Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
I_ REF _ Due Debt 25_03_2024.msg

Overview

General Information

Sample name:I_ REF _ Due Debt 25_03_2024.msg
Analysis ID:1416904
MD5:80b191fd47252c162bce3113982eda0f
SHA1:1462bfa57fa0aa9f4f3f9ecf90fdfbcdf131ddb6
SHA256:5d37d4fab3e2a2d1bbaf540b04dad95695a8180f89fbcc81bff4df81921835b2
Infos:

Detection

HTMLPhisher
Score:80
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for domain / URL
Yara detected HtmlPhish10
Yara detected HtmlPhish38
Yara detected HtmlPhish44
Yara detected obfuscated html page
Detected hidden input values containing email addresses (often used in phishing pages)
HTML body contains low number of good links
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory
Tries to load missing DLLs

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6388 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\I_ REF _ Due Debt 25_03_2024.msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6420 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "0DD89F12-5673-4A82-AEA0-97E8DA1BCD06" "B5FCD9F8-2EEC-43AB-9C59-FA00705F164B" "6388" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 6928 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://cloudflare-ipfs.com/ipfs/bafybeib66t4ah2ibo6fdsaysddgmzuhfrkaoehx5crfpnarheqsjywdjnu#virginia.scremin@cuzziol.it MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 6712 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1952,i,619608486278428770,2198478658401269725,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
dropped/chromecache_76JoeSecurity_HtmlPhish_44Yara detected HtmlPhish_44Joe Security
    dropped/chromecache_76JoeSecurity_ObshtmlYara detected obfuscated html pageJoe Security

      HTML

      SourceRuleDescriptionAuthorStrings
      0.0.pages.csvJoeSecurity_HtmlPhish_38Yara detected HtmlPhish_38Joe Security
        0.0.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security

          Sigma Signatures

          Sigma detected: Office Autorun Keys Modification
          Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6388, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

          Snort Signatures

          ⊘No Snort rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Multi AV Scanner detection for domain / URL
          Source: cloudflare-ipfs.comVirustotal: Detection: 13%Perma Link

          Phishing

          barindex
          Yara detected HtmlPhish10
          Source: Yara matchFile source: 0.0.pages.csv, type: HTML
          Yara detected HtmlPhish38
          Source: Yara matchFile source: 0.0.pages.csv, type: HTML
          Yara detected HtmlPhish44
          Source: Yara matchFile source: dropped/chromecache_76, type: DROPPED
          Yara detected obfuscated html page
          Source: Yara matchFile source: dropped/chromecache_76, type: DROPPED
          Source: https://cloudflare-ipfs.com/ipfs/bafybeib66t4ah2ibo6fdsaysddgmzuhfrkaoehx5crfpnarheqsjywdjnu#virginia.scremin@cuzziol.itHTTP Parser: https://cloudflare-ipfs.com/ipfs/bafybeib66t4ah2ibo6fdsaysddgmzuhfrkaoehx5crfpnarheqsjywdjnu#virginia.scremin@cuzziol.it
          Source: https://cloudflare-ipfs.com/ipfs/bafybeib66t4ah2ibo6fdsaysddgmzuhfrkaoehx5crfpnarheqsjywdjnu#virginia.scremin@cuzziol.itHTTP Parser: Number of links: 0
          Source: https://cloudflare-ipfs.com/ipfs/bafybeib66t4ah2ibo6fdsaysddgmzuhfrkaoehx5crfpnarheqsjywdjnu#virginia.scremin@cuzziol.itHTTP Parser: <input type="password" .../> found
          Source: https://cloudflare-ipfs.com/ipfs/bafybeib66t4ah2ibo6fdsaysddgmzuhfrkaoehx5crfpnarheqsjywdjnu#virginia.scremin@cuzziol.itHTTP Parser: No <meta name="author".. found
          Source: https://cloudflare-ipfs.com/ipfs/bafybeib66t4ah2ibo6fdsaysddgmzuhfrkaoehx5crfpnarheqsjywdjnu#virginia.scremin@cuzziol.itHTTP Parser: No <meta name="copyright".. found
          Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49735 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49738 version: TLS 1.2
          Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
          Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
          Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
          Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
          Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
          Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
          Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
          Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
          Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
          Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
          Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
          Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
          Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
          Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
          Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
          Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
          Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
          Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
          Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
          Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
          Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
          Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
          Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
          Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
          Source: unknownTCP traffic detected without corresponding DNS query: 40.127.169.103
          Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
          Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
          Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
          Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
          Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
          Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownDNS traffic detected: queries for: cloudflare-ipfs.com
          Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
          Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
          Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49688 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
          Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
          Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
          Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49735 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49738 version: TLS 1.2
          Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
          Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
          Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
          Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
          Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
          Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
          Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
          Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
          Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
          Source: classification engineClassification label: mal80.phis.winMSG@17/32@24/242
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240328T0926310089-6388.etl
          Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\I_ REF _ Due Debt 25_03_2024.msg"
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "0DD89F12-5673-4A82-AEA0-97E8DA1BCD06" "B5FCD9F8-2EEC-43AB-9C59-FA00705F164B" "6388" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://cloudflare-ipfs.com/ipfs/bafybeib66t4ah2ibo6fdsaysddgmzuhfrkaoehx5crfpnarheqsjywdjnu#virginia.scremin@cuzziol.it
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1952,i,619608486278428770,2198478658401269725,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "0DD89F12-5673-4A82-AEA0-97E8DA1BCD06" "B5FCD9F8-2EEC-43AB-9C59-FA00705F164B" "6388" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://cloudflare-ipfs.com/ipfs/bafybeib66t4ah2ibo6fdsaysddgmzuhfrkaoehx5crfpnarheqsjywdjnu#virginia.scremin@cuzziol.it
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1952,i,619608486278428770,2198478658401269725,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
          Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
          Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
          DLL Side-Loading          		1
          Process Injection          		1
          Masquerading          		OS Credential Dumping1
          Process Discovery          		Remote ServicesData from Local System2
          Encrypted Channel          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/Job1
          Registry Run Keys / Startup Folder          		1
          DLL Side-Loading          		1
          Process Injection          		LSASS Memory13
          System Information Discovery          		Remote Desktop ProtocolData from Removable Media1
          Non-Application Layer Protocol          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
          Registry Run Keys / Startup Folder          		1
          DLL Side-Loading          		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
          Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          ⊘No Antivirus matches

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          SourceDetectionScannerLabelLink
          cloudflare-ipfs.com14%VirustotalBrowse
          image.thum.io0%VirustotalBrowse

          URLs

          ⊘No Antivirus matches

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          d26p066pn2w0s0.cloudfront.net
          		52.85.151.109
          		truefalse
            		high
            code.jquery.com
            		151.101.66.137
            		truefalse
              		high
              cloudflare-ipfs.com
              		104.17.64.14
              		truetrueunknown
              www.google.com
              		172.253.115.147
              		truefalse
                		high
                image.thum.io
                		18.235.6.110
                		truefalseunknown
                res.cloudinary.com
                		unknown
                		unknownfalse
                  		high
                  ka-f.fontawesome.com
                  		unknown
                  		unknownfalse
                    		high
                    kit.fontawesome.com
                    		unknown
                    		unknownfalse
                      		high
                      docucdn-a.akamaihd.net
                      		unknown
                      		unknownfalse
                        		high
                        logo.clearbit.com
                        		unknown
                        		unknownfalse
                          		high

