Edit tour
Windows
Analysis Report
Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg
Overview
General Information
| Sample name: | Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg |
| Analysis ID: | 1562261 |
| MD5: | e0c92bacfc67c2ac994c8edb5d848f46 |
| SHA1: | d88375d568a4af5e5e09b977b079a820468e84a6 |
| SHA256: | 65254b1b272d484de501ed0a0e9d34bd5310ca967f373d93cdacb75e90f553e1 |
| Infos: |  |
 | |
Detection
HTMLPhisher
| Score: | 60 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
AI detected phishing page
Yara detected HtmlPhish54
AI detected potential phishing Email
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML page contains string obfuscation
HTML title does not match URL
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Outlook Security Settings Updated - Registry
Stores files to the Windows start menu directory
Classification
- System is w10x64_ra
OUTLOOK.EXE (PID: 4184 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\OUTLO OK.EXE" /f "C:\Users \user\Desk top\Vendor Agreement Ready for Your Sign ature Nove mber 22 20 24 at 0849 23 PM.msg" MD5: 91A5292942864110ED734005B7E005C0) 
ai.exe (PID: 6868 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \root\vfs\ ProgramFil esCommonX6 4\Microsof t Shared\O ffice16\ai .exe" "EE9 F8E4B-B551 -4C51-AEC7 -6D94D9133 390" "9D2E A293-5E3C- 42BC-A718- BD473EC588 43" "4184" "C:\Progr am Files ( x86)\Micro soft Offic e\Root\Off ice16\OUTL OOK.EXE" " WordCombin edFloatieL reOnline.o nnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD) 
Acrobat.exe (PID: 7148 cmdline: "C:\Progra m Files\Ad obe\Acroba t DC\Acrob at\Acrobat .exe" "C:\ Users\user \AppData\L ocal\Micro soft\Windo ws\INetCac he\Content .Outlook\A A3LANRS\Ca rd Factory -Cardfacto ry-agreeme nt__6a0404 2a1da76206 58a5e18dfd 587863-dat ateam.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C) 
AcroCEF.exe (PID: 6440 cmdline: "C:\Progra m Files\Ad obe\Acroba t DC\Acrob at\acrocef _1\AcroCEF .exe" --ba ckgroundco lor=167772 15 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE) - AcroCEF.exe (PID: 6716 cmdline:
"C:\Progra m Files\Ad obe\Acroba t DC\Acrob at\acrocef _1\AcroCEF .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --log-seve rity=disab le --user- agent-prod uct="Reade rServices/ 23.6.20320 Chrome/10 5.0.0.0" - -lang=en-U S --log-fi le="C:\Pro gram Files \Adobe\Acr obat DC\Ac robat\acro cef_1\debu g.log" --m ojo-platfo rm-channel -handle=22 60 --field -trial-han dle=1568,i ,978168238 1244597973 ,752139508 8549441664 ,131072 -- disable-fe atures=Bac kForwardCa che,Calcul ateNativeW inOcclusio n,WinUseBr owserSpell Checker /p refetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE) 
chrome.exe (PID: 7896 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// t1.a.editi ons-legisl atives.fr/ r/?id=hfe2 0c57a%252C 3602a3f1%2 52C7f94ba8 8&p1=googl e.pt/url?q =72934GOtI W72934GOtI W72934GOtI W72934GOtI W72934GOtI W72934GOtI W72934GOtI W72934GOtI W72934GOtI W72934GOtI W72934GOtI W72934GOtI W72934GOtI W72934GOtI W72934GOtI W72934GOtI WpQvvq6xRy j7Y00xDjnl x9kIHOSozu rMOiaAkImP uQJnOIWtJj qJLi6stjtD z3yh&rct=t TPSrMOiaAk ImPuQJnOIW tJjqJLi6st jtFX08pQvv q6xRyj7Y00 xDjnlx9kIj usucT&sa=t &esrc=842H wFgECA0xys 8Em2FL&sou rce=&cd=HX Uursu8uEcr 4eTiw9XH&c ad=XpPkDfJ 6CHARlDJVS 0Y&ved=xjn ktlqryYWwZ IBRrgvK&ua ct=&url=am p/wwgt4tne tengt4tema ilredirect phpactionc lick018081 1085135j94 i3dj1.q245 d.sbs/schm idstorenwe iterdev/Ca rdfactory/ ZGF0YXRlYW 1AY2FyZGZh Y3RvcnkuY2 8udWs= MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA) - chrome.exe (PID: 8092 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2272 --fi eld-trial- handle=188 8,i,139117 3061152843 6003,17788 2930165887 1777,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
- cleanup
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_HtmlPhish_54 | Yara detected HtmlPhish_54 | Joe Security | ||
| JoeSecurity_HtmlPhish_54 | Yara detected HtmlPhish_54 | Joe Security | ||
| JoeSecurity_HtmlPhish_54 | Yara detected HtmlPhish_54 | Joe Security | ||
| JoeSecurity_HtmlPhish_54 | Yara detected HtmlPhish_54 | Joe Security | ||
| JoeSecurity_HtmlPhish_54 | Yara detected HtmlPhish_54 | Joe Security | ||
| Click to see the 1 entries | ||||
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
| Source: | Author: frack113: | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
Phishing |   |
|---|
| Source: | Joe Sandbox AI: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Joe Sandbox AI: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Memory has grown: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Classification label: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File read: | ||
| Source: | Key opened: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Key value queried: | ||
| Source: | Window found: | ||
| Source: | Window detected: | ||
| Source: | Key opened: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | File Volume queried: | ||
| Source: | Process information queried: | ||
| Source: | Queries volume information: | ||
| Source: | Key value queried: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 1 Drive-by Compromise | Windows Management Instrumentation | 1 Browser Extensions | 1 Process Injection | 1 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | 2 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 DLL Side-Loading | 1 DLL Side-Loading | 1 Process Injection | LSASS Memory | 1 File and Directory Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Non-Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 Registry Run Keys / Startup Folder | 1 Registry Run Keys / Startup Folder | 1 DLL Side-Loading | Security Account Manager | 14 System Information Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 1 Extra Window Memory Injection | 1 Extra Window Memory Injection | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| wwgt4tnetengt4temailredirectphpactionclick0180811085135j94i3dj1.q245d.sbs | 172.67.206.110 | true | false | unknown | |
