44C8A04C7999A19D0B9D477997
SHA1:	474FA44A11EC2B88003D92775AD905A4877C8945
SHA-256:	5EE2C4C14411D271460311B243527208535F1318E2530C249596EAD7577791FB
SHA-512:	2B54A7A45D82318955FFFAFD3FF2947EEB81FD7B294D5E2BFDF9C710603582A1288FE1CB119223C14F172ADAFA125AABEBB3E6478609EDC3A26B2181C6119828
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8dbb4bc0cfd7e712/1730457935979/bO66fWkmt7UkG65
Preview:	.PNG........IHDR.......N.....D.......IDAT.....$.....IEND.B`.

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Static File Info

General

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	5.660856338746231
TrID:	Outlook Message (71009/1) 58.92% Outlook Form Template (41509/1) 34.44% Generic OLE2 / Multistream Compound File (8008/1) 6.64%
File name:	Action Desk Support 01 Nov.msg
File size:	209'920 bytes
MD5:	b46156130331c514a5f23b72a3ebf346
SHA1:	6c9f25af94c5caf9238eded0e6fab411e67a4868
SHA256:	7fa983146e0d8b853000e49a06997bab133e4b74ffde382c0fbfd8869a5ab53d
SHA512:	b55e77b864aaad6ad393147d593bda8e37a52e0120f9818e3a339702821a57671c5d2517411f54ef7e36fe2845ee3868968c75e7d4acde3f56583f27b6c57676
SSDEEP:	3072:mpKtn8rgyrWjlKRGjnNkEetQo5+0cnqgqOlF1z/Mq6wiqI:IKt8jIjnNUtt5AnNqOB/0Lq
TLSH:	9024D82135EA1109F1B3DF7195E261A68A1B7D522E1949AA31CC330B0BF2D41DDB2B7B
File Content Preview:	........................>...............................................................~......................................................................................................................................................................