                          Contacted URLs

                          NameMaliciousAntivirus DetectionReputation
                          https://cloudflare-ipfs.com/ipfs/bafybeib66t4ah2ibo6fdsaysddgmzuhfrkaoehx5crfpnarheqsjywdjnu#virginia.scremin@cuzziol.itfalse
                            		unknown

                            World Map of Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public IPs

                            IPDomainCountryFlagASNASN NameMalicious
                            23.199.63.178
                            		unknownUnited States
                            		20940AKAMAI-ASN1EUfalse
                            142.251.167.101
                            		unknownUnited States
                            		15169GOOGLEUSfalse
                            104.18.40.68
                            		unknownUnited States
                            		13335CLOUDFLARENETUSfalse
                            172.253.62.95
                            		unknownUnited States
                            		15169GOOGLEUSfalse
                            172.253.115.147
                            		www.google.comUnited States
                            		15169GOOGLEUSfalse
                            172.253.115.101
                            		unknownUnited States
                            		15169GOOGLEUSfalse
                            151.101.66.137
                            		code.jquery.comUnited States
                            		54113FASTLYUSfalse
                            18.235.6.110
                            		image.thum.ioUnited States
                            		14618AMAZON-AESUSfalse
                            104.17.64.14
                            		cloudflare-ipfs.comUnited States
                            		13335CLOUDFLARENETUStrue
                            142.251.163.94
                            		unknownUnited States
                            		15169GOOGLEUSfalse
                            104.21.26.223
                            		unknownUnited States
                            		13335CLOUDFLARENETUSfalse
                            52.113.194.132
                            		unknownUnited States
                            		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                            1.1.1.1
                            		unknownAustralia
                            		13335CLOUDFLARENETUSfalse
                            3.162.174.126
                            		unknownUnited States
                            		16509AMAZON-02USfalse
                            142.251.111.95
                            		unknownUnited States
                            		15169GOOGLEUSfalse
                            172.253.63.94
                            		unknownUnited States
                            		15169GOOGLEUSfalse
                            23.205.104.21
                            		unknownUnited States
                            		16625AKAMAI-ASUSfalse
                            52.111.230.27
                            		unknownUnited States
                            		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                            20.50.80.214
                            		unknownUnited States
                            		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                            239.255.255.250
                            		unknownReserved
                            		unknownunknownfalse
                            23.221.242.90
                            		unknownUnited States
                            		8612TISCALI-ITfalse
                            104.19.166.65
                            		unknownUnited States
                            		13335CLOUDFLARENETUSfalse
                            52.85.151.109
                            		d26p066pn2w0s0.cloudfront.netUnited States
                            		16509AMAZON-02USfalse
                            142.251.163.84
                            		unknownUnited States
                            		15169GOOGLEUSfalse

                            Private

                            IP
                            192.168.2.16

                            General Information

                            Joe Sandbox version:40.0.0 Tourmaline
                            Analysis ID:1416904
                            Start date and time:2024-03-28 09:25:56 +01:00
                            Joe Sandbox product:CloudBasic
                            Overall analysis duration:
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:defaultwindowsinteractivecookbook.jbs
                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                            Number of analysed new started processes analysed:15
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • EGA enabled
                            Analysis Mode:stream
                            Analysis stop reason:Timeout
                            Sample name:I_ REF _ Due Debt 25_03_2024.msg
                            Detection:MAL
                            Classification:mal80.phis.winMSG@17/32@24/242
                            Cookbook Comments:
                            • Found application associated with file extension: .msg

                            Warnings

                            • Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
                            • Excluded IPs from analysis (whitelisted): 52.113.194.132, 23.221.242.90, 52.111.230.27, 52.111.230.24, 52.111.230.26, 52.111.230.25, 172.253.63.94, 172.253.115.101, 172.253.115.138, 172.253.115.139, 172.253.115.102, 172.253.115.100, 172.253.115.113, 142.251.163.84, 34.104.35.123, 172.253.62.95, 142.251.111.95, 104.18.40.68, 172.64.147.188, 104.19.166.65, 104.19.167.65, 104.21.26.223, 172.67.139.119, 20.50.80.214, 172.253.122.95, 142.251.167.95, 142.250.31.95, 142.251.16.95, 172.253.63.95, 172.253.115.95, 142.251.163.95, 23.199.63.178, 23.199.63.147, 23.205.104.21, 23.205.104.59
                            • Excluded domains from analysis (whitelisted): ka-f.fontawesome.com.cdn.cloudflare.net, slscr.update.microsoft.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, prod-eus-resolver.naturallanguageeditorservice.osi.office.net.akadns.net, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, a1737.b.akamai.net, clients2.google.com, e16604.g.akamaiedge.net, onedscolprdneu11.northeurope.cloudapp.azure.com, prod.fs.microsoft.com.akadns.net, kit.fontawesome.com.cdn.cloudflare.net, ecs.office.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, ajax.googleapis.com, fonts.gstatic.com, prod-na.naturallanguageeditorservice.osi.office.net.akadns.net, s-0005-office.config.skype.com, docucdn-a.akamaihd.net.edgesuite.net, fe3cr.delivery.mp.microsoft.com, prod1.naturallanguageeditorservice.osi.office.net.akadns.net, nleditor.osi.office.net, edgedl.me.gvt1.com, s-0005.s-msedge.net, res
                            • Not all processes where analyzed, report is missing behavior information
                            • Report size getting too big, too many NtQueryAttributesFile calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.

                            Created / dropped Files

                            C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):231348
                            Entropy (8bit):4.393014889914205
                            Encrypted:false
                            SSDEEP:
                            MD5:B2AA2B1BB0FAA692670405CC375A110C
                            SHA1:67128732946B9F00730609F73C4858456DFA9F47
                            SHA-256:BCAED15B54ADD40AFC2DD383D14D8C775FC36786D8183F5A51302B051D1864A2
                            SHA-512:5230A2CA83680D59260623FAE69EE2AE035DA255DE25FC68BDF1E2CD001DBA9E6CBA4464E3E330B6EF3EF0CF44FAD73B31ED0460DE9AEE160FF137455EAB6AF7
                            Malicious:false
                            Reputation:unknown
                            Preview:TH02...... .0..........SM01X...,...P..............IPM.Activity...........h...............h............H..h..o............h.........n..H..h\cal ...pDat...h...0...P.o....h.6V............h........_`.j...hH7V.@...I.lw...h....H...8..j...0....T...............d.........2h...............k..............!h.............. h..w.....h.o...#h....8.........$h.n......8....."h.c.......d....'h..............1h.6V.<.........0h....4....j../h....h......jH..h.?..p.....o...-h .........o...+h.6V......o......... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                            C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                            File Type:XML 1.0 document, ASCII text, with very long lines (2159), with no line terminators
                            Category:dropped
                            Size (bytes):2159
                            Entropy (8bit):5.103614835244707
                            Encrypted:false
                            SSDEEP:
                            MD5:C9A3371EF98F53E56E4EC4A7B01C9A4C
                            SHA1:882E7C8F4DA1E1A3146875BE4B874010A2FD4BD0
                            SHA-256:20AFDD0B311E4C106B55BD05B3884C2E3C7D6138D9326669043B6516C0116CDA
                            SHA-512:57A484ADBBA2DDAB2FB4EC9B44388FD83085FA9E827539F3FEEF991DF61524046ABCCC7BC5AE0679A0E3DE41B49E4CB306142704449225A86FC1959BB654FF3D
                            Malicious:false
                            Reputation:unknown
                            Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>14</Count><Resource><Id>Aptos_26215680</Id><LAT>2023-10-06T09:25:29Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-06T09:25:29Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:25:29Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:25:29Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_