| bg.microsoft.map.fastly.net | 199.232.214.172 | true | false | high | |
| a.nel.cloudflare.com | 35.190.80.1 | true | false | high | |
| challenges.cloudflare.com | 104.18.95.41 | true | false | high | |
| sni1gl.wpc.omegacdn.net | 152.199.21.175 | true | false | high | |
| www.google.com | 172.217.21.36 | true | false | high | |
| fastzonecapecodbaseballmuseumkaihsecotour.earringsandthings.com | 101.99.75.104 | true | true | unknown | |
| worldballoonconventionqualatexcompanarmenian.earringsandthings.com | 101.99.75.104 | true | false | unknown | |
| s-part-0035.t-0009.t-msedge.net | 13.107.246.63 | true | false | high | |
| google.pt | 172.217.19.195 | true | false | unknown | |
| www.google.pt | 172.217.19.195 | true | false | unknown | |
| magamemecoin-drop.com | 104.21.14.72 | true | false | unknown | |
| x1.i.lencr.org | unknown | unknown | false | high | |
| identity.nel.measure.office.net | unknown | unknown | false | high | |
| aadcdn.msftauth.net | unknown | unknown | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false | unknown | ||
| true | unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 172.217.19.227 | unknown | United States | 15169 | GOOGLEUS | false | |
| 101.99.75.104 | fastzonecapecodbaseballmuseumkaihsecotour.earringsandthings.com | Malaysia | 45839 | SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY | true | |
| 13.107.246.63 | s-part-0035.t-0009.t-msedge.net | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 52.202.204.11 | unknown | United States | 14618 | AMAZON-AESUS | false | |
| 172.217.17.67 | unknown | United States | 15169 | GOOGLEUS | false | |
| 2.20.60.204 | unknown | European Union | 20940 | AKAMAI-ASN1EU | false | |
| 172.217.19.195 | google.pt | United States | 15169 | GOOGLEUS | false | |
| 52.109.89.19 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 199.232.214.172 | bg.microsoft.map.fastly.net | United States | 54113 | FASTLYUS | false | |
| 172.217.21.36 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 35.190.80.1 | a.nel.cloudflare.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.181.42 | unknown | United States | 15169 | GOOGLEUS | false | |
| 172.64.41.3 | unknown | United States | 13335 | CLOUDFLARENETUS | false | |
| 104.21.14.72 | magamemecoin-drop.com | United States | 13335 | CLOUDFLARENETUS | false | |
| 52.113.194.132 | unknown | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 172.217.19.238 | unknown | United States | 15169 | GOOGLEUS | false | |
| 1.1.1.1 | unknown | Australia | 13335 | CLOUDFLARENETUS | false | |
| 52.109.68.130 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 104.18.95.41 | challenges.cloudflare.com | United States | 13335 | CLOUDFLARENETUS | false | |
| 2.16.149.9 | unknown | European Union | 1273 | CWVodafoneGroupPLCEU | false | |
| 13.70.79.200 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 23.47.168.24 | unknown | United States | 16625 | AKAMAI-ASUS | false | |
| 63.32.197.17 | unknown | United States | 16509 | AMAZON-02US | false | |
| 64.233.165.84 | unknown | United States | 15169 | GOOGLEUS | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 172.67.206.110 | wwgt4tnetengt4temailredirectphpactionclick0180811085135j94i3dj1.q245d.sbs | United States | 13335 | CLOUDFLARENETUS | false | |
| 152.199.21.175 | sni1gl.wpc.omegacdn.net | United States | 15133 | EDGECASTUS | false | |
| 23.195.39.65 | unknown | United States | 20940 | AKAMAI-ASN1EU | false |
| IP |
|---|
| 192.168.2.17 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1562261 |
| Start date and time: | 2024-11-25 12:18:59 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsinteractivecookbook.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 25 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | stream |
| Analysis stop reason: | Timeout |
| Sample name: | Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg |
| Detection: | MAL |
| Classification: | mal60.phis.winMSG@37/61@35/211 |
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe
- Excluded IPs from analysis (whitelisted): 52.113.194.132, 52.109.89.19
- Excluded domains from analysis (whitelisted): roaming.officeapps.live.com, ecs.office.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, s-0005.s-msedge.net, weu-azsc-000.roaming.officeapps.live.com, ecs.office.trafficmanager.net, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtQueryAttributesFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtSetValueKey calls found.
- VT rate limit hit for: Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 294 |
| Entropy (8bit): | 5.1391393994634145 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 26571D99EAC5A3D6058AB8B66912E3B3 |
| SHA1: | 9256EADC994F66CA02424B8E8166CD418F7EBCE8 |
| SHA-256: | C4D5DB4F0B04760B9CFFD17500E34869ECEE51432815FDC30EA1E6A3D5E1FCB4 |
| SHA-512: | 73EE01033FE6942A8F7D20E260C444D1A1E23FEB80B9B40F381E0C657A9ACD0DCF4FD12835B7338E9DE7A57CC1736BAE22664DE673C84D9AD08282F4CA0EC542 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 338 |
| Entropy (8bit): | 5.182420236714466 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | F384200911C807B6A04B80186C495BDC |
| SHA1: | 22E9A013814676FED98BDA19531714B6672465CE |
| SHA-256: | 1BCDA65F56B401C415FE5D72C82D30384CCDE1B340787142FD6E982C0B0E9848 |
| SHA-512: | 4DA395A113A122531D72B18988E7F6C37071FEAEB78BB50F2E8FBF0A0C5D34214E47E5265CAF51F014BA1D3E66886496C4DBA3EA7B13F0C451346437E84E0670 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5a84fada-85ef-4678-b526-3ac2aaa31bd9.tmp
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 476 |
| Entropy (8bit): | 4.972685033255279 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 667C98C4D90261D060B71EF430986695 |
