Windows Analysis Report
FW Expiration Pending Support Care HIPAA Acknowledgement Form 2024.eml

Overview

General Information

Sample name:	FW Expiration Pending Support Care HIPAA Acknowledgement Form 2024.eml
Analysis ID:	1562769
MD5:	63e3c96b5b6b003cbf76e93366dfc448
SHA1:	ec106a42c03b9d318cca209aa246c47f902641ac
SHA256:	d3a10154ed35ebb629c6d51680ce422a7e5c4e1fcf9b716bc1ef01e9219df745
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

Suspicious MSG / EML detected (based on various text indicators)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Stores large binary data to the registry

Classification

Signatures

Phishing

AI detected landing page (webpage, office document or email)

Source: Email	Joe Sandbox AI: Page contains button: 'REVIEW DOCUMENT' Source: 'Email'
Source: Email	Joe Sandbox AI: Email contains prominent button: 'review document'

AI detected potential phishing Email

Source: Email

Joe Sandbox AI: Detected potential phishing email: The email claims to be from DocuSign but uses a suspicious security code format and urgent expiration timeline to create pressure. The sender's domain 'docusign.net' attempts to look legitimate but the overall formatting and structure differs from genuine DocuSign emails. The email contains multiple tracking links and suspicious URLs masked as legitimate DocuSign resources

Suspicious MSG / EML detected (based on various text indicators)

Source: MSG / EML

OCR Text: External Sender: See below. Phishing email. Armando Villanueva Finance 562-677-4940 Main: armando.villanueva@24hrcares.com E: www.24hrcares.com w: 200 N. Pacific Coast Hwy I Suite 300 | El Segundo, CA 90245 From: DocuSign NA3 System <dse NA3@docusign.net> Sent: Sunday, November 24, 2024 1:23 AM To: Armando Villanueva <armando.villanueva@24hrcares.com> Subject: Expiration Pending: Support Care HIPAA Acknowledgement Form 2024 Do not click links or open attachments unless you trust the sender] EXTERNAL EMAIL: Pictu re Of Hello, HR Compliance sent you a document to review and sign. REVIEW DOCUMENT HR Compliance compliancehub@24hrcares.com At your earliest convenience, we ask that you review the 24 Hour Home care HIPAA training Guidebook and sign the acknowledgement form to update your records. Thank you! 24 Hour Home care Expiration Pending: This document will expire on December 24, 2024 | 15:59. Powered by docusign Do Not Share This Email This email contains a secure link to Docusign. Please do not share this email, link, or access code with others.

Source: unknown

HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49815 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 26MB

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212

Source: global traffic	DNS traffic detected: DNS query: na3.docusign.net
Source: global traffic	DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.docusign.com
Source: global traffic	DNS traffic detected: DNS query: api.mixpanel.com
Source: global traffic	DNS traffic detected: DNS query: cdn.optimizely.com

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49815 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.winEML@17/80@24/226

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241125T1857470348-6896.etl

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\FW Expiration Pending Support Care HIPAA Acknowledgement Form 2024.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7A878081-2B7C-49F8-B191-8B71F04F6AFC" "7D45DD20-BFB0-4C1B-8DE0-1C5790D14BFD" "6896" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7A878081-2B7C-49F8-B191-8B71F04F6AFC" "7D45DD20-BFB0-4C1B-8DE0-1C5790D14BFD" "6896" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na3.docusign.net/Signing/EmailStart.aspx?a=52a62e08-52ab-4deb-9961-052cba101116&etti=24&acct=07df84b5-c8f5-4e7f-a831-b605f464f6f9&er=4156e787-bddd-48bf-b932-5329c6a60a23
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1980,i,2667196118707451285,13180892797666329255,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na3.docusign.net/Signing/EmailStart.aspx?a=52a62e08-52ab-4deb-9961-052cba101116&etti=24&acct=07df84b5-c8f5-4e7f-a831-b605f464f6f9&er=4156e787-bddd-48bf-b932-5329c6a60a23
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1980,i,2667196118707451285,13180892797666329255,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{799ED9EA-FB5E-11D1-B7D6-00C04FC2AAE2}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Stores large binary data to the registry