                            C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Open Sans\21798841561.ttf

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                            File Type:TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 26 names, Macintosh, Digitized data copyright \251 2010-2011, Google Corporation.Open SansRegular1.10;1ASC;OpenSans-R
                            Category:dropped
                            Size (bytes):217276
                            Entropy (8bit):6.419567239266024
                            Encrypted:false
                            SSDEEP:
                            MD5:D7D5D4588A9F50C99264BC12E4892A7C
                            SHA1:513966E260BB7610D47B2329DBA194143831893E
                            SHA-256:13C03E22A633919BEB2847C58C8285FB8A735EE97097D7C48FD403F8294B05F8
                            SHA-512:CE9F98208CD818E486A12848B2D64BD14E12D42D84B2E47436A3C4420A242583EEFC4A9B42401B51CC204146C6133645975682E4BB5D48527B3796770EFA3397
                            Malicious:false
                            Reputation:unknown
                            Preview:...........0DSIG..D...;H...tGDEF.&....7(....GPOS.7.7..7H...8GSUB.+=...7.....OS/2.6.........`cmap............cvt .M..........fpgm~a.....<....gasp...#..7.....glyft8.K..$.../.head..cp...<...6hhea...s...t...$hmtx.5<.........kernT+.~..T....6loca)..........Vmaxp.C......... nameH.B.........post.C.l......&+prepC...................Ww.(_.<..........51......+.........b...........................{...............................V......./.\.......................3.......3.....f..................@. [...(....1ASC.@. ...........X ........H..... ...................#...5...+.3.......h...q.....^.R.^.=.j.V...h...?...T.!.........f.......d...^...+.......u...^...h...j.!...!.?...h...w...h.o...1.y...../.....}.....s...!.....}.......T.#.`.....'...9.......;.}.....;.}.....d.j.m...........h.......{.....R...........3.V.1.........s.^.......s...s.}.s.....b.'.............3.......q.........s.......s.D.....j.............9...1.'.......R...=.h.....H...h.....#.........?...{.....h...!.{...5...d...F...R...h...T...d.....m.....h

                            C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Open Sans\23165521968.ttf

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                            File Type:TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 26 names, Macintosh, Digitized data copyright \251 2010-2011, Google Corporation.Open SansBold1.10;1ASC;OpenSans-Bold
                            Category:dropped
                            Size (bytes):224452
                            Entropy (8bit):6.418018034788758
                            Encrypted:false
                            SSDEEP:
                            MD5:F5331CB6372B6C0D8BAF2DD7E200498C
                            SHA1:8387D4F8E061C264DC3AEBEBE6068B66E45D7C6F
                            SHA-256:1B43DE2449D39B65FF6F63315D4AFDA585F72FBBEC2E3D9A56F59DE6C75149D3
                            SHA-512:B534A27EE82942784155E087FF2A546AB6EAA7A6CDD1C449687B97DCEE2028D3ABF6F9B0A7459667797DFAEDA30C0342C01DB0F2826F7E80B6B9CCDC9902166A
                            Malicious:false
                            Reputation:unknown
                            Preview:...........0DSIG..t:..WP...tGDEF.&....S0....GPOS.7.7..SP...8GSUB.+=...S.....OS/2.m.........`cmap............cvt .-..........fpgm.s.u...<....gasp......S$....glyf......%...K.head.%I....<...6hhea.).R...t...$hmtx$...........kernT+.~..p....6loca..`+.......Vmaxp.5......... nameo)8...'.....post.C.l..,...&+prep...k.................4S_.<..........B.......+.....................................y...............................X......./.\.......................3.......3.....f..................@. [...(....1ASC. . ...........X ........^..... ...................J.u.....+.-...X.5.?...R.!.....R...=.\.?...X.R.?...=.H.u.N.....J...y...N...N...#...d...H...7...H...B.H.u.R.?...X...X...X.....-.f.....`.....w.....{...d.....w.......B...h.P...............^.w.....^.w.H...h.^...).....3.......V.........1.....N.....3.B...J.....L...V.......\...\...\...).....B...q...q.}.....q.......B.....\.......\.......\.y./.B.....................7.'...h...'.R...X.....J.u.......R...q.....h.....j.......d.../...R...X...=...d.....m.\...X

                            C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):32768
                            Entropy (8bit):0.045545108988456734
                            Encrypted:false
                            SSDEEP:
                            MD5:40F3E30211B41DD74230BAB88A557893
                            SHA1:8DDE4906F6E96A49603ACB3705319EEE73236B68
                            SHA-256:D6700A380306923DD01FDF9B3C077ACB7DE05621410348E8DE2FD1ED7F39CBA6
                            SHA-512:97223E7E96C15913CE13671176426519195BAB4A1D5658B7E42253B0597996C981865170839B70E67C3AF56D8FDFC7CD05A7B81460FE0DD6557EE80CAEC3D23A
                            Malicious:false
                            Reputation:unknown
                            Preview:..-......................gG]@...H=..f..U.' ..%....-......................gG]@...H=..f..U.' ..%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                            File Type:SQLite Write-Ahead Log, version 3007000
                            Category:modified
                            Size (bytes):49472
                            Entropy (8bit):0.48375657192836174
                            Encrypted:false
                            SSDEEP:
                            MD5:0EF34E5FA933D1EED79FB35A98E71D66
                            SHA1:C166397B59566EB72868EBC3134E36AB54A59138
                            SHA-256:E17FEE27FAC59F128CEB0C018A98D369E828B31FBC81C2D367B7D9D5174FD44E
                            SHA-512:F263F2B016FFE0B2D5935919BE2773EA203BF62940E0CBD552E72FE8D4268D69A8EA9FA0870FAEB7A3657BF879595E9B8F0CD199C10F97920EB19563EC701363
                            Malicious:false
                            Reputation:unknown
                            Preview:7....-..........H=..f..U..@[...f........H=..f..U.....(.TSQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{387B8817-A3FD-4B84-80D3-6DA5664AFB5D}.tmp

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                            File Type:data
                            Category:modified
                            Size (bytes):3444
                            Entropy (8bit):3.106299924948432
                            Encrypted:false
                            SSDEEP:
                            MD5:CFB11C6ADBA683F02CCA8D3B3045D175
                            SHA1:934981BCDBE565BB02910AAF4EA82644C86EC7AF
                            SHA-256:5E0CABF7E2EC218D71D683659537088FC0555F3A96D0BF3D68F82BD99D630B7C
                            SHA-512:96BC4C6526CBDAB35CDDD3D411E8B70CB427A5668A6273C30AAADE58DB869AE0951E5AD506A2DD4BED4548885C9855002FB451A7A764A8E87C5C6E5A9BD1285A
                            Malicious:false
                            Reputation:unknown
                            Preview:....D.o.v.r.e.m.m.e. .i.n.v.i.a.r.m.i. .u.n.a. .p.r.e.s.e.n.t.a.z.i.o.n.e.,. .m.a. .n.o.n. .c.a.p.i.s.c.o. .s.e. .q.u.e.s.t.a. .m.a.i.l. ... .s.p.a.m...D.a.:. .D.a.v.i.d. .<.n.w.b.i.l.i.t.y.@.n.e.w.a.b.i.l.i.t.i.e.s.o.t...c.o.m.>. ...I.n.v.i.a.t.o.:. .m.e.r.c.o.l.e.d... .2.7. .m.a.r.z.o. .2.0.2.4. .2.2.:.5.3...A.:. .v.i.r.g.i.n.i.a. .s.c.r.e.m.i.n. .<.v.i.r.g.i.n.i.a...s.c.r.e.m.i.n.@.c.u.z.z.i.o.l...i.t.>...O.g.g.e.t.t.o.:. ...................................................................................................4...6...N........................................................................................................................................................................................................................................................................................................................................................................................................................................................................dJ.....