| SHA1: | 0E84EFFE840FEE76793CFDB80514522FAD3E0DAC |
| SHA-256: | 294D9F60AE60CF3398C9B0AE1E3330728A4346687F6608D30F74103A801273B6 |
| SHA-512: | 6CBCF330DA484B0F54CF378B493305C08AEC9F539A85E59AF4E25E1F32013379AD354BB0F63E8DED4B44F7B35463D686D5E9DB610EC75016FCF09F30D6D6F28C |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 0 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 1B8F511BE0FCD6FB7524F55C9FB06E61 |
| SHA1: | 01BFA769F459561D9748A7E1AD5862DF8216BA4E |
| SHA-256: | 41F52BA78E708F3EEBFB6720F9E13F5DDBE656BCA1E370DF90AA53223ABC6361 |
| SHA-512: | FCF398D9D4274A7FFE41DE433DF3137BC1D62D1933733BAD71ED0DC69F77209427585F8D84088242070835FF2697FBEA752437A7A8C0945CB5A924652DCDC8F5 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6ff2ff.TMP (copy)
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 0 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 1B8F511BE0FCD6FB7524F55C9FB06E61 |
| SHA1: | 01BFA769F459561D9748A7E1AD5862DF8216BA4E |
| SHA-256: | 41F52BA78E708F3EEBFB6720F9E13F5DDBE656BCA1E370DF90AA53223ABC6361 |
| SHA-512: | FCF398D9D4274A7FFE41DE433DF3137BC1D62D1933733BAD71ED0DC69F77209427585F8D84088242070835FF2697FBEA752437A7A8C0945CB5A924652DCDC8F5 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d3d964e0-b8cd-46dc-adf6-e6020e1c7216.tmp
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 384 |
| Entropy (8bit): | 4.932552339462053 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 1B8F511BE0FCD6FB7524F55C9FB06E61 |
| SHA1: | 01BFA769F459561D9748A7E1AD5862DF8216BA4E |
| SHA-256: | 41F52BA78E708F3EEBFB6720F9E13F5DDBE656BCA1E370DF90AA53223ABC6361 |
| SHA-512: | FCF398D9D4274A7FFE41DE433DF3137BC1D62D1933733BAD71ED0DC69F77209427585F8D84088242070835FF2697FBEA752437A7A8C0945CB5A924652DCDC8F5 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6268 |
| Entropy (8bit): | 5.2447386911095 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | E4A5426287CC78F831B96A7631AA59B8 |
| SHA1: | 361F060EEBC47465529D3123F1AF31134E62C667 |
| SHA-256: | 966D14FD52263535AA1386AD9598EE24A0E3B7EF3E920FDD1CA4AF52B829318B |
| SHA-512: | 8E97516542510CB07ADA4CBCB9D787B306D357505560BB57C48265812AE86F7676B2EEAECD33A97A4B9C9CE10D57F08F0ED5B72AB356E2D22496845B8AA00C6B |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 326 |
| Entropy (8bit): | 5.170358728040974 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | F4CA0029A3BAA239FAAEE61A9B5BBB5A |
| SHA1: | 9D38B03CFA7D18B02E63AE5A39024BAE2FA4D559 |
| SHA-256: | 6AD4BDB3431FCAADCA4998EA871F019B827003EF02D810E5F304C3527F6EA48F |
| SHA-512: | 2299D11C09B7F2D7C3FC6728F6537D0638A42BFF5646A244A1B092306BD579E8F864D9FD2E1E38DCD36B7613628E3C3661C04643313077DE8405CDEB8788241D |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 86016 |
| Entropy (8bit): | 4.444791343141643 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | FEB33FC713E62E56971F1C907B37B26F |
| SHA1: | A16A95C4BFF0362EF1209DF7C6E03D3ED4EEF3C0 |
| SHA-256: | 32E5C1EBA8AB61C02BF0123B0C7773071E82DA3B54D92B377493D6D1A26B0557 |
| SHA-512: | 17C8686C0075007A2F5579B0B5C69672F6BC1EB0CEA4B6046726838DBFD8D2772851DA83DC41D4898D78D496D90EA16C8C2DF7D7AAEA6318F91EC6FF8A4D229A |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8720 |
| Entropy (8bit): | 3.7666223782275705 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 7B3BF9BD636EFC0C6BCB51E22B84EB0D |
| SHA1: | ECD4243A183F732EDDE89F0B19A4E0047C7E67C6 |
| SHA-256: | 610AFB9888729BB396D195D4B2EA6EA3B0843D6B3ACA4EE0785761D3845D02BA |
| SHA-512: | 7A1ABAEE27A3067A8F1CF9895E756D56AFD57B215BAE187DD2B4BD9665C37DCE0C6E6C03CF2E9239360265E51703E20FE11EB985D098566E3C6AFE9EE9FCFC7D |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1391 |
| Entropy (8bit): | 7.705940075877404 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 0CD2F9E0DA1773E9ED864DA5E370E74E |
| SHA1: | CABD2A79A1076A31F21D253635CB039D4329A5E8 |
| SHA-256: | 96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6 |
| SHA-512: | 3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 71954 |
| Entropy (8bit): | 7.996617769952133 |
| Encrypted: | true |
| SSDEEP: | |
| MD5: | 49AEBF8CBD62D92AC215B2923FB1B9F5 |
| SHA1: | 1723BE06719828DDA65AD804298D0431F6AFF976 |
| SHA-256: | B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F |
| SHA-512: | BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 192 |
| Entropy (8bit): | 2.7673182398396405 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | AE8E9B6F366267B5A19898FB5228FD89 |
| SHA1: | B3B6ACC6A2005D6E64358A1FCF519E4776EF4484 |
| SHA-256: | F86644F8DE42B9DAA0BBF04A791C3A9BF0DD7F1E139AFEF26E6A94EF133E065D |
| SHA-512: | 199A3133FB02F841FDE3D7F725FC315E6EBD9E45DAAA01A564DCB9C3F3FE9A2E6228A1E0E1DFF163E6DD87AC84A0E8DD69A5FA697427D0AEA187161DB7C8D61C |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 328 |
| Entropy (8bit): | 3.242104774174968 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 72F44C8151F62B963455AB14CF9244FD |
| SHA1: | 6BB6263B678B1F7F9BB21D0486D115344E5D4181 |
| SHA-256: | C60876C819A99E268F70EA98D9AAEA9C8B37544D566F40F88C6071390384A02F |
| SHA-512: | 8ED49C0EDC28B2F6DC92C935B1FED652B192F1E33EDEC8E21143C1E1C73E433B4C782F7874C0A7D3B83D9BD80815AAF19D60FC114E1845679854E751E4F1F4A8 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 0 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 8BA9D8BEBA42C23A5DB405994B54903F |
| SHA1: | FC1B1646EC8A7015F492AA17ADF9712B54858361 |
| SHA-256: | 862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C |
| SHA-512: | 26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1233 |
| Entropy (8bit): | 5.233980037532449 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 8BA9D8BEBA42C23A5DB405994B54903F |
| SHA1: | FC1B1646EC8A7015F492AA17ADF9712B54858361 |
| SHA-256: | 862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C |