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Queries the volume information (name, serial number etc) of a device

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.43.183.255	arya-1323461286.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
35.164.51.148	unknown	United States	16509	AMAZON-02US	false
172.217.19.227	unknown	United States	15169	GOOGLEUS	false
172.217.19.238	unknown	United States	15169	GOOGLEUS	false
104.18.66.57	unknown	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.18.65.57	cdn.optimizely.com	United States	13335	CLOUDFLARENETUS	false
172.217.17.67	unknown	United States	15169	GOOGLEUS	false
172.217.17.78	unknown	United States	15169	GOOGLEUS	false
20.42.65.84	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.64.59.59	unknown	United States	812	ROGERS-COMMUNICATIONSCA	false
52.111.252.18	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
84.201.208.68	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Poland	34390	NPLAYTELEKOM-AS-PONPL	false
23.218.208.109	unknown	United States	6453	AS6453US	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
64.207.218.235	unknown	United States	62856	DOCUS-6-PRODUS	false
35.190.25.25	api.mixpanel.com	United States	15169	GOOGLEUS	false
74.125.205.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.54.81.216	unknown	United States	20940	AKAMAI-ASN1EU	false
52.109.76.243	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.17

Contacted Domains

Name	IP	Active
cdn.optimizely.com	104.18.65.57	true
www.google.com	142.250.181.100	true
api.mixpanel.com	35.190.25.25	true
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.208.68	true
arya-1323461286.us-west-2.elb.amazonaws.com	52.43.183.255	true
na3.docusign.net	unknown	unknown
a.docusign.com	unknown	unknown
docucdn-a.akamaihd.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://na3.docusign.net/Signing/?ti=ebc1a2abb3b74da183969718fa12744e	false		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	data	75FAE2659A70261DE8AA9972E3B4BE17	3BFFBF6FDE223F37AD01F9E3D20CBC70405C03C0	DB391338A43494301C50D005D3C019AF70660E4E7F88E2C496E32F2401D22E1C
C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT	data	3B6B7A6CF6DD8AD35564A10CEAECDD50	1628E0464BA8EA356AE240F80F441A6E0FEEB4B1	4B6EA29C753824B00B10ABF022715649E1B00E3BA8312F6DACE4BC91FDD178DE
C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators	4EEA7CFA81FD72200ADB72D5161EA722	CB2AD6B7DE2F7AB42FE5592E3766856C5FDF0DA7	3E1C7280ACBC7B833DBAC7AF8190006BED1643D73142B7CA866970913C08C5BB
C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json	JSON data	C37972CBD8748E2CA6DA205839B16444	9834B46ACF560146DD7EE9086DB6019FBAC13B4E	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365	4296A064B917926682E7EED650D4A745	3953A6AA9100F652A6CA533C2E05895E52343718	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin	ASCII text, with very long lines (65536), with no line terminators	CC90D669144261B198DEAD45AA266572	EF164048A8BC8BD3A015CF63E78BDAC720071305	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin	ASCII text, with no line terminators	B288ACEAA981E02B301499F8E860ABAE	853ED7283145A8469989AFD0F77EAA39DF0A4A74	CABC11EF29CAA0E7209BF952B6BAE07F845C5EFF2D1E26D69F75309634DBB4F9