                            C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1711614391302179800_6F4D5E05-DECE-4841-9FB6-7264F598FE86.log

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                            File Type:ASCII text, with very long lines (28773), with CRLF line terminators
                            Category:dropped
                            Size (bytes):20971520
                            Entropy (8bit):0.16527085425117027
                            Encrypted:false
                            SSDEEP:
                            MD5:8ABF71B6CF539259939899DCA5B017D2
                            SHA1:F7B0E441BE00CC696C63D1047B5D087787702AF7
                            SHA-256:BF758C6371A80E952BEA1080FE4A8D48AA90925020302CB2DCDE15D3E9FFD431
                            SHA-512:8AC40187F8CD53C3C8CAD20201D95CE7BA9C9F4310163B7A9924708D3A286D0200441D31084DE98069C16C130364DEA9AD645C364FDA99E2616B3D241A18F767
                            Malicious:false
                            Reputation:unknown
                            Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..03/28/2024 08:26:31.328.OUTLOOK (0x18F4).0x18FC.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":26,"Time":"2024-03-28T08:26:31.328Z","Contract":"Office.System.Activity","Activity.CV":"BV5Nb87eQUiftnJk9Zj+hg.4.11","Activity.Duration":18,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...03/28/2024 08:26:31.344.OUTLOOK (0x18F4).0x18FC.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":28,"Time":"2024-03-28T08:26:31.344Z","Contract":"Office.System.Activity","Activity.CV":"BV5Nb87eQUiftnJk9Zj+hg.4.12","Activity.Duration":10837,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajor

                            C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1711614391303030400_6F4D5E05-DECE-4841-9FB6-7264F598FE86.log

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):20971520
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:
                            MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                            SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                            SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                            SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                            Malicious:false
                            Reputation:unknown
                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240328T0926310089-6388.etl

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                            File Type:data
                            Category:modified
                            Size (bytes):94208
                            Entropy (8bit):4.493814748176206
                            Encrypted:false
                            SSDEEP:
                            MD5:822A46492E2CE86C404633B6BF0E47D5
                            SHA1:39E9020DFE360FA26563F1CC45BE5F5BF77F7718
                            SHA-256:37850A8E715D5C91D7E91FE8FBDBE39C0481EE0928A78D17D4F99030811FA544
                            SHA-512:E7F6E6A6D79F48A21B8CC9A8358A1647DB715D7651C57CCE7D893B3D3D6E1C9E824BD7AFF1D8293E3570392243850BBE81C8B46C6460BF50C37E7CC0DFF71C97
                            Malicious:false
                            Reputation:unknown
                            Preview:............................................................................`............G.....................eJ..............Zb..2.......................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1............................................................\...Y...........G.............v.2._.O.U.T.L.O.O.K.:.1.8.f.4.:.8.4.2.b.4.5.d.b.8.1.2.c.4.2.2.2.a.3.b.8.d.6.2.7.5.8.0.7.b.4.6.1...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.0.3.2.8.T.0.9.2.6.3.1.0.0.8.9.-.6.3.8.8...e.t.l.......P.P..........G.............................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\~DF94911B7E2FB76FFB.TMP

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):163840
                            Entropy (8bit):0.36758715496571454
                            Encrypted:false
                            SSDEEP:
                            MD5:97BC505F7C5FDE78C6CDF56EEE3285A4
                            SHA1:892CC37363FC84220C9BED3AB9375E85B773FDC3
                            SHA-256:AA705E9D80EAF4748DF782A06D27FE27B33E9A6020D7C5687BC4E5BEDC6954B2
                            SHA-512:6DDE6C6AE69D242561DCBE6A7C269C9CFEB28CB48F75264C805716DD586A120167601BEBC47F652B6B39942B653DE4C016BD66B1C908C3601582A796B14B7EAD
                            Malicious:false
                            Reputation:unknown
                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):30
                            Entropy (8bit):1.2389205950315936
                            Encrypted:false
                            SSDEEP:
                            MD5:20410592BD3C4E6C4DC7349942B6AF84
                            SHA1:8A831CFE57E97D14F2C48806BEE4274D20793703
                            SHA-256:6D9DBBFE669D7DC3E0D4535447219C1E8E2EFD08F924E121549F74BDBBC78370
                            SHA-512:5BC247C4329BCC758609D14CE5A2A01BF559945461703695D0993DB89BD98FEA1E79F69002BCAADCEE7C03DF6A728EF3F8C3C3B85574E617E2A4F57AED6B03A5
                            Malicious:false
                            Reputation:unknown
                            Preview:..............................

                            C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):14
                            Entropy (8bit):2.699513850319966
                            Encrypted:false
                            SSDEEP:
                            MD5:C5A12EA2F9C2D2A79155C1BC161C350C
                            SHA1:75004B4B6C6C4EE37BE7C3FD7EE4AF4A531A1B1A
                            SHA-256:61EC0DAA23CBC92167446DADEFB919D86E592A31EBBD0AB56E64148EBF82152D
                            SHA-512:B3D5AF7C4A9CB09D27F0522671503654D06891740C36D3089BB5CB21E46AB235B0FA3DC2585A383B9F89F5C6DAE78F49F72B0AD58E6862DE39F440C4D6FF460B
                            Malicious:false
                            Reputation:unknown
                            Preview:..c.a.l.i.....