| SHA-512: | 26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 0 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 8BA9D8BEBA42C23A5DB405994B54903F |
| SHA1: | FC1B1646EC8A7015F492AA17ADF9712B54858361 |
| SHA-256: | 862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C |
| SHA-512: | 26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 0 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | B60EE534029885BD6DECA42D1263BDC0 |
| SHA1: | 4E801BA6CA503BDAE7E54B7DB65BE641F7C23375 |
| SHA-256: | B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856 |
| SHA-512: | 52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 10880 |
| Entropy (8bit): | 5.214360287289079 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | B60EE534029885BD6DECA42D1263BDC0 |
| SHA1: | 4E801BA6CA503BDAE7E54B7DB65BE641F7C23375 |
| SHA-256: | B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856 |
| SHA-512: | 52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4 |
| Entropy (8bit): | 0.8112781244591328 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | DC84B0D741E5BEAE8070013ADDCC8C28 |
| SHA1: | 802F4A6A20CBF157AAF6C4E07E4301578D5936A2 |
| SHA-256: | 81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06 |
| SHA-512: | 65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2145 |
| Entropy (8bit): | 5.066620667317905 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | F0A8E12AC510E73D6BEF395D94846198 |
| SHA1: | 9EA0421D6BA724AC4AF45166763053478A770D2E |
| SHA-256: | 62C34697E9980F11BEA6209622454FD3F4FBD82AB09CF93E7225AB32AD5151EA |
| SHA-512: | 63F5FEB42F769D62459AC3E5EB039F801FBB966C29E35817BED740AC84C68040818A0BFC0EE0566BCE9CD864530BB04906B807EB38B72132C059715FAF01E74C |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 12288 |
| Entropy (8bit): | 1.355715664119167 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 7C0734649E225D6916B60A6B3D6B03FD |
| SHA1: | 675C2A8BAA98D8526AE3E4AC157B13D15C6FBDF7 |
| SHA-256: | E5D7B49E892C7C6FB8EADD966545705AE8C3EA9E70C2087228FD85C1757C7B0B |
| SHA-512: | D18915099F2FB3A0C96F49E4040C23E41DF8C2FCEFA5824F914869E462E772AEFE39FB384B6513D197DC1DBFC46EF56B513AE5A31C3F8AC38F4CB68A7229432C |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8720 |
| Entropy (8bit): | 1.8295513392659422 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | DD329B3FA5D8421942DC85D997165B0A |
| SHA1: | 6EEB13795AD1668476DD99F82B4410D238C69364 |
| SHA-256: | DBC0AA1D9CD9F45FCDEBC011271965CE0773361268F96DA8E7235A83BDDA9C43 |
| SHA-512: | 41E0D7739CB002789E378FA93972B9A2CCF4ED39594C4F90C107876AB62BD7B7CC9717E6BD34B0CCC4E86E6774DF85CD56AC89BFFD26F19C8427BA1A1CBAFD7D |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 66726 |
| Entropy (8bit): | 5.392739213842091 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | BFF251DA9AC134731D7C3F9F2406EDA0 |
| SHA1: | 55793BFCC490A7A531F11D6E379131333431EFE5 |
| SHA-256: | 4ADDAEB21C50AE54D84CE65C2117578E64BA0F594079B845A89C62F06E78F8FC |
| SHA-512: | CD74C87C13A242555297082B4985CEA677D1A52FC3AFA6A568249C9E69FF0D817E91836937A097E92F3E84D6F9EDC3227AD8446BAAE1CEA710F0CC580F0255FB |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 231348 |
| Entropy (8bit): | 4.387567176000907 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 6670A200E4AC68C234A56820185BB919 |
| SHA1: | 1767FD75CA332CDA2444B09C1E781E96A25DEF52 |
| SHA-256: | 37002B6D26C9213441EF368D06E7E7F872120623138BA06B2FE0B15B3423BD4D |
| SHA-512: | CEB00E3F816646D9FB015E86B6883D1F6686DAB0E4175A57463AB3D9E35DC4C0E5ED8DD51D3D61D6EB747B6DB05A00260FD1BC30C7D93F8494F0B7301162A847 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 32768 |
| Entropy (8bit): | 0.045667179300956734 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | F7A569F81D20C6D4A0DCBD80042F80DF |
| SHA1: | 25CF4CDC2FF8F5875965B447056A29FEF82A27B5 |
| SHA-256: | E2C633C328CF028E72FFD90875447A6DFA87F556721B810C4942A15AD74C841B |
| SHA-512: | B036171F1043AF3DD3E21356CDFA6E75801D8A561BE1A03CB15778823AEF631E982FD8BA6E09D8C7D4A2EEB0018E7EA7E6531021F57B088997913B9A9BD01D07 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 49472 |
| Entropy (8bit): | 0.4832793800505578 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 0B258A060DA2B5BCC4F35339E6AE358D |
| SHA1: | CEDB1551E2A27CCA0896A3BAD00FE4C70ED80DE4 |
| SHA-256: | 838072E7BC1006E0A28A1096524752BFD3C8DA7DA97E11DE3A2D0A1CF87EE656 |
| SHA-512: | 9421872A26CDA75C8D484CE9E36CA644156854A7FAC015D2659842AECAA5D1E4C5000E43FBC5BA454DF12EB8D2C8570B3C37009A7B76A24F2CD90AC24A7DF64B |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\AA3LANRS\Card Factory-Cardfactory-agreement__6a04042a1da7620658a5e18dfd587863-datateam (002).pdf
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 40418 |
| Entropy (8bit): | 7.517568136179179 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | D00F702D3AB9E10CD38BA847A1585F99 |
| SHA1: | 767739C2425C4E78534E31E576F63B46EC13B5F1 |
| SHA-256: | 13C02828802DDD0DAAB89829C85043408E1F87DB0E88714AB85727DEA29658E2 |
| SHA-512: | 1829A414ADD28338F364C144024BA1E11175C3100A7DC371FFA90473E59DFC55340FA2431FACE015B728FD5B92B3E3760FA144F1A9455D2C3CBDCA4D71014F99 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\AA3LANRS\Card Factory-Cardfactory-agreement__6a04042a1da7620658a5e18dfd587863-datateam (002).pdf:Zone.Identifier (copy)
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 0 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | D00F702D3AB9E10CD38BA847A1585F99 |
| SHA1: | 767739C2425C4E78534E31E576F63B46EC13B5F1 |
| SHA-256: | 13C02828802DDD0DAAB89829C85043408E1F87DB0E88714AB85727DEA29658E2 |
| SHA-512: | 1829A414ADD28338F364C144024BA1E11175C3100A7DC371FFA90473E59DFC55340FA2431FACE015B728FD5B92B3E3760FA144F1A9455D2C3CBDCA4D71014F99 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\AA3LANRS\Card Factory-Cardfactory-agreement__6a04042a1da7620658a5e18dfd587863-datateam.pdf:Zone.Identifier