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db	SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2	F138A66469C10D5761C6CBB36F2163C3	EEA136206474280549586923B7A4A3C6D5DB1E25	C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal	SQLite Rollback Journal	52145A21FF960A4754322BD17B6C46A4	1D8D712612292A20CDA27889C776740F62A7463B	79614FB5AB1AE205998FB10FF6868DD7FA9BAFEACA73D0D92528A1A0E57F5EC9
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm	data	FFAE20A77367BB1487DF5D358FF895BA	81A30567D0E8904B87726774942FEA1237250EF1	C1D08E8816341597C91D611B6963F12D0627594A494ED1EC74E6B0147F55F0B4
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal	SQLite Write-Ahead Log, version 3007000	D4E56BA6F1377EA1744911370869F247	CF3BE9DCE0B3AF400EAE4C22E9708250ADB1864D	84C4419100BBDC2F344B6CDFE48B4BE1D8205DF310E0D20DC23C842D741D0AE5
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres	data	2EDB5F0E85B58450024DF15DB9220E1D	E6D730B34DBEB17695A216564AE5B827A0052F2B	E45D827344C6EBD6A4BD7F20CDF70434B596CFC613FE0AB88253FF01FD805940
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres	data	467A0EE6A55C8419E88FB936C2AFCC75	7DCAEAA35E069A182A1CCDFE6F128E69DA3F3BF3	533E36F086EC2552D4F12C2BD7C32E99FAE087C933D3CE487297DED2B954FB61
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres	data	FC78E18C6668418868D3D3C12CABE6D1	9974737DF32C61AE1104E5E5B5F64081E1CB114A	DAC1B43D0AED89BE7E9762F31A604035D4F4D75C6A301CD74A342BB52BDCB065
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\370D8B73.dat	PNG image data, 5 x 23, 8-bit/color RGBA, non-interlaced	834A4209CE463FEE69EA2D053CEB95BF	0C4456B733F1F8A823BD3B3AC71766A5FBA2B326	8B6CB44CE509E5AC3E586EFC604FAC0831E861B70A042C9F984A54A511F41F54
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{02002EA7-6A12-4C04-BAE1-9ED0B06E93A9}.tmp	data	01F33155C998260E4B2EBEDF3A6F74E7	327623684585D0A4F2488E074E7A703B2F0E8225	C728EFD46DC36685C65A99D77E40361EC9B17B246DCB788B0BBE69462A4A4CCF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\image[1].gif	GIF image data, version 89a, 834 x 834	FF815D5C160DCF604CC8C1CE3EB4B480	6E582061703AE0800D59A951654D34F03AF6566F	832FFA5710A9C9D96248CDD073AB2145B3A70AFF5831685F5BE4885D8AD1193A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Image[1].png	PNG image data, 128 x 27, 8-bit/color RGBA, non-interlaced	96D8807F272D946A37AD501C0E688BD4	1AB2289435C63BC32BD76968F5B5AC421A50DF59	DA97D0D672285ECAAB74BCE2B8D40B178759FC099A1DE15A60BA199B864A7888
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\docInvite-white[1].png	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced	6A78B0944A1DA4F3892D0F4A0163DA25	EDBEE8BAECF4D272F1B52BFA4C823DDC50E5486D	C9903CB4027BD617227A5F968C1B48883F9FFC3C140A629C418A413A3C14991C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\email-logo[1].png	PNG image data, 228 x 50, 8-bit/color RGBA, non-interlaced	B4F8F0DCDA279711CB9224C2239323D4	3C1B1B68CD9D2D25FF5D7FB2C7A61271DFFBF41B	53D92718DD6001A4EBF49D631AB9DF5B8194E6AF220790B1D8CF57164E38C6B0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NB937L4Q\icon-download-app[1].png	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	E03518ED70845F60E54D995516FC7814	F70C7019C0989B62CC691B6CD34859D8FC506C01	6F1AE1C2D727A21E023D4C687EDBD6FB7AA97BE003E3B17E4E6A2505F2B2B82C