                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 07:26:40 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                            Category:dropped
                            Size (bytes):2673
                            Entropy (8bit):3.982667999369477
                            Encrypted:false
                            SSDEEP:
                            MD5:FCFB576F6879EEA0FDABAC56E361D715
                            SHA1:51566B919554D32F28CAA1D0EA021C8F065119A2
                            SHA-256:0536AAF948F635DDB568A9B040B678EAF33433BF8BDCC09F938C68F5903C9062
                            SHA-512:660B8C0CFE9B018659C7F5A6AB39B00B1A18A8E17FAAB3CA2707B930C377D2FE273A9ED9CDD091572E53CC088253FB63CEC24CCCE386C1A164C8756E759FF3C5
                            Malicious:false
                            Reputation:unknown
                            Preview:L..................F.@.. ...$+.,....O......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I|XHC....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V|XSC....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V|XSC....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V|XSC..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V|XUC...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 07:26:40 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                            Category:dropped
                            Size (bytes):2675
                            Entropy (8bit):3.997183333257457
                            Encrypted:false
                            SSDEEP:
                            MD5:EBFFE4CC56B233A43F1D87E3D2176F34
                            SHA1:9460C2E4B49A24C803835C7BFF5898A3AFCABBB8
                            SHA-256:1866CF7A9682E548FB9326FE67777C48BC734F1BED6BF34746B21D2C82C89F91
                            SHA-512:BC1AEEE14D8B67DA6B99412E63ED090932F34A8359300340C6B72069EFCF4ADA6FD65DDC187DE10CD953A7BF6408E6FFA5E51A7F9185BE2FA9E7570EA0DA3EBF
                            Malicious:false
                            Reputation:unknown
                            Preview:L..................F.@.. ...$+.,.....c.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I|XHC....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V|XSC....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V|XSC....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V|XSC..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V|XUC...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                            Category:dropped
                            Size (bytes):2689
                            Entropy (8bit):4.005900887875529
                            Encrypted:false
                            SSDEEP:
                            MD5:120CD612C6DAFE5D12DA282A4F62D010
                            SHA1:AF6D269B795BA68BB48FDFC1D9D6C117116FD27E
                            SHA-256:29BB62DD658D3BBEC4C8DFED030478548F7831D68855E53EB8156882838E7A27
                            SHA-512:7665B4DE69AC60FA357EE39C73C22D369EF43B5CB985132B815C9224CEF90E4F40F79D8DC509C2DF1EB0E39FBDEF2BBAAA713F4796E72B6CAB1363DE87E60EFB
                            Malicious:false
                            Reputation:unknown
                            Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I|XHC....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V|XSC....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V|XSC....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V|XSC..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 07:26:40 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                            Category:dropped
                            Size (bytes):2677
                            Entropy (8bit):3.996077592879409
                            Encrypted:false
                            SSDEEP:
                            MD5:2E830106BBF6B37146D8CD6B6075AB03
                            SHA1:1437AD273853FD62E2B775FC523BA81808D87BD7
                            SHA-256:89BEE59F5B779241DB1C357DB70A145057688FE2AFA2F26665663D3805BE9313
                            SHA-512:66EADD06D909F9B33D5CF6264C38F6A6FBEB549213886EFFF2CE8EE22033DCD3EFD5F8F4BB525FCA95E1A36BC2309DA8B775CBC309FEB1BB935B0BAB27E2E10D
                            Malicious:false
                            Reputation:unknown
                            Preview:L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I|XHC....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V|XSC....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V|XSC....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V|XSC..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V|XUC...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 07:26:40 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                            Category:dropped
                            Size (bytes):2677
                            Entropy (8bit):3.984651488246571
                            Encrypted:false
                            SSDEEP:
                            MD5:5754EDF371ABD89451CF97C726B1B5ED
                            SHA1:FFD34AE1E0EA5DB239C368807C03B266E0BBBCA5
                            SHA-256:4C61503EA33B7E37D57FB17105BF6D01D498E2D5B113C18DCABA5BA52675CF09
                            SHA-512:9D0B31F08D3CF6DEFE8B283580F3A6049E535E70963FFC6E9720B12F7CE443ADF40C26CB10459BDC8DF98F1F43C1AC202C2DDA46C01666481B572C5D2BF0E14C
                            Malicious:false
                            Reputation:unknown
                            Preview:L..................F.@.. ...$+.,....h......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I|XHC....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V|XSC....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V|XSC....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V|XSC..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V|XUC...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 07:26:40 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                            Category:dropped
                            Size (bytes):2679
                            Entropy (8bit):3.996983950932546
                            Encrypted:false
                            SSDEEP:
                            MD5:C17A05CB7492ABAD6EE5EDEC7CC9B8FD
                            SHA1:DF265376E6C885F37EF0BAC225C3CA25CA9BCD08
                            SHA-256:40CFA4B4BC307EA4AA33925C6A38C003F97A477C202CF305F0B7E88CB85E80EF
                            SHA-512:E38CA196136453F1526053873CAC485C646E9BDCCD3C3F2AA5AF1025DC434096FC75B2D9014CE14B35F309FD628BC1A5D71888901092E9F787D6443891E842B0
                            Malicious:false
                            Reputation:unknown
                            Preview:L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I|XHC....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V|XSC....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V|XSC....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V|XSC..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V|XUC...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                            C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                            File Type:Microsoft Outlook email folder (>=2003)
                            Category:dropped
                            Size (bytes):271360
                            Entropy (8bit):1.1816032104466392
                            Encrypted:false
                            SSDEEP:
                            MD5:D09ABE1B8B3B669F59FE7388281428EB
                            SHA1:B49790D0F00EE55EECA099374E8D510B4C80F035
                            SHA-256:443AE345A5E9A53A3BBC4F32DBE21AF24EB5DC1A8E3C6114145E0AEE5A0DE55D
                            SHA-512:6656B503527159B644C83EE559A69B6B74795AD90B23DE89F9C73FED34E4BB4B49FEA8979DB614C194181DA7D5CAEF24DC040A3C11CECF346AD453AD69E33A3F
                            Malicious:false
                            Reputation:unknown
                            Preview:!BDN.L..SM......\.......................U................@...........@...@...................................@...........................................................................$.......D.......O.......................................p..................................................................................................................................................................................................................................................................................<.......y..)h.,.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):131072
                            Entropy (8bit):1.8317407855872272
                            Encrypted:false
                            SSDEEP:
                            MD5:AFAFDA2AB2CC1C2D40EB1B6B015EB995
                            SHA1:6B7340546AE039595F63166F288A411CFCAB3B8D
                            SHA-256:C3E45D359187A9B5AAB6193D99CE26369C35E89EC2B4946A33CE6ECFB6D28CE5
                            SHA-512:F89B3576753818C7D4F7CD5EA4A85667C08245BA4683112A83AA00ECD4DDD73A9045F2D95BA711A81D7C3CA4A83CA50DC203A63A4CDA1CC9BD5E44747C44853A
                            Malicious:false
                            Reputation:unknown
                            Preview:GK..0...G...........H..........D............#..............................................................~..............?..........................................................................................................................................................................................................................................................................................................................................................................................................................................l.D.......>:.0...H...........H..........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                            Chrome Cache Entry: 74

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:ASCII text, with no line terminators
                            Category:downloaded
                            Size (bytes):40
                            Entropy (8bit):4.312814895472355
                            Encrypted:false
                            SSDEEP:
                            MD5:6174803E1290675A9EBFD3DA42D37A89
                            SHA1:E12A36AD60D831226939F5CA33ECCEBBA110C52B
                            SHA-256:FBF3FE58E108DB11A399E78D745AD50104F3081DFE78EC6EC1D50BD63F305F88
                            SHA-512:04BA80309103A13A47E58AE1D00907EBF446C286F9F3D1EC85B1FAFC739564D760D96896CD34FFE7B3238428BB220C0FAB6723B19E7681A4109DA51752D140A2
                            Malicious:false
                            Reputation:unknown
                            URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwlo9VTyFMrvZRIFDVNVgbUSBQ3OQUx6?alt=proto
                            Preview:ChoKCw1TVYG1GgQIVhgCCgsNzkFMehoECEsYAg==