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | FBCCF14D504B7B2DBCB5A5BDA75BD93B |
| SHA1: | D59FC84CDD5217C6CF74785703655F78DA6B582B |
| SHA-256: | EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913 |
| SHA-512: | AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1732533599370806700_943D8002-868D-4E88-B255-D180E66B4B7D.log
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 20971520 |
| Entropy (8bit): | 0.16042922082136776 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 37F35C1720F318F03D81D46ABA4BF2F9 |
| SHA1: | A843C468FBB1A8F54538EA121883511C1DF19DE5 |
| SHA-256: | 2B4EA4AC5C5CE8D6E01DB005DBF1FED6B3C704B766682E4E5070040A84482F35 |
| SHA-512: | 70DBCFD6C97B9E27D358F75943AAF45337640B44EB0DA82D18AD7F138A7B97B87766CC560C1635AA49CC183BA57195E2814D3C09B14EBD4009399C611E1B8206 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1732533599371512500_943D8002-868D-4E88-B255-D180E66B4B7D.log
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 20971520 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 8F4E33F3DC3E414FF94E5FB6905CBA8C |
| SHA1: | 9674344C90C2F0646F0B78026E127C9B86E3AD77 |
| SHA-256: | CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC |
| SHA-512: | 7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 246 |
| Entropy (8bit): | 3.516674370985874 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 00C77584AC9B494B5938C84578B02773 |
| SHA1: | 3AD26AA04F2F95A488A41B267900C555E8F0A73A |
| SHA-256: | 864A2481BDE87BF13BE47163BD92C93F6B3B3F21E678611E7D7508E26B6AF34E |
| SHA-512: | BDF1CCC1569D7EC75DEF77C283E78980DAAC666EE8282194A7362F9ECCACD8558DADFF8109CF82035857F5AA1B7D7AE20C1B34919305214CEFE21441EB6B8207 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241125T0619590158-4184.etl
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | modified |
| Size (bytes): | 94208 |
| Entropy (8bit): | 4.471759427570803 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 61A1A6841484477E60C56D0B3B833415 |
| SHA1: | 889B8A98A07DFB4B312B48F09F203C3B30BCD345 |
| SHA-256: | 4BF292495FF86DE139BF6D8C6B763A73C4DBB2EBA4BC72A94AE2A5946C80E74E |
| SHA-512: | 76578A6C162449D581A67DA95A10969CA536A174C9113FD547A3E05BD898A7D85DC2BF0FF17D8AF6CEA48C2DCBC20348A7FD0D54635022461DC00917D88CB230 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-25 06-20-18-689.log
Download File
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 16525 |
| Entropy (8bit): | 5.359827924713262 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 06DEAEDB81D09FD8FB5FF668D8E09CB2 |
| SHA1: | 28A02BCBD5975117B97A08AFB049F2C94F334726 |
| SHA-256: | D98DE785425112A2D7A41B16073812FA4FA4955F2D5139AE87C9A5FBC4717D64 |
| SHA-512: | 948E3B56E5A8D818A5FE9D74B82A898F7264909ADF2C49E5D096CB90F4D28ED95990545A4857933F0E06D493AA0F6D41F6109C74B44BC0E4B84346B519681936 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 35721 |
| Entropy (8bit): | 5.421542657081389 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | FCC9EC85368C057560EF08B44711D942 |
| SHA1: | 5A37192F8ED1D5FE5BEFA037CD0795F61038DA24 |
| SHA-256: | 6A729EF8DF851C277C8A7434EB5EFC12A20EEDC37CDDE8A7D214137AFA9C317A |
| SHA-512: | 6441EF4FA96A330EFE02944C958113455E0AB17A6C2AE93045784463E6BA7506329E649EA9CEAFE7B53C1356458925D1DAABA791DCC8E9DA8EF64242F1724B81 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1419751 |
| Entropy (8bit): | 7.976496077007677 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 0A347312E361322436D1AF1D5145D2AB |
| SHA1: | 1D6C06A274705F8A295F62AD90CF8CA27555C226 |
| SHA-256: | 094501B3CA4E93F626ABFCAE800645C533B61409DC3D1D233F4D053CE6A124D7 |
| SHA-512: | 9856C231513B47DD996488DF19EEE44DBB320E55432984C0C041EF568B6EC5C05F5340831132890D1D162E0505CA243D579582EDB9157CF722A86EC8CE2FEAFE |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 758601 |
| Entropy (8bit): | 7.98639316555857 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 3A49135134665364308390AC398006F1 |
| SHA1: | 28EF4CE5690BF8A9E048AF7D30688120DAC6F126 |
| SHA-256: | D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B |
| SHA-512: | BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 386528 |
| Entropy (8bit): | 7.9736851559892425 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 5C48B0AD2FEF800949466AE872E1F1E2 |
| SHA1: | 337D617AE142815EDDACB48484628C1F16692A2F |
| SHA-256: | F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE |
| SHA-512: | 44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1407294 |
| Entropy (8bit): | 7.97605879016224 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 716C2C392DCD15C95BBD760EEBABFCD0 |
| SHA1: | 4B4CE9C6AED6A7F809236B2DAFA9987CA886E603 |
| SHA-256: | DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8 |
| SHA-512: | E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 163840 |
| Entropy (8bit): | 0.4759817735817301 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | D2734B4FF37FD15C50526CDFFFB1A51A |
| SHA1: | EED87CA98FC56E254A068E67CAEFD1EF71CC6C07 |
| SHA-256: | E03A0DF9DEE832E01A2538D462CB9E2965D1D65C93D2814B38C92EEFDE71080D |
| SHA-512: | F8A30803FEF3B5975933BC7B0B1A25710D2DC028C7ADD54A137D0D9E1ED43698C1B10DE49F22201FF3FD03A17ADA53C125E2361C91F23A173D58A768A133E3C7 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | modified |
| Size (bytes): | 30 |
| Entropy (8bit): | 1.2389205950315936 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 051BDA147C979B0DC2B06BBB73156471 |
| SHA1: | 49FFFC10C69EBE362D00E607B4AC692973548986 |
| SHA-256: | A0B114D2B52ACC32CC67AD6EC8D03606B22346738CAB4F05C8BB6F2E9E8204FF |
| SHA-512: | B2A3AA398BFFD52FC1EA0C848C284B7DA2B864DA2798DD8D18BDAE54B7A7B08E32857B782B63B9900B4DCD9ABD2B929C2C6B1DDEB669B5687C3E6F251341E3A6 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.995871119123107 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 95B344E16DA26AB31BF5A22B4307E2EC |