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1732579067543392600_BA754FBE-C2D9-483D-A0C2-6E8BEEEF5CD7.log	ASCII text, with very long lines (860), with CRLF line terminators	A47052B1196462B404575F9E1382113C	4A2EE1E28A840470804ADC1FE6DDEC85595E1F34	35878CE05486EED1A29453C7EAC32C771F7A257A78066DF72DABC34054BBB499
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1732579067544139600_BA754FBE-C2D9-483D-A0C2-6E8BEEEF5CD7.log	data	8F4E33F3DC3E414FF94E5FB6905CBA8C	9674344C90C2F0646F0B78026E127C9B86E3AD77	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241125T1857470348-6896.etl	data	B890060E8B90E3020166E162C89C9A61	23D9A350FDD9B0DCFC4DEACA5E6F6EB44362BD3B	DD30B511C3E78ECEFA22B70882D9E782114C488438E6313829AF2E9C33C38A4E
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl	data	40B0707A5CD82D7B8E8BC2817A27279D	53878CC0A90BED8C929E25A16E2C435792CF45E6	98FA4CEAC697E335BD5A68FB1D399E172C087E6CB756EFEA57D0D425479EA61F
C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs	Composite Document File V2 Document, Cannot read section info	185E94A7172C76D487A25E5935D26E34	9C32179963228229F64D0E6B200B54ECCE5FAB0F	9B084581FBC942A71668D0079E01036DE74E49A38C965B6DDCE05EDCC346FE21
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC	Unicode text, UTF-16, little-endian text, with CRLF line terminators	A5E51FDFAF429614FB5218AB559D299A	262EC76760BB9A83BCFF955C985E70820DF567AE	3E82E9F60CE38815C28B0E5323268BDA212A84C3A9C7ACCC731360F998DF0240
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 22:58:05 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	57F15829AF9DA04BA3CABBF5DDD14556	0FC0569E437CF1EA6EDE4DB3AD13B04422E31A30	6F991BFF13391BC12D3C4B368B79CF320ABF5136BD966D93C6112399D7461452
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 22:58:05 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	F543579C246844B8858FF714DEFCAF79	7F7D7BFDED94ABE0BE5F69311AFE35253BEB63EB	66096CECFA54E6ED7A7DA0F070AB45CF8CFAD71EFD3E5A3D92B1D93E115C24EF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	7696441C7F4F42D75FEE7F7EE636F834	B7DD3ADBD21AE39D06665116B16245ACDA9B0095	FA5F87F4049C9779C928DB265ED99B8505E52BA466AFE8629CCD4D119B4B5704
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 22:58:05 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	97B0F9492DC4136175907C923B166A51	89FB97494D101B28293FAF3400FEDFF45E3E466E	94F5CBF52B0DB7A625A402270178FA99BE6DBD16173084B23344C966D5A24A96
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 22:58:05 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	A2CD18BF140409C94A127CB7DC2FAE03	3F5E64E8CA3C506EB5994E32C9AFB49F7D5C2675	69F61F5F4EEFC454037C67B91BA5D903418B2AD39AA56A2B4EC76BEE7C825C62
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 22:58:05 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	203A186250E1D168FAB8319EC26D5FCD	9A110ABD0F8754FFB2CC9E8A437AA09F2E546243	062BEAAEAA94F00C36CE5876A893B81B9C667E6F17BB1A8D73D95403FFA25343
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst	Microsoft Outlook email folder (>=2003)	2828ADA174AE5C92C0D1FC9A5BD6C31F	8BE90AB5ACCD3921AFAD4F640B96E73142E83DE7	EB0C46B89DC959B47AB2E6BCD80CF7D4FBA2A90D6831795C651B9D1A411E7103