Static Mail

General

Subject:	Action: Desk Support. 01 Nov
From:	Service IT Center <linda@asib.com.my>
To:	maximilian.mueller@scanlab.de
Cc:
BCC:
Date:	Fri, 01 Nov 2024 11:36:00 +0100
Communications:	Microsoft This is a notification to let you know that we are deactivating all Inactive accounts. Please confirm maximilian.mueller@scanlab.de is still active by verifying account now Verify Now <https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fir.nbaikp3.sa.com%2Fdelaw%2Flawn%2Fkoo%2Fsf_rand_string_mixed(24)/maximilian.mueller@scanlab.de> Please do not print this email unless it is absolutely necessary. The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. Dear Shyam, Kindly Rang and activate our pre-pack list in our new store panda 136 panda 7 as below : Supplier Site No. New Location No. SKU DISCRIPTION 920902 89 164350234 NAQUA WHOLE COOKED SHRIMP (MEDIUM) PRE-PACK 200G 315951 492 164350197 NAQUA WHOLE COOKED SHRIMP (LARGE) PRE-PACK 200G 493 164350162 NAQUA RAW PEELED SHRIMP (MEDIUM) PRE-PACK 200G 164350242 NAQUA PEELED TAIL-ON COOKED SHRIMP (LARGE) PRE-PACK 200G 164350171 NAQUA PEELED TAIL-ON COOKED SHRIMP (MEDIUM) PRE-PACK 200G 164350146 NAQUA RAW PEELED SHRIMP (LARGE) PRE-PACK 200G 164350226 NAQUA SEA BASS SKIN-ON FILLET PRE-PACK 200G 164350200 NAQUA SEA BASS STEAKS PRE-PACK 300G Mustafa Hasan Turdi Assistant Category Manager [X]<https://u47331948.ct.sendgrid.net/ls/click?upn=u001.sQR4LUcjFOothn2V4hzvtdA-2B8I7htBM9MLHVtzycy5b9fh0XcCqCRzzMOibwV-2FFJOCiV_uLkm3ENkUqhOek56w8rYVA5xiSmKF06X82j6-2F0pBi-2BXwWZQOagpJXaZ3Qi6h3EDXzgrPbW4ACHE-2BQ5uF0S4c8mMG1Z-2BuPZq63TQgaq1x-2BebCrU75ZQtEZPYW8ti-2FFq91B0lb7pLFp3EgSk1r8cNomribK7UQ4na9RwBlkaMDdfLNvG51lUrHWbRwUm-2BFRmM3GjpHplicFCBpANxn5zhFN-2FfBwc8vy0n9jnxy4WChUbZajZNPS55z59TRZGNa2ayUdX2cGK9fNNzAaxbXTpqo7gPf9wyQDyGgVMzsR-2BUyrF1u0eU-2BTu7GIGRP-2BltRdZUYXl8kmTDUWgtdYpeZhI-2BlHfskQOFUHBqMvsarLgb3D-2BLSWDTpBYNqRMi1thZS1MTbuKlov-2F4ZIeF0kFIqJHwf07TBJsO56tr2iKUWx251aJNeHFmLiOO-2F2leAhvp1VHkD3eaa-2BOlaX-2B7ST-2FTtqhF6vAJRE4IMgPzAfQMsjjvCK3zv-2BF0YCKbzKyBnhKcd60YSBWHIank1U3c4T5D7UkFAvHnrRBCRfUhcMxzMOCgmyrA7kzbpppMDGF4jHRweCsZFXxu5FfDkuPRbMtJDuh4qx23bYXulPT1vzDykS78p4NdOuQFBtwkHGTf0v