| SHA1: | BDBC1CCB1319086DF68391895347B3E2D512D02C |
| SHA-256: | 25A7B7754BA55AF1947F716A15AF6CE18BCAE4BE49D891E91DD19FF7245D4003 |
| SHA-512: | 85B6303549088FD1369FE15F0CDDFAF74577EB652AEF1E30B898D88421B3F80FB600884CC977354A620E49450F850EC2F90E2AAB8EA6624803FA0D736C123641 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 4.01207238017841 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 0AF09176BD25BFB74EB9AA002BB29A80 |
| SHA1: | BAD9B136221C7AAE7EB0AD35C9E12156FC8B0530 |
| SHA-256: | EB33216474EE6998F036FDDCDE4D126B74F581BA1EFEA0DA0EC0CC1C0068D7DB |
| SHA-512: | 118A6190A13E1B7C473B30B37ECA4BA28D8494385E77AE036F8A843C6D0FD3D960D461007C9E4C787045B94B752B06D25C4D7CF8C4A9C3818F39E07810D6FFCB |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2693 |
| Entropy (8bit): | 4.02097958221649 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 606900C15614AB4177993B84A41E160B |
| SHA1: | 0FD8BA03368093AE36F6AB26EED17967A4DBC6B5 |
| SHA-256: | BC2196D530FC7EED7055890EC4FA94ECD3B45D56D592DA49CF35360CB00DF6BC |
| SHA-512: | D1C39524F84891CF57E5BDFBA155A0C9199A0CEE8730B01770E8D11F9A579AC1C7B294A251C1C2D32F93B10D05F1B51FFEFF3431D01581BC30C82F89B54C9893 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 4.010470856982571 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 77D48A49509B48975728AFD5A0C8E22C |
| SHA1: | C085252E3E0E3D5C6FCC4B89A37C7DAEB0B665CE |
| SHA-256: | 5ED1D36B40CDC869815D9B9916FB25665D054F800D8B1B48C79017AC17BB1E39 |
| SHA-512: | CED539F1C73470C47D8CA1C23EAFC2267EA3A26A0D2B3FD2AE4FB9D0EFF9B45468DE49D821430958D05087ADCD811FD2C7775ECC474EA807416766EBE3C65603 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2681 |
| Entropy (8bit): | 4.001038334808991 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | B36030CFC8FBEE02921E8CBB98D0FC3C |
| SHA1: | 6223B41FF5D237DE50C4ECA6D2427A0A4156167B |
| SHA-256: | DE3228F2544AC41DB991696C6CA81D2790232301A49FE1EF9C3626B61273BC73 |
| SHA-512: | EF86F6F6A0244AB011A12D232A771195FCC98594601FDD91A59D314A88C95A1DA8B7F0DD68644ED96D3C3797D9C6057A21AD45B5576378CA6C1AE1BABE9E0DAC |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2683 |
| Entropy (8bit): | 4.008250387510154 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 2EDA358B0CC6CE2FB99007C32D19ACAD |
| SHA1: | 0292CF5CD2C2F818C0254DD6DAA152DF1AA7E9A2 |
| SHA-256: | DD61577138D0A7702CA1F1D3B59DFAD6B2368B14EBA9BC9812886F0F08BE7C04 |
| SHA-512: | 3FECBE5A876BE94437A277992A73D9E0A6B1F2E9D308313BE33C2D0192AD657A4690C48138A90BFBE7A8DEB013E8D1A7BE3B2B90B20385E6B4BB91D4BF68BB28 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 271360 |
| Entropy (8bit): | 1.31509559445185 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 1413E4593362C7E8F712D93D66300019 |
| SHA1: | 13F57922DCD927165C70AB7202B8C2EB425D738A |
| SHA-256: | 6A977A5786D7418B626C0D9FABFB0CEECA9D0254C315996665263353F60558C6 |
| SHA-512: | 277A0D2AD6D4C3A1B0EDC760204DDE93A2B25A31E6E70F91CD0612975AC2D347EBAE87DF0AD7EAAE90CD7826767D9A79C43225EF68ADE2D52E37C0009D9AC282 |
| Malicious: | true |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 131072 |
| Entropy (8bit): | 1.2111081238555816 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 126223966A426539D467853BD99DE8EB |
| SHA1: | 7AA2F2BC4E5524B7F64F59623D30A1235FB9017A |
| SHA-256: | B141787E88781C88961A0CFB5FC6586DA7B3B7B85E86E01EC46399F2CC880E0C |
| SHA-512: | 08AB75155823AB10069CCAF5053ADDCA0AC39678880BA7ED9309B0569C4D6AF0463EBD6C3021C72A709561E46755518B7B349559840C7C32C9BC9ADB0AE7E73B |
| Malicious: | true |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1435 |
| Entropy (8bit): | 7.8613342322590265 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9F368BC4580FED907775F31C6B26D6CF |
| SHA1: | E393A40B3E337F43057EEE3DE189F197AB056451 |
| SHA-256: | 7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36 |
| SHA-512: | 0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 406986 |
| Entropy (8bit): | 5.31836569617146 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | E40761677762EAB0692F86B259C7D744 |
| SHA1: | 34A9B50CEC6E1163CEEFCD4D394DB6524C89A854 |
| SHA-256: | DA4A8DF0C326292B5BEE9C732B3C962FD67AAF2F99D850F1BF65068D573C5619 |
| SHA-512: | 04FA1D6074AD24E3ABAB53D1DE116A6B39B4BE3DFABC082427F1C5A169E50527561F160CC133C2AC4AEDC4E7AC404572F60E531A4618111EA74D138B2B0DD034 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3620 |
| Entropy (8bit): | 6.867828878374734 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | B540A8E518037192E32C4FE58BF2DBAB |
| SHA1: | 3047C1DB97B86F6981E0AD2F96AF40CDF43511AF |
| SHA-256: | 8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D |
| SHA-512: | E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 673 |
| Entropy (8bit): | 7.6596900876595075 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 0E176276362B94279A4492511BFCBD98 |
| SHA1: | 389FE6B51F62254BB98939896B8C89EBEFFE2A02 |
| SHA-256: | 9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C |
| SHA-512: | 8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 47695 |
| Entropy (8bit): | 5.401533135534308 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 481EDB6F4045F16980C920CCD9705105 |
| SHA1: | D8CB40ABC935DC65D25D83D8358F52AC88742F73 |
| SHA-256: | 5F7C821EEA52471A9BBB0397DF6B77EE279505BE05BB52AEF00932989522D3C2 |
| SHA-512: | 497484EF0BAB7D2F4ED38E8063D1BAED9C8B49775CCF490CFF0C2B9CE73265D8E5292DA9FCEEB22B4CED508B9930A6ADBB145E2E2DC458FAF67EBB706D3021D3 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://challenges.cloudflare.com/turnstile/v0/g/e4025c85ea63/api.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 61 |
| Entropy (8bit): | 4.035372245524404 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | C95F8D2D5453CF86E6B94DCECFEF0911 |
| SHA1: | 14197A65ED7AC5DD4215FC054184B8DDA13D3DC5 |