C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp	data	501A4B5C3D64819539C7D6AB06302E0B	2336132FBD4399A3B5F9C4B8CE03D4FCFCF92BF7	5BE0129A9A128F7EA7BC1FF702EEE5FEAA99F36D1D67592B72646FC9600D7BB2
Chrome Cache Entry: 167	Unicode text, UTF-8 text, with very long lines (30984)	48BC933608F733A9283F2218C73A941F	E04E625C70A5E8505B77A51D82D9A73AFA9F3547	FCBC395A3D24699D9229846A30C9FE245D77A7AFDBC8386838A03A837C6672AA
Chrome Cache Entry: 168	ASCII text, with very long lines (17329)	BC03940CFAB2484BAC8A2D41FE9E4C53	7E050C5FA27B3792A117745CBB1C63D42FF117EF	0E1D410DD2C0ABB80B9FA543A104A97D927A411D3D8A81FE614BD7D6ECEF632D
Chrome Cache Entry: 170	ASCII text, with very long lines (65438)	C9A178E87EF9D67207B744DD8252556E	32A11476141AE8CC9E0881E56743DFA0DBC0843E	4298AB8A22EEDA2DEEEACBA50E9AB4E86696CEF95E639F4ACB8DA89C8187809E
Chrome Cache Entry: 172	ASCII text, with very long lines (65448)	57DF0E34273CB75DC3A46C4F4C805D84	88D61F0784F25731D468B72F0F48319A112A0414	48E41A664A5F60ACEEAAA1C32BCC7FEBFEF091C3B79AA62F2429B03B18152F76
Chrome Cache Entry: 175	ASCII text, with very long lines (65440)	5B34F77F2A7BDCD695F205886AFC5F3D	90629FA500198EA078AC71FF3FBE0A7BB7EF9DC2	2726B24B18B694BB1992FFBFC096078BC5054EFF0A41E6CE32077178145D34F4
Chrome Cache Entry: 176	ASCII text, with very long lines (9874)	BEB8B66AB72084608723E3FE8054C93A	6829D76B076820BBC0080D16CDF69EC3450582EC	8D7B65A0D96C9BAB1972D98C546E3BEE9F2BCE67AA10CACBCDC6274D6BD5F766
Chrome Cache Entry: 178	ASCII text, with very long lines (9377)	DB19C71E2E3A20DB637D018D5B641ADE	64059292B782CCBD0334898D7D742CE7D4B3DCA5	A2E7FF838CF122F5AEB0A62B298553EB3318A34E1AFA2C45CF62FDB6B7CD5EED
Chrome Cache Entry: 179	ASCII text, with very long lines (65448)	66CB0BA84C866A3247B18C4E5ED80356	1F68BB87B3113200EE4D51E8FA0F1D4D0F2EB34C	B4452B79618142577FB11DDAC0AF96DB53868A97A79D7F944D6A5E59517E9676
Chrome Cache Entry: 180	Unicode text, UTF-8 text, with very long lines (13823)	E7E019E41003F5579677352C65822381	E54EC42B7E034BD95776E856A826A02E9FF4C0F5	09F919ADF0A7F4C3EE28D2547F000283D2C3F9C9B2C4BCB41511882F25756B8B
Chrome Cache Entry: 181	ASCII text, with very long lines (61773)	BF3A9D5151C8B9D586CCEE2347368C3B	C86D8899D703C46EE2E3660ED7D0FA48423D8CEB	0A9CD92388893914A5DEC03A5D7CAB4832A9912C1B30E5B5FF0EF67D61CC6D2B
Chrome Cache Entry: 182	ASCII text, with very long lines (631), with no line terminators	C7FF0481BA4714B2A8EC37C636E9F48E	B143A63B5285650603ACC063565B3769621063F0	38D3B5338C0DC8754CA866D7068A7089A49C1167E240669BF8FF0ABD17B4C3E9
Chrome Cache Entry: 183	ASCII text, with very long lines (46070)	9FF6C771D8F1571EE4ED5A15C75741C8	402F8577AE1E7175F354A7F3532CF90CAA61040D	647E0D35687A333F02B80F7C4605EA7B32DAF7A4314C5654B1F1F825AAFB9CF7
Chrome Cache Entry: 184	Unicode text, UTF-8 text, with very long lines (16859)	DEC04B57977555D02A949E88B04CA086	68CBDFCC8A9B00B93B4681986B88941C229F4FD9	1E78776195DAC7AF74183205A1916FD78F21F150FFCF62F8D9AB0491D8DD6F41
Chrome Cache Entry: 186	ASCII text, with very long lines (65448)	D625021888FB263923D555D11F4D41A4	F0274774A841DF73E1FBC138ABF0A9EB4F64AFA1	45643151800C77DBB83D3D24C5D90BD5BB989BB11E7E862F533584C00D9352D6