                            Chrome Cache Entry: 75

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:ASCII text
                            Category:downloaded
                            Size (bytes):1293
                            Entropy (8bit):5.448893852817212
                            Encrypted:false
                            SSDEEP:
                            MD5:CBA4ED6C809962AC6C2A26842183B67A
                            SHA1:3F8E077AFC8EF5BAB7FA626EA782DAE34D419BBE
                            SHA-256:AAE65C231008861C6430EBE296C926E728C4D2CCB1492F86E42D760E9B67D9A5
                            SHA-512:84894B90DDA3CA3487F3E4F87F8244C78BA726331AC3EA290F6BD64830B0A21856A42333CC4EDBBF23DC2F063C53AD71B3F41864275D874AEBD37C198AE1CBE0
                            Malicious:false
                            Reputation:unknown
                            URL:https://fonts.googleapis.com/css?family=Archivo+Narrow&display=swap
                            Preview:/* vietnamese */.@font-face {. font-family: 'Archivo Narrow';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/archivonarrow/v30/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6rHmsJCQ.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;.}./* latin-ext */.@font-face {. font-family: 'Archivo Narrow';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/archivonarrow/v30/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6rXmsJCQ.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./* latin */.@font-face {. font-family: 'Archivo Narrow';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com

                            Chrome Cache Entry: 76

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:HTML document, ASCII text, with very long lines (65440), with CRLF line terminators
                            Category:downloaded
                            Size (bytes):400111
                            Entropy (8bit):3.242342873766696
                            Encrypted:false
                            SSDEEP:
                            MD5:F8EECC7186958C51891D0C7EEF8CC610
                            SHA1:E2E1569C4F787229C2DAFF95E1E145D599730E1F
                            SHA-256:FF809F7E32749BEFC3DA07038612A84E31E6FC33C027ED529B8F721D23C53477
                            SHA-512:56FB640CDCE05DA25766225AF37249AA32817FA6CAD776F14E278976708DE77BD1C3355E75B327BCF6E7B6E1E106DDECCE6A06F2012BFD142587164EE2C39A2F
                            Malicious:false
                            Reputation:unknown
                            URL:https://cloudflare-ipfs.com/ipfs/bafybeib66t4ah2ibo6fdsaysddgmzuhfrkaoehx5crfpnarheqsjywdjnu
                            Preview:<script type="text/javascript">.. HTML Encryption provided by www.webtoolhub.com -->.. ..document.write(unescape('%3c%21%64%6f%63%74%79%70%65%20%68%74%6d%6c%3e%0d%0a%3c%68%74%6d%6c%20%6c%61%6e%67%3d%22%65%6e%22%3e%0d%0a%3c%68%65%61%64%3e%0d%0a%20%20%3c%73%63%72%69%70%74%20%73%72%63%3d%22%68%74%74%70%73%3a%2f%2f%61%6a%61%78%2e%67%6f%6f%67%6c%65%61%70%69%73%2e%63%6f%6d%2f%61%6a%61%78%2f%6c%69%62%73%2f%6a%71%75%65%72%79%2f%32%2e%32%2e%34%2f%6a%71%75%65%72%79%2e%6d%69%6e%2e%6a%73%22%3e%3c%2f%73%63%72%69%70%74%3e%0d%0a%20%20%3c%73%63%72%69%70%74%20%73%72%63%3d%22%68%74%74%70%73%3a%2f%2f%63%6f%64%65%2e%6a%71%75%65%72%79%2e%63%6f%6d%2f%6a%71%75%65%72%79%2d%33%2e%31%2e%31%2e%6d%69%6e%2e%6a%73%22%3e%0d%0a%20%20%3c%73%63%72%69%70%74%20%73%72%63%3d%22%68%74%74%70%73%3a%2f%2f%63%6f%64%65%2e%6a%71%75%65%72%79%2e%63%6f%6d%2f%6a%71%75%65%72%79%2d%33%2e%33%2e%31%2e%6a%73%22%20%69%6e%74%65%67%72%69%74%79%3d%22%73%68%61%32%35%36%2d%32%4b%6f%6b%37%4d%62%4f%79%78%70%67%55%56%76%41%6b%2f%48%4a%32%6a

                            Chrome Cache Entry: 77

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:ASCII text, with very long lines (60130)
                            Category:dropped
                            Size (bytes):60312
                            Entropy (8bit):4.72859504417617
                            Encrypted:false
                            SSDEEP:
                            MD5:A12EC7EBE75A4D59A5DD6B79E2BA2E16
                            SHA1:28F5DCC595EE6D4163481EF64170180502C8629B
                            SHA-256:FC5128DFDCDFA0C3A9967A6D2F19399D7BF1AAAE6AD7571B96B03915A1F30DDA
                            SHA-512:28B9EA5F3F95807259C2745162424ACEECAC2556BC1AB9A3B33E4E15B54C6970A4DF4A5892FE83C1155C82CA8D93AEBB173BE32F1A7F8B9D3CE038B2DD1E6FFE
                            Malicious:false
                            Reputation:unknown
                            Preview:/*!. * Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */.fa,.fab,.fad,.fal,.far,.fas{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:inline-block;font-style:normal;font-variant:normal;text-rendering:auto;line-height:1}.fa-lg{font-size:1.33333em;line-height:.75em;vertical-align:-.0667em}.fa-xs{font-size:.75em}.fa-sm{font-size:.875em}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-fw{text-align:center;width:1.25em}.fa-ul{list-style-type:none;margin-left:2.5em;padding-left:0}.fa-ul>li{position:relative}.fa-li{left:-2em;position:absolute;text-align:center;width:2em;line-height:inherit}.fa-border{border:.08em solid #eee;border-radius:.1em;padding:.2em .25em .15em}.fa-pul

                            Chrome Cache Entry: 78

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:ASCII text, with very long lines (11461)
                            Category:downloaded
                            Size (bytes):11893
                            Entropy (8bit):5.198678335763684
                            Encrypted:false
                            SSDEEP:
                            MD5:55D343A40C7166A79FD314F13CBB2E93
                            SHA1:96904A849C32CA220E0AAA2AE3E81CF2B5CDF764
                            SHA-256:A1F75D6278713A84A8F28A392C77CA8A6A7C32BF14314D4A34A6CE2F06CFDF7A
                            SHA-512:518AC396E7F82899CAB4A6E3CB68116F2B599D680D015A1A8024926BC39E9A5D3ED68935B2150DA33AD41A9103E4CFD5031A7E89036901C972EEE257546BB1C5
                            Malicious:false
                            Reputation:unknown
                            URL:https://kit.fontawesome.com/585b051251.js
                            Preview:window.FontAwesomeKitConfig = {"id":132286382,"version":"5.15.4","token":"585b051251","method":"css","baseUrl":"https://ka-f.fontawesome.com","license":"free","asyncLoading":{"enabled":true},"autoA11y":{"enabled":true},"baseUrlKit":"https://kit.fontawesome.com","detectConflictsUntil":null,"iconUploads":{},"minify":{"enabled":true},"v4FontFaceShim":{"enabled":false},"v4shim":{"enabled":true},"v5FontFaceShim":{"enabled":false}};.!function(t){"function"==typeof define&&define.amd?define("kit-loader",t):t()}((function(){"use strict";function t(t,e){var n=Object.keys(t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(t);e&&(r=r.filter((function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable}))),n.push.apply(n,r)}return n}function e(e){for(var n=1;n<arguments.length;n++){var o=null!=arguments[n]?arguments[n]:{};n%2?t(Object(o),!0).forEach((function(t){r(e,t,o[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(o)):