-2BEBwxnoRCyLPRAspuAWYDILmefyJy7QzNM-2BqxRuV-2BJ-2FCNxBKN6jx-2BU-2FMcqqDRDGNTF6OIIJ7r9QtdUXzAuVEPTcdonlawJe5lt45bMWu-2BtCCll-2FCJS-2BYU7ACSP-2Ff6FiJAigr3221rIn5c5r5o2tIB7ECKvEe7nLkWzwXeCjKTJP72CklNtf0QFtrb81uaCxOFEq2bxvvpTfBQelLYkxMmu9aJk5-2FFsmtEO0MeIVDrqKWZ6APla0s08EiMKspwT7w198opxl> [X]<https://u47331948.ct.sendgrid.net/ls/click?upn=u001.fhKXagHlmQAT9HRnG1lGrw4KthsAOqoNAb5GVyk0igRdKwPB8poUh5jzlcKJSHNVECoh_uLkm3ENkUqhOek56w8rYVA5xiSmKF06X82j6-2F0pBi-2BXwWZQOagpJXaZ3Qi6h3EDXzgrPbW4ACHE-2BQ5uF0S4c8mMG1Z-2BuPZq63TQgaq1x-2BebCrU75ZQtEZPYW8ti-2FFq91B0lb7pLFp3EgSk1r8cNomribK7UQ4na9RwBlkaMDdfLNvG51lUrHWbRwUm-2BFRmM3GjpHplicFCBpANxn5zhFN-2FfBwc8vy0n9jnxy4WChUbZajZNPS55z59TRZGNa2ayUdX2cGK9fNNzAaxbXTpqo7gPf9wyQDyGgVMzsR-2BUyrF1u0eU-2BTu7GIGRP-2BltRdZUYXl8kmTDUWgtdYpeZhI-2BlHfskQOFUHBqMvsarLgb3D-2BLSWDTpBYNqRMi1thZS1MTbuKlov-2F4ZIeF0kFIqJHwf07TBJsO56tr2iKUWx251aJNeHFmLiOO-2F2leAhvp1VHkD3eaa-2BOlaX-2B7ST-2FTtqhF6vAJRE4IMgPzAfQMsjjvCK3zv-2BF0YCKbzKyBnhKcd60YSBWHIank1U3c4T5D7UkFAvHnrRBCRfUhcMxzMOCgmyrA7kzbpppMDGF4jHRweCsZFXxu5FfDkuPRbMtJDuh4qx23bYXulPT1vzDykS78p4NdOuQFBtwkHGTf0v-2BEBwxnoRCyLPRAspuAWYDILmefyJy7QzNM-2BqxRuV-2BJ-2FCNxBKN6jx-2BU-2FMcqqDRDGNTF6OIIJ7r9QtdUXzAuVEPTcdonla3ZJVP8jmpceh9jTMaKC7n1S9RX4Cz2BqsHRFYaK6mpjJLEDkfHxtxmSWfeyvwg9AHDPmV25djRJFdKOjoiO37AIUwp5TiwgORyg9CvP5nPRyQdxS-2FuEwNFXSQ-2FL-2FiwdTSY-2FgHB7spnYo4mjtUoUiZboltIKKjdRHGr5rnw7gsUE> T. +966 13 8686700 Ext. 175 M. NULL E. mturdi@panda.com.sa<mailto:mturdi@panda.com.sa> Partnering with our communities for a better life [X] <https://u47331948.ct.sendgrid.net/ls/click?upn=u001.sQR4LUcjFOothn2V4hzvtYZ97J1E-2FBvojSzfB2TFC4LGF7uPFHfkgpmB-2BlYz9yS0s7OykSk6iAwhoUKLejFHpIWiEIv9XU-2FUBS3PiP1gKsk-3DDB8W_uLkm3ENkUqhOek56w8rYVA5xiSmKF06X82j6-2F0pBi-2BXwWZQOagpJXaZ3Qi6h3EDXzgrPbW4ACHE-2BQ5uF0S4c8mMG1Z-2BuPZq63TQgaq1x-2BebCrU75ZQtEZPYW8ti-2FFq91B0lb7pLFp3EgSk1r8cNomribK7UQ4na9RwBlkaMDdfLNvG51lUrHWbRwUm-2BFRmM3GjpHplicFCBpANxn5zhFN-2FfBwc8vy0n9jnxy4WChUbZajZNPS55z59TRZGNa2ayUdX2cGK9fNNzAaxbXTpqo7gPf9wyQDyGgVMzsR-2BUyrF1u0eU-2BTu7GIGRP-2BltRdZUYXl8kmTDUWgtdYpeZhI-2BlHfskQOFUHBqMvsarLgb3D-2BLSWDTpBYNqRMi1thZS1MTbuKlov-2F4ZIeF0kFIqJHwf07TBJsO56tr2iKUWx251aJNeHFmLiOO-2F2leAhvp1VHkD3eaa-2BOlaX-2B7ST-2FTtqhF6vAJRE4IMgPzAfQMsjjvCK3zv-2BF0YCKbzKyBnhKcd60YSBWHIank1U3c4T5D7UkFAvHnrRBCRfUhcMxzMOCgmyrA7kzbpppMDGF4jHRweCsZFXxu5FfDkuPRbMtJDuh4qx23bYXulPT1vzDykS78p4NdOuQFBtwkHGTf0v-2BEBwxnoRCyLPRAspuAWYDILmefyJy7QzNM-2BqxRuV-2BJ-2FCNxBKN6jx-2BU-2FMcqqDRDGNTF6OIIJ7r9QtdUXzAuVEPTcdonla8U0KxPqzsXr8L4-2FzQ4qo3GP-2FkqqfbnInM32plVMg8VTZjbDa5MZ-2F4vel-2BmiypqqeCmaV8bM3f5tNfzIY3DFgnhQOMDVkYfXewWFx6s9gpTUNcqbxsrXig-2FCXdutjr4LImihif1PRzRjXhv4T5QNNcy-2FrbKd3sGRUGfGYNt41Iie> [X] <https://u47331948.ct.sendgrid.net/ls/click?upn=u001.sQR4LUcjFOothn2V4hzvtcetLm5fm80vX9Vviy6mCtX8f-2FwyM9MxI05NVNWN3CCeoGroe0nZx149V9NfyNz1Bg-3D-3Dm8NM_uLkm3ENkUqhOek56w8rYVA5xiSmKF06X82j6-2F0pBi-2BXwWZQOagpJXaZ3Qi6h3EDXzgrPbW4ACHE-2BQ5uF0S4c8mMG1Z-2BuPZq63TQgaq1x-2BebCrU75ZQtEZPYW8ti-2FFq91B0lb7pLFp3EgSk1r8cNomribK7UQ4na9RwBlkaMDdfLNvG51lUrHWbRwUm-2BFRmM3GjpHplicFCBpANxn5zhFN-2FfBwc8vy0n9jnxy4WChUbZajZNPS55z59TRZGNa2ayUdX2cGK9fNNzAaxbXTpqo7gPf9wyQDyGgVMzsR-2BUyrF1u0eU-2BTu7GIGRP-2BltRdZUYXl8kmTDUWgtdYpeZhI-2BlHfskQOFUHBqMvsarLgb3D-2BLSWDTpBYNqRMi1thZS1MTbuKlov-2F4ZIeF0kFIqJHwf07TBJsO56tr2iKUWx251aJNeHFmLiOO-2F2leAhvp1VHkD3eaa-2BOlaX-2B7ST-2FTtqhF6vAJRE4IMgPzAfQMsjjvCK3zv-2BF0YCKbzKyBnhKcd60YSBWHIank1U3c4T5D7UkFAvHnrRBCRfUhcMxzMOCgmyrA7kzbpppMDGF4jHRweCsZFXxu5FfDkuPRbMtJDuh4qx23bYXulPT1vzDykS78p4NdOuQFBtwkHGTf0v-2BEBwxnoRCyLPRAspuAWYDILmefyJy7QzNM-2BqxRuV-2BJ-2FCNxBKN6jx-2BU-2FMcqqDRDGNTF6OIIJ7r9QtdUXzAuVEPTcdonlay0DkXuQQt4wZOl-2FNkLkHlyIwQLinjU4Jtib8bIwt7L4EJmprQMzA6lAJnrJDrhzNte5k4a-2FhPili8WQ10RhBLjh-2BeWhvB-2BQNL7VDkPw45DxLh-2B9YFuPbqj88eB04ONbq2M3rD7ZuNEr8l6PsrdUVH4l2hv7S5T-2BON-2BHHBwgVCB8> [X] <https://u47331948.ct.sendgrid.net/ls/click?upn=u001.sQR4LUcjFOothn2V4hzvtR8JYsIrolYRlNrL3cWKd9fYWf8cPAaTUENswtY3y9mog4nq_uLkm3ENkUqhOek56w8rYVA5xiSmKF06X82j6-2F0pBi-2BXwWZQOagpJXaZ3Qi6h3EDXzgrPbW4ACHE-2BQ5uF0S4c8mMG1Z-2BuPZq63TQgaq1x-2BebCrU75ZQtEZPYW8ti-2FFq91B0lb7pLFp3EgSk1r8cNomribK7UQ4na9RwBlkaMDdfLNvG51lUrHWbRwUm-2BFRmM3GjpHplicFCBpANxn5zhFN-2FfBwc8vy0n9jnxy4WChUbZajZNPS55z59TRZGNa2ayUdX2cGK9fNNzAaxbXTpqo7gPf9wyQDyGgVMzsR-2BUyrF1u0eU-2BTu7GIGRP-2BltRdZUYXl8kmTDUWgtdYpeZhI-2BlHfskQOFUHBqMvsarLgb3D-2BLSWDTpBYNqRMi1thZS1MTbuKlov-2F4ZIeF0kFIqJHwf07TBJsO56tr2iKUWx251aJNeHFmLiOO-2F2leAhvp1VHkD3eaa-2BOlaX-2B7ST-2FTtqhF6vAJRE4IMgPzAfQMsjjvCK3zv-2BF0YCKbzKyBnhKcd60YSBWHIank1U3c4T5D7UkFAvHnrRBCRfUhcMxzMOCgmyrA7kzbpppMDGF4jHRweCsZFXxu5FfDkuPRbMtJDuh4qx23bYXulPT1vzDykS78p4NdOuQFBtwkHGTf0v-2BEBwxnoRCyLPRAspuAWYDILmefyJy7QzNM-2BqxRuV-2BJ-2FCNxBKN6jx-2BU-2FMcqqDRDGNTF6OIIJ7r9QtdUXzAuVEPTcdonlaxCpdv62woD5EXs7j8ROfp4JsRSTCtbSLGLIsgqi-2Brqd2yUplCLbFl38HfBn3I2kluwOgWwb7rhNJ0sTrJ-2BwphIZMpwx10jtWj2IySt9L3Xuahd9u-2B2cfNoFeopueKOaWK81Ig5Ou81WiEkRZZj0vmqmhoP5MTFs1RmbW5YjQ4sK> [X] <https://u47331948.ct.sendgrid.net/ls/click?upn=u001.sQR4LUcjFOothn2V4hzvtTIWZe7BGx8-2FHzX4BdIx6Bid7PnRlXSvbCknDxtdtxQbhjYX_uLkm3ENkUqhOek56w8rYVA5xiSmKF06X82j6-2F0pBi-2BXwWZQOagpJXaZ3Qi6h3EDXzgrPbW4ACHE-2BQ5uF0S4c8mMG1Z-2BuPZq63TQgaq1x-2BebCrU75ZQtEZPYW8ti-2FFq91B0lb7pLFp3EgSk1r8cNomribK7UQ4na9RwBlkaMDdfLNvG51lUrHWbRwUm-2BFRmM3GjpHplicFCBpANxn5zhFN-2FfBwc8vy0n9jnxy4WChUbZajZNPS55z59TRZGNa2ayUdX2cGK9fNNzAaxbXTpqo7gPf9wyQDyGgVMzsR-2BUyrF1u0eU-2BTu7GIGRP-2BltRdZUYXl8kmTDUWgtdYpeZhI-2BlHfskQOFUHBqMvsarLgb3D-2BLSWDTpBYNqRMi1thZS1MTbuKlov-2F4ZIeF0kFIqJHwf07TBJsO56tr2iKUWx251aJNeHFmLiOO-2F2leAhvp1VHkD3eaa-2BOlaX-2B7ST-2FTtqhF6vAJRE4IMgPzAfQMsjjvCK3zv-2BF0YCKbzKyBnhKcd60YSBWHIank1U3c4T5D7UkFAvHnrRBCRfUhcMxzMOCgmyrA7kzbpppMDGF4jHRweCsZFXxu5FfDkuPRbMtJDuh4qx23bYXulPT1vzDykS78p4NdOuQFBtwkHGTf0v-2BEBwxnoRCyLPRAspuAWYDILmefyJy7QzNM-2BqxRuV-2BJ-2FCNxBKN6jx-2BU-2FMcqqDRDGNTF6OIIJ7r9QtdUXzAuVEPTcdonla-2FIWCuZzRYpX-2B-2FfeR-2BL3K3EvjVpJoYFjnFlQA8XL2EgrPY23PBPo3oFBOx-2B9uhEBieg6iPQJi91b1uxKsfDxYkd5xzjH-2FGMTEZLS1fPqYuZ-2B0y0n8BTcpAVEZO-2F-2B4UVxTULmaPiMtWuv2228l9aeqw2gqKDQZ3Fq3ALCYj1HTv14> [X] <https://u47331948.ct.sendgrid.net/ls/click?upn=u001.sQR4LUcjFOothn2V4hzvtfN5j9wkLgqAz9LpXsjBwOXQvS-2BFcFGdrZ6ODgCooQ59ZSL3_uLkm3ENkUqhOek56w8rYVA5xiSmKF06X82j6-2F0pBi-2BXwWZQOagpJXaZ3Qi6h3EDXzgrPbW4ACHE-2BQ5uF0S4c8mMG1Z-2BuPZq63TQgaq1x-2BebCrU75ZQtEZPYW8ti-2FFq91B0lb7pLFp3EgSk1r8cNomribK7UQ4na9RwBlkaMDdfLNvG51lUrHWbRwUm-2BFRmM3GjpHplicFCBpANxn5zhFN-2FfBwc8vy0n9jnxy4WChUbZajZNPS55z59TRZGNa2ayUdX2cGK9fNNzAaxbXTpqo7gPf9wyQDyGgVMzsR-2BUyrF1u0eU-2BTu7GIGRP-2BltRdZUYXl8kmTDUWgtdYpeZhI-2BlHfskQOFUHBqMvsarLgb3D-2BLSWDTpBYNqRMi1thZS1MTbuKlov-2F4ZIeF0kFIqJHwf07TBJsO56tr2iKUWx251aJNeHFmLiOO-2F2leAhvp1VHkD3eaa-2BOlaX-2B7ST-2FTtqhF6vAJRE4IMgPzAfQMsjjvCK3zv-2BF0YCKbzKyBnhKcd60YSBWHIank1U3c4T5D7UkFAvHnrRBCRfUhcMxzMOCgmyrA7kzbpppMDGF4jHRweCsZFXxu5FfDkuPRbMtJDuh4qx23bYXulPT1vzDykS78p4NdOuQFBtwkHGTf0v-2BEBwxnoRCyLPRAspuAWYDILmefyJy7QzNM-2BqxRuV-2BJ-2FCNxBKN6jx-2BU-2FMcqqDRDGNTF6OIIJ7r9QtdUXzAuVEPTcdonlawBPiD7VqKxHXdjMMPdn4-2Bm3tjCcDr3Ze-2BHbgwMjq-2BOACEOWUDmIilbFQ-2BBGGX-2B-2B9-2FBXlFmswfKxZB6OhNaN1huu2BHbBK2jbieTGpoSlutyObi7qT06hLkbuCtN5B0EpFcpqFW7wWSrRnAXR-2FhEr2FNmp7uhmcHUB9o4KF182yD> From: Philip Grumo Cervantes <pcervantes@naqua.com.sa<mailto:pcervantes@naqua.com.sa>> Sent: Wednesday, October 30, 2024 10:27 AM To: Mustafa Hasan Turdi <mturdi@panda.com.sa<mailto:mturdi@panda.com.sa>> Cc: Sarfaraz Ahmed <sarfarazahmed@naqua.com.sa<mailto:sarfarazahmed@naqua.com.sa>>; Sanath Tissa Kumara Liyanaarachchige <s.kumara@naqua.com.sa<mailto:s.kumara@naqua.com.sa>>; Syed Muaaz Ali <muaaz.ali@naqua.com.sa<mailto:muaaz.ali@naqua.com.sa>>; Prudencio M. Pagsuyuin Jr. <p.pagsuyuin@naqua.com.sa<mailto:p.pagsuyuin@naqua.com.sa>> Subject: 69434 - Alam Al Qemma Consumer Pack opening in Panda System Branch Importance: High Good day. Below branches consumer pack is not open in their system, can we open it and include also RTV? For which I see these stores have a good potential. NAME LOCATION PANDA 428 DAMMAM PANDA 429 DAMMAM PANDA 411 JUBAIL Thank you so much for your warm support with this project. Sincerely, Disclaimer: This message may contain privileged or confidential information intended for the recipient only. If you have received this message by mistake, please inform us immediately. Kindly delete the message and do not forward it or any part of it to anyone else. Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The organization accepts no liability for any damage caused by any virus transmitted by this email. Email transmission cannot be guaranteed to be secure or error-free, as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender, therefore, does not accept liability for any errors or omissions in the contents of this message which arise as a result of email transmission.
Attachments:

Headers

Key	Value
Received	from NDczMzE5NDg (unknown)
15.1.2507.39 via Mailbox Transport; Fri, 1 Nov 2024 11	36:35 +0100
15.1.2507.39; Fri, 1 Nov 2024 11	36:35 +0100
15.1.2507.39 via Frontend Transport; Fri, 1 Nov 2024 11	36:35 +0100
Authentication-Results	mail.scanlab.de; spf=None smtp.pra=linda@asib.com.my; spf=Pass smtp.mailfrom=bounces+47331948-c49f-maximilian.mueller=scanlab.de@sendgrid.net; spf=None smtp.helo=postmaster@xvfrskkf.outbound-mail.sendgrid.net
Received-SPF	None (mail.scanlab.de: no sender authenticity
x-record-text="v=spf1 ip4	167.89.0.0/17 ip4:208.117.48.0/20
ip4	159.183.0.0/16 include:ab.sendgrid.net ~all"
IronPort-SDR	6724af31_pGSRWF7ld5bmVOTmlVea8FEEkDfkFkbhzQnyS3SQh6sjiHn
X-IPAS-Result	=?us-ascii?q?A0FbBwCgqSRn/x9h9ahagQmDFAEWRCgZAWMRfARTBIRSg?=
IronPort-PHdr	A9a23:Hf/HFRf3bN0byIbqVucUO/VqlGM+u8LLVj580XLHo4xHfqnrxZn+J
IronPort-Data	A9a23:DG23A6giqKozokRSopTcVt2XX161txkKZh0ujC45NGQN5FlHY01je
IronPort-HdrOrdr	A9a23:03uHE6NTrK+p5cBcTvejsMiBIKoaSvp037BL7SxMoHluGfBw+P
X-Talos-CUID	=?us-ascii?q?9a23=3A7wB9Emm0KCaReR5nUHLtSMvulXXXOWPll33LD16?=
X-Talos-MUID	9a23:Kh/6Wwhij7UzwalHNylzDsMpFuJo2aK1GEA0jZQjp+O8Pw1JNCWbpWHi
X-IronPort-Anti-Spam-Filtered	true
X-IronPort-AV	E=Sophos;i="6.11,249,1725314400";
X-Amp-Result	SKIPPED(no attachment in message)
X-Amp-File-Uploaded	False
X-IronPort-Outbreak-Status	No, level 0, Unknown - Unknown
X-MGA-submission	=?us-ascii?q?MDEpHRVGchTikmYXGHmOBJCh70xvTzDPaJRe/8?=
by mail.scanlab.de with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 01 Nov 2024 11	36:33 +0100
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=sendgrid.net;
h=content-type	from:mime-version:subject:reply-to:list-unsubscribe:
list-unsubscribe-post	to:cc:content-type:from:subject:to;
2024-11-01 10	35:58.778569933 +0000 UTC m=+315906.631494015
Fri, 01 Nov 2024 10	35:58.756 +0000 (UTC)
Content-Type	multipart/alternative; boundary=6db0da3b289349f05e3316659efc0dd7fb4c30bee986c4901232842b3e5a
Date	Fri, 1 Nov 2024 10:36:00 +0000
From	Service IT Center <linda@asib.com.my>
Mime-Version	1.0
Message-ID	<H0jfaXfzQ66DvJsRJaZaFQ@geopod-ismtpd-31>
Subject	Action: Desk Support. 01 Nov
Reply-To	noreply_freequota@gmx.com
List-Unsubscribe	=?us-ascii?Q?=3Cmailto=3Aunsubscribe=40sendgrid=2Enet=3Fsubject=3Dhttps=3A=2F=2Fu47331948=2Ect=2E?=
List-Unsubscribe-Post	List-Unsubscribe=One-Click
X-SG-EID	=?us-ascii?Q?u001=2Eu1G0E8Q2LSLm+cVHEkEyPf67JH+DrjHcdpL66UyM91uRe=2FpZoEUDSNndu?=
X-SG-ID	=?us-ascii?Q?u001=2EXwhBPNhCejkv4+fVosb2QVfR16Qxp9CrA7PjDe5zzeI=2F0IZCBsPXtgHbA?=
To	maximilian.mueller@scanlab.de
X-Entity-ID	u001.wWZGOFTvjo+PWRO1eKZWOA==
Return-Path	prvs=0280b1d72=bounces+47331948-c49f-maximilian.mueller=scanlab.de@sendgrid.net
X-MS-Exchange-Organization-Network-Message-Id	0119ad59-2a5a-4cb1-b812-08dcfa610f37
X-MS-Exchange-Organization-AuthSource	Exchange1-SRV.scanlab-intern.de
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Exchange-Transport-EndToEndLatency	00:00:00.2180491
X-MS-Exchange-Processed-By-BccFoldering	15.01.2507.039
date	Fri, 01 Nov 2024 11:36:00 +0100

File Icon


Icon Hash:	c4e1928eacb280a2

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Action Desk Support 01 Nov.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\718D6FE6-9275-4AB0-A21A-CE0798AF029E

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\23767060.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\2EAC156E.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\397713AC.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3D990608.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B2094156.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\DF736902.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E0806FD4.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{08E65AE4-42BE-4DDE-89F4-2EFBEAAA91F8}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{6C910AC0-F529-4485-9E2E-344218171E5C}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\open[1].gif

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730457841273974300_03117D69-347F-480A-BCC5-CDB3955EAA70.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730457841274734000_03117D69-347F-480A-BCC5-CDB3955EAA70.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241101T0644010037-6948.etl

C:\Users\user\AppData\Local\Temp\~DF3F6AA47A4B6E8DBE.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm (copy)

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm

C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Windows Analysis Report
Action Desk Support 01 Nov.msg