| SHA-256: | FAABB2949B6CFF690159204E07EEF0F05578BC8482534B5CB607746211DE7B64 |
| SHA-512: | B38A3CB8A799F9F28E7A51740AFE06089FDA3B70DDAB10DDCDCD7973F71D15BAB0DC45361D3E0D396E28DD2BE888EA991DF10EF5F43BE0A12BD1E65F0E67D265 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8e8140e4da61c32b/1732533672961/vwIJxFVa6Y1jBBR |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 35168 |
| Entropy (8bit): | 7.99275807202193 |
| Encrypted: | true |
| SSDEEP: | |
| MD5: | D3B6AE9986DF244AB03412CC700335D0 |
| SHA1: | BAAA1F9899178938F3881F09B18265E47DA806E3 |
| SHA-256: | CA50059111D30C2E212C90805792EB543548AEF0D4941E886A778E3DCE0B9066 |
| SHA-512: | 755C57FBC9BECE435A477F76C5E8198CA8942C23BE667ACAB83A00E5CD4F54075B10AA07C7FDC10C38FC3D5C0C406C9132FEB5B67BA5BCCC57EF796054A84E7C |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 122341 |
| Entropy (8bit): | 7.997734268074267 |
| Encrypted: | true |
| SSDEEP: | |
| MD5: | 0015292EAF58B4680B4A303F7C153A35 |
| SHA1: | 39C6356FC5DD37C3695D7ABDFA921EAC92BD830E |
| SHA-256: | C7733C6D69B9FE91B93B3C1FD3838898810C0F23017A1BF3011ECC0DB0722620 |
| SHA-512: | DAE8CED5C0FE1D5485C59F9ACCB20375142B87060CD93040D314E38DDE1F82BBA2E66C0721096DF3F251EE1D5D77919530A9F109F38E022CF74A1802E88C6DC9 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5529 |
| Entropy (8bit): | 7.95514518328613 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 6DEB44A9FE273266EFABC3214B998BA0 |
| SHA1: | C8BE755694C25E416C81F5057670E3B14B2FE08F |
| SHA-256: | 4A1AA3B8B23FB3C150A62BB681DAE96E6CAB20BFAFB89D74FED2E0BC85826BAF |
| SHA-512: | EBA11F91C3751574F82FBF82F81338761142ABC13B14534133A2986BEF2F2505125B648E1E991F79C1ACC731A9008F98C3F7937649533E7C4E59C2548D4E7452 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 142367 |
| Entropy (8bit): | 5.430597817875451 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | CCAA31FD031C4C856EB7B986FD9F447B |
| SHA1: | 0A809EABCDB95FA04DE5F8409B3BC994ED65CBD1 |
| SHA-256: | 3D40B4129B8B4C284908636AE46D72EA053F286FB5FE45DB78351B5B2CFC1EB9 |
| SHA-512: | 4B5B2271DB5F640FEBF13A7C0BDBD630C73530000F1593046D090585D1752E239D894614E23E801BE4C6A379406B6EF521423FA27C3865C3CD4ABB0A64823780 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 2672 |
| Entropy (8bit): | 6.640973516071413 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 166DE53471265253AB3A456DEFE6DA23 |
| SHA1: | 17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D |
| SHA-256: | A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13 |
| SHA-512: | 80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 28 |
| Entropy (8bit): | 4.307354922057605 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9F9FA94F28FE0DE82BC8FD039A7BDB24 |
| SHA1: | 6FE91F82974BD5B101782941064BCB2AFDEB17D8 |
| SHA-256: | 9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E |
| SHA-512: | 34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSFwn8GvbaHt4O_xIFDdFbUVISBQ1Xevf9?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 621 |
| Entropy (8bit): | 7.673946009263606 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 4761405717E938D7E7400BB15715DB1E |
| SHA1: | 76FED7C229D353A27DB3257F5927C1EAF0AB8DE9 |
| SHA-256: | F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF |
| SHA-512: | E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 20400 |
| Entropy (8bit): | 7.980289584022803 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | F0DE9A98DBDFA8C02742CE6D92FB2524 |
| SHA1: | CDEC682AEB9E39EDCCC2374DAB26F04DB754A8B5 |
| SHA-256: | FAF4294F27A542B0F9EA2A7CB2711529AB027CD84A5F5BADFAE752100855E6BE |
| SHA-512: | 856FC9AB199997E69A9487372BC0083564F7115B3E0678CF1D542B9864E9A88D5FFB85697FD93538DC9439071E3BCD4B8BCCBFC610E1A45DE104D6362D8ADCD9 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 16345 |
| Entropy (8bit): | 7.98960525258912 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 187B9EBA41FDF66B2C8F7EB645D2BC17 |
| SHA1: | B1C034F7F5F754F271D094FB417B9A820C1F712C |
| SHA-256: | CA0FBF8421A0CF4CCDA7310B2AE74CBD92214901EC2D0F273EA3B07F12CF96EA |
| SHA-512: | 0D7FB682D24E97C9E3FC04AA87CCB8EC508CA0CF197DA0617EFFD981BC8B5E3600824FDD08F1F31F59D276B5BF53229D00805D984E01D512FD968610C5FE9609 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 17174 |
| Entropy (8bit): | 2.9129715116732746 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 12E3DAC858061D088023B2BD48E2FA96 |
| SHA1: | E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5 |
| SHA-256: | 90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21 |
| SHA-512: | C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 61 |
| Entropy (8bit): | 3.990210155325004 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9246CCA8FC3C00F50035F28E9F6B7F7D |
| SHA1: | 3AA538440F70873B574F40CD793060F53EC17A5D |
| SHA-256: | C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84 |
| SHA-512: | A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| File type: | |
| Entropy (8bit): | 5.022699643310464 |
| TrID: |
|
| File name: | Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg |
| File size: | 164'864 bytes |
| MD5: | e0c92bacfc67c2ac994c8edb5d848f46 |
| SHA1: | d88375d568a4af5e5e09b977b079a820468e84a6 |
| SHA256: | 65254b1b272d484de501ed0a0e9d34bd5310ca967f373d93cdacb75e90f553e1 |
| SHA512: | e72532c97b0cf3a48844e4fb8d4f0399dde09ffedb56115211531f03a82010295006a961f2ee0f8e5d3ca126d56f7ad56878a786d95bb0122490242851b75a27 |
| SSDEEP: | 3072:rMOFQyFH//t31QOFIx3qLln0UhhJr2uf9i:rMuFf/tKx3qLln0UXZ2i |
| TLSH: | 59F3881439EA1119F3B3DF318BE690AB8536FDD2AE15965F2095330E0671941EC63B3B |
| File Content Preview: | ........................>..................................."...................y.............................................................................................................................................................................. |