                            Chrome Cache Entry: 79

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:Web Open Font Format (Version 2), TrueType, length 78168, version 331.-31196
                            Category:downloaded
                            Size (bytes):78168
                            Entropy (8bit):7.996980715595138
                            Encrypted:true
                            SSDEEP:
                            MD5:A9FD1225FB2CD32320E2B931DCA01089
                            SHA1:44EC5C6A868B4CE62350D9F040ED8E18F7A1D128
                            SHA-256:C5DD43F53F3AF822CBF17B1FB75F46192CDBD51724F277ACF6CF0DACB3FD57E7
                            SHA-512:58F45066D5738B1EF1F431EB9FC911FC9E6F61F60538F1577CD2EBE651BD8E7B87124DAE36C4E66FB303FD249EBA333BF41D316774201948CAD056BB0E4B4F2E
                            Malicious:false
                            Reputation:unknown
                            URL:https://ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-solid-900.woff2
                            Preview:wOF2......1X..........0..K.$....................?FFTM....`..N.....h..B.6.$..0..4.. ..+...[.u...m......6.........f%...N\!7.....w!......K..~.....DP)..V.u].5a..dQT1..#.bIIL&L=.....z....}4E.8..`..-..8..?....Xk.C..mV..`&...D."...V.c'.)......"/ .AD.4...i..S)e.72..@D "....~.Jj...~...so7r.....TK...P6..m5.>....1...=x...~.....mD...&.....4/.#[...v.U.,.3.O[aoy......f|.gKL..d.....e...P......c.j........H..../+d..Z....@.._....8.yk.0p.._~..g.C.:{..u.......h..n...I..%..#aD..$@....... ......'..G.89.*n...*._q.~....+]..uvX.r..!~n...7r.7*.9..6..7...`....=..j..~.:.......y..P.[.Q.7.../....J..j..B[`KliY.-m,.i..6.eW..^u]W7..qu.r..K.N..O..i9`H..0.!0.6............d..f......e.!,..oK....N:..-..X}..."....]..........j2....8.f5/b..n5..V.......d.C.....a.d!..,.../00).{y9V.W!..o.S.<..B>...mhH..%...X.....m~&....&.i.)`rS...."l..d......I.....B....;2Cb.SD........F..s.Z.S.Acb-.C.@..vj....=..Si...... .........i}._m..v.L..x..K.j_.v........]y...WV.B-{}1..E.9.{...9\.. .H..:svr..E_..q....._w...

                            Chrome Cache Entry: 80

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:PNG image data, 128 x 128, 8-bit/color RGB, non-interlaced
                            Category:dropped
                            Size (bytes):17340
                            Entropy (8bit):7.972771605722327
                            Encrypted:false
                            SSDEEP:
                            MD5:568A5D9DBBF9A33D0992C1064A352BBC
                            SHA1:0571D32C751FD7A118C1718473F77E4A00CF610A
                            SHA-256:09496F40654CA66DD6FE0FE4660F81D599B6AF53D674EEDABFB9FC7D419AECF5
                            SHA-512:834AE14C1D08FD5F4A65101EEA1A7DE714A24257EE1C26A8D06DAF59CC495F5635002DEAC6FD2FAF0CD3C500D8677EC7EF3CBFD62F549244C71C600A4CA3043F
                            Malicious:false
                            Reputation:unknown
                            Preview:.PNG........IHDR.............L\....C.IDATx.......0|.[......D....i.....D.. j.7......%&....c....Lb.F....R.V.H.l.{...SN.~3..p.E`a......1.{.9..}...|...........F.W..F.W..F.W..F.W..F.W..F.W..F.W..F.W...\..'.l..C#B.s.1...v.K..!..n.!d.a.!....B.............l.N.R...!$..4@.......@.Y..i......q!@.k..={..?#...L.....?.......&..^._...d..UaD...L......@...8...xv;....%...].=f..D..<.1.k....Q. ?..9N.-.5s.m...UU5.CUT.......Huw...S>....0..+.....Kz@1M.H.B.A.|..N/..?...N..kll..1.G|.4.L4..F..=..<..y..@....3:..9w\..@)-.*...O..|...p.eY....W.!!D@......4.....!...%#..d2.lVQ..Z.:..J.0..PX.........v:.2..i..../...X,@...B.\...!R(....^.LF..M.TUU.EUU......uS...i\.0y%....f..a.b.(.T....k...!.v.V..)B...cB..h...|..*.s.|....RJS...@.uEQb.h!...c.dR:A..mp.jPZ..t:..y.;....._.D.s.O.A\...'E..!.....v..q\.h'=0...G.U.yz.q..IG..:.c......-]....Q..`..f..&"........t:.I<_!.f9...Y.c;..T....+$..J..H..w......q.%.....8.#E.....N.$.]......A...yv4...J$I...$'e.Y....P..%...;...d..B......eY.d.n .!..[..3Pu....w

                            Chrome Cache Entry: 81

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:ASCII text, with very long lines (26500)
                            Category:dropped
                            Size (bytes):26682
                            Entropy (8bit):4.82962335901065
                            Encrypted:false
                            SSDEEP:
                            MD5:76F34B71FC9FB641507FF6A822CC07F5
                            SHA1:73ED2F8F21CD40FB496E61306ACBB5849D4DBFF4
                            SHA-256:6DEA47458A4CD7CD7312CC780A53C62E0C8B3CCC8D0B13C1AC0EA6E3DFCECEA8
                            SHA-512:6C4002CE78247B50BFA835A098980AF340E4E9F05F7097C1E83301289051CE1282E647ABAB87DB28A32FBFE0263C7318D2444B7D57875873908D6D5ED2AF882F
                            Malicious:false
                            Reputation:unknown
                            Preview:/*!. * Font Awesome Free 5.15.4 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */.fa.fa-glass:before{content:"\f000"}.fa.fa-meetup{font-family:"Font Awesome 5 Brands";font-weight:400}.fa.fa-star-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-star-o:before{content:"\f005"}.fa.fa-close:before,.fa.fa-remove:before{content:"\f00d"}.fa.fa-gear:before{content:"\f013"}.fa.fa-trash-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-trash-o:before{content:"\f2ed"}.fa.fa-file-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-file-o:before{content:"\f15b"}.fa.fa-clock-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-clock-o:before{content:"\f017"}.fa.fa-arrow-circle-o-down{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-arrow-circle-o-down:before{content:"\f358"}.fa.fa-arrow-circle-o-up{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-arro

                            Chrome Cache Entry: 82

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:ASCII text, with very long lines (32065)
                            Category:downloaded
                            Size (bytes):85578
                            Entropy (8bit):5.366055229017455
                            Encrypted:false
                            SSDEEP:
                            MD5:2F6B11A7E914718E0290410E85366FE9
                            SHA1:69BB69E25CA7D5EF0935317584E6153F3FD9A88C
                            SHA-256:05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
                            SHA-512:0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
                            Malicious:false
                            Reputation:unknown
                            URL:https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
                            Preview:/*! jQuery v2.2.4 | (c) jQuery Foundation | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