Chrome Cache Entry: 187	HTML document, ASCII text, with very long lines (65448)	CD34838FD5BB396CB816821D6E77F649	18BC0B2FAB1124614B321526237D980363A735B5	FFE96356B533198165293502713767D2FD6A0645F979BA5D0D21B1592404668D
Chrome Cache Entry: 190	ASCII text	ECE7A224F69AB2205D90900589AE1D05	3D861B816A5DA892C8A88D5755A5537C036239DE	FFA8C6A4CE199BFD9E32B05E0E4DECE330C6A577FB3A0E8518291619C658C486
Chrome Cache Entry: 191	Unicode text, UTF-8 text, with very long lines (65439)	06573B4089B6AE15BA75CDA15CDC26DC	AB9BB4BF549A58346755D5F5682ABB0C68BF4014	94F1B29EA884DD3C743B21B789169206B93364AD249DE66EF6F7A073C83824DE
Chrome Cache Entry: 194	ASCII text, with very long lines (65448)	DAAD01ADC359B47B49908A74ECD07F2D	BE29F6DC813A64F11D18E08CE79734E535DC8721	56409FCCE2E54B4570CB4A69827D0000CC0530A67A41B911516A2D90C61F2F71
Chrome Cache Entry: 197	ASCII text, with very long lines (65448)	82A99203D8F176022C5C5894591C1978	A7F9F02E9C09A9E2CEF865CA57C24E86EEAB88B6	9471F5DC3C5BB27444DA82E4B80E056FB2F9AB4E020FDA0482C4070801E1BA51
Chrome Cache Entry: 198	ASCII text, with very long lines (28371)	1317A57B938133F1C22F70606779D939	129E47D1946C50AE3338EA3F5A73634FF9DF2347	FB67EF14210E956333D25A5586E120ECF3AAACF4CAF7C61E9699E82D6E5766E0
Chrome Cache Entry: 200	ASCII text, with very long lines (65449)	6AF741F5310E43427B2A14CA21A4250B	1EB292B49588E755BC2D8B0A32D137B7F2892AC8	37E8D2F7EF20885AD907BFC83FFDC21ED318BB0F05C3D64D146212B738B7A830
Chrome Cache Entry: 201	JSON data	0ED07B1FB00F2FFF56C8FF113CAA18C7	5A95A2018CF0004706E3C7E95DDC678DAD6F426E	9E4B24CBC3D4CAE2BF90AE2F48AE43C490CDA68D05373399808B2951A1EF5193
Chrome Cache Entry: 207	ASCII text, with very long lines (65536), with no line terminators	2C73DD9B48CB342C5FEB81C8A378B291	FA52BCA3CF57FFE2FBA82D3C923B1A3DE1E38E76	DA90AEA8421C31DDAB9FADDF17FC9D1F7EE9B466786C8113F0C523DB8CB3F00C
Chrome Cache Entry: 208	ASCII text, with very long lines (65443)	661EE6E67109C19C4F1231FA688B2B10	C4D4466C0A8D1F52DAE1D209A26F29D43A88AFC8	4B57DB57C5DBCC7B491ABA41E551E89F744E79CEEE79AA42AC6C22244C662487
Chrome Cache Entry: 209	ASCII text, with very long lines (24600)	3A048EA7BE88ABF0FEC5899DF72EA291	9E55AD7A3831A792FD826A40CE75845737D9097D	AE697CD440125DBC55C2C885FF02503330876535812CE1EF53918E5FE42D74D8
Chrome Cache Entry: 211	ASCII text, with very long lines (65448)	9F5EDE38B0D1D7FE0EE6E2A72BB52655	DD7C0784B957C8103AEEF4200A1B658EFFDE28C5	83F8ECFA94B75E542672E438B4CFA06B7A819F78CD130BDD700FD2269EE4C44E
Chrome Cache Entry: 213	Unicode text, UTF-8 text, with very long lines (61850), with LF, NEL line terminators	ED516E6BE9429849D1704B6C35A417EA	4C88BE47B062EDF1C2745B7355C057EB55388B02	A7CBAB07C5097E23745F62CA8B5914F1B93938258D670E23F2D18B5CCC3C323D
Chrome Cache Entry: 216	ASCII text, with very long lines (7965)	692906E147A4306A10623B24511EE10C	CE92C758DE9440D5195B04E2F71A57476F2EF444	F7B86D4053EF73B861F31139C0A3FC374CC14310E84261131FA0A34F4C92138E
Chrome Cache Entry: 217	ASCII text, with very long lines (27974)	F03BC80FE19576E53EE79979463F9024	3B2AE70F8ECC97DDA978AE7473146C83BE499262	955EC39E298442113983D14E7EBCB49C8C57F301E88A3DAA05705AD34556286B
Chrome Cache Entry: 219	Unicode text, UTF-8 text, with very long lines (65427)	CEEB59F1BBE389D85F0C979D844BF008	F80ECC9AD12577493D269217EBE8C78FC37DCDB8	BC7851B900A19E676C51C4BDE04639CC0B27E47C384370AB517C5BE72EA01DA5