| Subject: | Vendor Agreement Ready for Your Signature November 22, 2024 at 08:49:23 PM |
| From: | "Noreply-e drive from Ryan Phillips" <chie19810122@nifty.com> |
| To: | datateam@cardfactory.co.uk |
| Cc: | |
| BCC: | |
| Date: | Fri, 22 Nov 2024 21:49:24 +0100 |
| Communications: |
|
| Attachments: |
|
| Key | Value |
|---|---|
| Received | from [127.0.0.1] by mta-snd-e04.mail.nifty.com with ESMTP |
| 20 | 49:44 +0000 |
| (2603 | 10a6:20b:659::6) with Microsoft SMTP Server (version=TLS1_2, |
| 2024 20 | 49:30 +0000 |
| Transport; Fri, 22 Nov 2024 20 | 49:30 +0000 |
| Authentication-Results | spf=softfail (sender IP is 198.154.180.200) |
| Received-SPF | Pass (protection.outlook.com: domain of nifty.com designates |
| via Frontend Transport; Fri, 22 Nov 2024 20 | 49:28 +0000 |
| for <gaganpreet.gandhi@cardfactory.co.uk>; Fri, 22 Nov 2024 20 | 49:39 +0000 (UTC) |
| X-Sophos-Product-Type | Mailflow |
| X-Sophos-Email-ID | b68443a4c7d043b38370bbf8acdfe1e5 |
| 4Xw6fP228Qz5vM7; Fri, 22 Nov 2024 20 | 49:33 +0000 (UTC) |
| by AS2PR03MB9929.eurprd03.prod.outlook.com (2603 | 10a6:20b:646::22) with |
| Authentication-Results-Original | spf=pass (sender IP is 106.153.226.36) |
| for <datateam@cardfactory.co.uk>; Sat, 23 Nov 2024 05 | 49:26 +0900 |
| Disposition-Notification-To | jamiepiraneo11@outlook.com |
| From | "Noreply-e drive from Ryan Phillips" <chie19810122@nifty.com> |
| To | datateam@cardfactory.co.uk |
| Reply-To | ericvena@outlook.com |
| Subject | Vendor Agreement Ready for Your Signature November 22, 2024 at |
| 08 | 49:23 PM |
| Message-ID | <2bf01b89-bcae-9eea-88f7-22e0355ff252@nifty.com> |
| Date | Fri, 22 Nov 2024 20:49:24 +0000 |
| MIME-Version | 1.0 |
| Content-Type | multipart/mixed; boundary="--_NmP-e6ec188f1e903f48-Part_1" |
| DKIM-Signature | v=1; a=rsa-sha256; c=relaxed/relaxed; d=nifty.com; |
| h=From | To:Reply-To:Subject:Date; |
| X-EOPAttributedMessage | 1 |
| X-EOPTenantAttributedMessage | 7956b84e-0c99-46b5-81c6-28689cfa7221:1 |
| X-MS-TrafficTypeDiagnostic | AMS0EPF0000019A:EE_|AS2PR03MB9929:EE_|DU6PEPF0000B61B:EE_|PAXPR03MB7965:EE_|PAVPR03MB10180:EE_ |
| X-MS-Office365-Filtering-Correlation-Id | 09f724af-9d1d-48ce-7c09-08dd0b372f30 |
| X-Microsoft-Antispam-Untrusted | BCL:0; |
| ARA | 13230040|7093399012|12012899012|5062899012|3072899012|2092899012|43540500003; |
| X-Microsoft-Antispam-Message-Info-Original | =?us-ascii?Q?+3hvJosO261h9WYEXbKuDVgpObQNIMAGGsZMnIZKcIm3GcM7oB0vf2WEeIgh?= |
| X-Forefront-Antispam-Report-Untrusted | CIP:106.153.226.36; CTRY:JP; LANG:en; |
| SCL | 1; SRV:; IPV:NLI; SFV:NSPM; H:mta-snd-e04.mail.nifty.com; |
| PTR | mta-snd-e04.mail.nifty.com; CAT:NONE; |
| SFS | (13230040)(7093399012)(12012899012)(5062899012)(3072899012)(2092899012)(43540500003); |
| DIR | INB; |
| X-Auto-Response-Suppress | DR, OOF, AutoReply |
| X-MS-Exchange-Transport-CrossTenantHeadersStamped | PAXPR03MB7965 |
| Content-Transfer-Encoding | 8bit |
| X-Sophos-Email-Scan-Details | 27140d1e1540510e7e771140550e7d75 |
| X-Sophos-Email | [eu-west-1] Antispam-Engine: 6.0.0, |
| AntispamData | 2024.11.22.203016 |
| X-Sophos-SenderHistory | ip=106.153.226.36, fs=159073, fso=47843955, |
| X-Sophos-DomainHistory | d=nifty.com, fs=81249070, fso=81249070, da=86510008, |
| X-LASED-From-ReplyTo-Diff | From:<cardfactory.co.uk>:11, |
| From | <printcraft.co.uk>:11, Reply-To:<printcraft.co.uk>:12 |
| X-LASED-SpamProbability | 0.141851 |
| X-LASED-Hits | AUTH_RES_PASS 0.000000, BODYTEXTP_SIZE_3000_LESS 0.000000, |
| X-LASED-Impersonation | False |
| X-LASED-Spam | NonSpam |
| X-Sophos-MH-Mail-Info-Key | NFh3NmZXNTZCQ3puVFZjLTE3Mi4xOS4yLjIyNw== |
| Return-Path | chie19810122@nifty.com |
| X-MS-Exchange-Organization-ExpirationStartTime | 22 Nov 2024 20:49:39.9291 |
| X-MS-Exchange-Organization-ExpirationStartTimeReason | OriginalSubmit |
| X-MS-Exchange-Organization-ExpirationInterval | 1:00:00:00.0000000 |
| X-MS-Exchange-Organization-ExpirationIntervalReason | OriginalSubmit |
| X-MS-Exchange-Organization-Network-Message-Id | 09f724af-9d1d-48ce-7c09-08dd0b372f30 |
| X-MS-Exchange-Organization-MessageDirectionality | Incoming |
| X-MS-Exchange-Transport-CrossTenantHeadersStripped | DU6PEPF0000B61B.eurprd02.prod.outlook.com |
| X-MS-PublicTrafficType | |
| X-MS-Exchange-Organization-AuthSource | DU6PEPF0000B61B.eurprd02.prod.outlook.com |
| X-MS-Exchange-Organization-AuthAs | Anonymous |
| X-MS-Office365-Filtering-Correlation-Id-Prvs | 958f1673-d992-4c73-9e33-08dd0b3728e8 |
| X-MS-Exchange-Organization-SCL | -1 |
| X-Microsoft-Antispam | BCL:0;ARA:13230040|5062899012|12012899012|35042699022|7093399012|3072899012|2092899012|43540500003; |
| X-Forefront-Antispam-Report | CIP:198.154.180.200;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SKN;H:mfid-euw1.prod.hydra.sophos.com;PTR:mfid-euw1.prod.hydra.sophos.com;CAT:NONE;SFS:(13230040)(5062899012)(12012899012)(35042699022)(7093399012)(3072899012)(2092899012)(43540500003);DIR:INB; |
| X-MS-Exchange-CrossTenant-OriginalArrivalTime | 22 Nov 2024 20:49:39.8823 |
| X-MS-Exchange-CrossTenant-Network-Message-Id | 09f724af-9d1d-48ce-7c09-08dd0b372f30 |
| X-MS-Exchange-CrossTenant-Id | 7956b84e-0c99-46b5-81c6-28689cfa7221 |
| X-MS-Exchange-CrossTenant-AuthSource | DU6PEPF0000B61B.eurprd02.prod.outlook.com |
| X-MS-Exchange-CrossTenant-AuthAs | Anonymous |
| X-MS-Exchange-CrossTenant-FromEntityHeader | Internet |
| X-MS-Exchange-Transport-EndToEndLatency | 00:00:04.8060968 |
| X-MS-Exchange-Processed-By-BccFoldering | 15.20.8158.023 |
| X-Microsoft-Antispam-Mailbox-Delivery | ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003); |
| X-Microsoft-Antispam-Message-Info | =?us-ascii?Q?xEwOQy4nqpUwad+yFWYwhG8+/ceBBZ1yPoCoO0jss1ZGA+TiITNbSgciA/jq?= |
| date | Fri, 22 Nov 2024 21:49:24 +0100 |
 | |
| Icon Hash: | c4e1928eacb280a2 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node