                            Chrome Cache Entry: 83

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:ASCII text, with very long lines (32030)
                            Category:downloaded
                            Size (bytes):86709
                            Entropy (8bit):5.367391365596119
                            Encrypted:false
                            SSDEEP:
                            MD5:E071ABDA8FE61194711CFC2AB99FE104
                            SHA1:F647A6D37DC4CA055CED3CF64BBC1F490070ACBA
                            SHA-256:85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
                            SHA-512:53A2B560B20551672FBB0E6E72632D4FD1C7E2DD2ECF7337EBAAAB179CB8BE7C87E9D803CE7765706BC7FCBCF993C34587CD1237DE5A279AEA19911D69067B65
                            Malicious:false
                            Reputation:unknown
                            URL:https://code.jquery.com/jquery-3.1.1.min.js
                            Preview:/*! jQuery v3.1.1 | (c) jQuery Foundation | jquery.org/license */.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b||d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.1.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.con

                            Chrome Cache Entry: 84

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:MS Windows icon resource - 3 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel
                            Category:downloaded
                            Size (bytes):7405
                            Entropy (8bit):2.037697524051661
                            Encrypted:false
                            SSDEEP:
                            MD5:888E04D5D5FF290D47BF73787F1E0BFC
                            SHA1:C8EDC4B60BB909C025B908F4ADBEEA557581687C
                            SHA-256:387483B8C9FB9F677E0D72D066945675540FE417E6E6C70BAA9C013CB8FC88CD
                            SHA-512:0662402C7EBC3D670D40EC55E5DC25C4360E54743517B783151F088A23FDCBE70803B4ED43BCE87D5B50908AC52AF4DEEDE6311445086E5CCFF98E2A82C0CB7A
                            Malicious:false
                            Reputation:unknown
                            URL:https://docucdn-a.akamaihd.net/olive/images/2.15.0/favicons/favicon.ico
                            Preview:......00..........6... ......................h.......(...0...`............................................"...........ti......................................|q......!..............# .......................y......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            Static File Info

                            General

                            File type:CDFV2 Microsoft Outlook Message
                            Entropy (8bit):3.77244263573451
                            TrID:
                            • Outlook Message (71009/1) 58.92%
                            • Outlook Form Template (41509/1) 34.44%
                            • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                            File name:I_ REF _ Due Debt 25_03_2024.msg
                            File size:46'080 bytes
                            MD5:80b191fd47252c162bce3113982eda0f
                            SHA1:1462bfa57fa0aa9f4f3f9ecf90fdfbcdf131ddb6
                            SHA256:5d37d4fab3e2a2d1bbaf540b04dad95695a8180f89fbcc81bff4df81921835b2
                            SHA512:68aa0a014a693384bc5da0d3b041281d0e3e357f74e644e628ae32b0bee97f601f79f06bcf294323b9eeb1af7165a5784767b22700b36cc3e40215fcfce1ab95
                            SSDEEP:768:0B06JoM4zm/sKXX0XHAHooY1WSwFR2gWPRiUxsKdiCF/0yCasKIsKEr:0SnEgHAHooY18r8V1ppAMr
                            TLSH:F023BD1536E94605F2BBDF365DF380978522BCD1ED20C79F3295730F0AB2981A961B2B
                            File Content Preview:........................>......................................................................................................................................................................................................................................

                            Static Mail

                            General

                            Subject:I: REF : Due Debt 25.03.2024
                            From:virginia scremin <virginia.scremin@cuzziol.it>
                            To:Andrea Ceccherini <andrea.ceccherini@cuzziol.it>
                            Cc:
                            BCC:
                            Date:Thu, 28 Mar 2024 09:20:08 +0100
                            Communications:
                            • Dovremme inviarmi una presentazione, ma non capisco se questa mail spam Da: David <nwbility@newabilitiesot.com> Inviato: mercoled 27 marzo 2024 22:53 A: virginia scremin <virginia.scremin@cuzziol.it> Oggetto: REF : Due Debt 25.03.2024 Docs Debt 22032024.pdf to virginia.scremin@cuzziol.it <mailto:virginia.scremin@cuzziol.it> These files will be available until 3/27/2024 10:52:30 p.m.. Questions? Ask David (documents@dropbox.com <mailto:documents@dropbox.com> ) Download files <https://cloudflare-ipfs.com/ipfs/bafybeib66t4ah2ibo6fdsaysddgmzuhfrkaoehx5crfpnarheqsjywdjnu#virginia.scremin@cuzziol.it> Here's what they sent you 1 item 609 KB Contract0283.pdf 850.1 KB [#]Help center [#]Feedback [#]Privacy & terms [#]About Drpbox Transfer [#]Upgrade your plan
                            Attachments:

                              Headers

                              Key Value
                              Receivedfrom SRV01.cuzziol.local ([::1]) by SRV01.cuzziol.local ([::1]) with
                              Transport; Thu, 28 Mar 2024 0920:09 +0100
                              2024 0920:09 +0100
                              mapi id 14.03.0513.000; Thu, 28 Mar 2024 0920:09 +0100
                              Content-Typeapplication/ms-tnef; name="winmail.dat"
                              Content-Transfer-Encodingbinary
                              Fromvirginia scremin <virginia.scremin@cuzziol.it>
                              ToAndrea Ceccherini <andrea.ceccherini@cuzziol.it>
                              SubjectI: REF : Due Debt 25.03.2024
                              Thread-TopicREF : Due Debt 25.03.2024
                              Thread-IndexAQHagJEZqWvivdjkSUW1E9j9mqi2M7FM0C3g
                              DateThu, 28 Mar 2024 09:20:08 +0100
                              Message-ID<9A086E9731B0ED449DF5CC1BB29A37D6010D375CB6@SRV01.cuzziol.local>
                              References<20240327225230.1F09A0D27523F790@newabilitiesot.com>
                              In-Reply-To<20240327225230.1F09A0D27523F790@newabilitiesot.com>
                              Accept-Languageit-IT, en-US
                              Content-Languageit-IT
                              X-MS-Has-AttachX-MS-Exchange-Organization-SCL: -1
                              X-MS-TNEF-Correlator<9A086E9731B0ED449DF5CC1BB29A37D6010D375CB6@SRV01.cuzziol.local>
                              MIME-Version1.0
                              X-MS-Exchange-Organization-MessageDirectionalityOriginating
                              X-MS-Exchange-Organization-AuthSourceSRV01.cuzziol.local
                              X-MS-Exchange-Organization-AuthAsInternal
                              X-MS-Exchange-Organization-AuthMechanism04
                              X-Originating-IP[192.168.2.128]
                              Return-Pathvirginia.scremin@cuzziol.it
                              X-MS-Exchange-Organization-Network-Message-Idc472c3bf-7b0b-4876-c0ba-08dc4effe22e
                              X-MS-Exchange-Organization-AVStamp-Enterprise1.0
                              X-MS-Exchange-Transport-EndToEndLatency00:00:01.1147769
                              X-MS-Exchange-Processed-By-BccFoldering15.01.2242.012
                              dateThu, 28 Mar 2024 09:20:08 +0100

                              File Icon

                              Icon Hash:c4e1928eacb280a2