Chrome Cache Entry: 223	ASCII text, with very long lines (32843)	30FE3DC6C28C79767CC85DFB34E487EB	3A11F5A934DCBD5B9475D7B2B750C7DF3FAE1E30	A8E02E733FAB3CEE73485F3C26CC6CDFB7C3DEE3C1FBDDFBEC38F59D375F06D3
Chrome Cache Entry: 226	ASCII text, with very long lines (16718)	7E0A5ABCB31199770B38DD9A0F557491	D4719F356E6800A6F664BCE7B3DDF7715607E5A3	0EE7DF63AA74F1623D01D69A016D845FD9024854A2F034D229ADE68D801DE4AA
Chrome Cache Entry: 227	ASCII text, with very long lines (65448)	388BD04B69B4A51F32438DCEFC4BA950	2628528AAB473325DFB08F0F8B27F8A9CC4A3C06	F7AAB38FBB9AA270C41CFAC7E8A9CF9DD8DF3FC830C702183000D1ABDF236A8A
Chrome Cache Entry: 229	Unicode text, UTF-8 text, with very long lines (65340)	0F2CD48BDA5FB302C59EEDA4A9E9FAF7	1E16F644C4C8A5AE131527814C7A9CA2E70A58C7	39F70165A1906138A5F5378223DA0C66933EC5FE1F70356D13D8E373C2686869
Chrome Cache Entry: 231	ASCII text, with very long lines (65448)	2F6738F90BAF8FD114F4E28D487E1CD9	2735F84AE90C6478933E994286AFAAA8963B2136	4606370BE9E4BBE2053A4CBD3FA3E206AD15781EA465F8C0C3484170B6996678
Chrome Cache Entry: 232	ASCII text, with very long lines (65447)	B996140AA55B4DCEFBE20B0EC96447B3	5C715DD38582604148904BADAF0342982195F698	54C6DB3FC48C1F54FAD197E91744DA04EB8FB584FBDB581A5C1E92CD6E72E12D
Chrome Cache Entry: 236	ASCII text, with very long lines (65447)	43A277E2F62386005C60540A68415F97	D69D78D6D10FF760F8068D87CE9C8ADB7A3E656E	B0F3FD10B52D4869B8ECBE459D12217E8BB8CF9E8B638546EFFBA3D377BF51ED
Chrome Cache Entry: 237	ASCII text, with very long lines (7063)	72BE693F43302A8D874D1632E088EA1F	9FF645EF334ED114EE6CE366FA4F4B9FBB0DF649	D2AE279844F8C0AEE147FA90ACE67575A6FEE5D56521BC553291646171FBF214
Chrome Cache Entry: 238	SVG Scalable Vector Graphics image	EC396047518A7FEF11D53D1B4F6BE65B	E3BEC4CDAF5567641517A23019ADBFA2328B0A7F	8F77CFC832517C619BC1B8D82A6A478EE18D97442B4C78B006B0286CEC91E1A8
Chrome Cache Entry: 242	ASCII text, with very long lines (19941)	6FB7E52A614B256C595653C357859C65	C37CC73DB881AF06249CC48EE699F99D0D07A952	6F74076F7C78230921B3E5D7591B7E410DE1102EE726DD5C8CCC72BC3028C6A3
Chrome Cache Entry: 244	Unicode text, UTF-8 text, with very long lines (65247)	38FE1AC6F7802BD4A7CB50998DD847EE	1F729EF646053FFB10097FED54FF61E7C5F437A9	D1453DD658E92F2F73254893295635E304D4365579B0B72A1D847ACA44BD692E
Chrome Cache Entry: 245	ASCII text, with very long lines (19861)	C02F42AD6A3725BF2856CB80B2A99A02	F42507B8E248CD804240CCFFA7E9787BAB14F2D1	68E6BB187BC0CAB3D9968CFBA124A68EF78289CDB2FC8194387AAACF7A730948
Chrome Cache Entry: 246	ASCII text, with very long lines (4755)	E88D2659A955F0E1BE25B1F310458621	072CCD61F941F37CDDE25954582AD9624F092E73	41A7957A1FAEDE768283CA6C2A8E262FDE64CC7E190E91372E8C064D09D8EA7A
Chrome Cache Entry: 248	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	AFE00DB89CE086B91A541C227EDBF136	961B2EE6FB39C4D515BDC49EC1BA688B0916F104	E11827C678AF8519E702F364E525AC34509CAD49F8D839677E089949EDDA060E
Chrome Cache Entry: 252	ASCII text, with very long lines (65448)	2CAA8D62C8FE6C1A1C79020F2009EA96	CE29AF377761577BB77BDA38681DB915259C9CA5	E108946EF76C3B64F68DAACA5A67045C3F7FF01B52F648680F66364BCC233501

Phishing

AI detected landing page (webpage, office document or email)

Source: Email	Joe Sandbox AI: Page contains button: 'REVIEW DOCUMENT' Source: 'Email'
Source: Email	Joe Sandbox AI: Email contains prominent button: 'review document'

AI detected potential phishing Email

Source: Email

Suspicious MSG / EML detected (based on various text indicators)

Source: MSG / EML

Source: unknown

HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49815 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 26MB

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212

Source: global traffic	DNS traffic detected: DNS query: na3.docusign.net
Source: global traffic	DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.docusign.com
Source: global traffic	DNS traffic detected: DNS query: api.mixpanel.com
Source: global traffic	DNS traffic detected: DNS query: cdn.optimizely.com

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49815 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.winEML@17/80@24/226

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241125T1857470348-6896.etl

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\FW Expiration Pending Support Care HIPAA Acknowledgement Form 2024.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7A878081-2B7C-49F8-B191-8B71F04F6AFC" "7D45DD20-BFB0-4C1B-8DE0-1C5790D14BFD" "6896" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7A878081-2B7C-49F8-B191-8B71F04F6AFC" "7D45DD20-BFB0-4C1B-8DE0-1C5790D14BFD" "6896" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na3.docusign.net/Signing/EmailStart.aspx?a=52a62e08-52ab-4deb-9961-052cba101116&etti=24&acct=07df84b5-c8f5-4e7f-a831-b605f464f6f9&er=4156e787-bddd-48bf-b932-5329c6a60a23
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1980,i,2667196118707451285,13180892797666329255,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na3.docusign.net/Signing/EmailStart.aspx?a=52a62e08-52ab-4deb-9961-052cba101116&etti=24&acct=07df84b5-c8f5-4e7f-a831-b605f464f6f9&er=4156e787-bddd-48bf-b932-5329c6a60a23
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1980,i,2667196118707451285,13180892797666329255,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{799ED9EA-FB5E-11D1-B7D6-00C04FC2AAE2}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Stores large binary data to the registry

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Queries the volume information (name, serial number etc) of a device

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

ID:	1562769
Product:	CloudBasic
Start time:	00:57:12
Start date:	26.11.2024
Sample:	FW Expiration Pending Support Care HIPAA Acknowledgement Form 2024.eml
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	63e3c96b5b6b003cbf76e93366dfc448
SHA1:	ec106a42c03b9d318cca209aa246c47f902641ac
SHA256:	d3a10154ed35ebb629c6d51680ce422a7e5c4e1fcf9b716bc1ef01e9219df745
Filetype:	E-Mail message (Var. 5) (54515/1) 100.00%

Windows Analysis Report
FW Expiration Pending Support Care HIPAA Acknowledgement Form 2024.eml

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report FW Expiration Pending Support Care HIPAA Acknowledgement Form 2024.eml

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
FW Expiration Pending Support Care HIPAA Acknowledgement Form 2024.eml