Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
phish_alert_iocp_v1.4.48 - 2025-03-10T103931.828.eml

Overview

General Information

Sample name:phish_alert_iocp_v1.4.48 - 2025-03-10T103931.828.eml
Analysis ID:1634133
MD5:3f55ce46bedf023effa8c71bd3779965
SHA1:dc0176c32dc0445aff68180a20c1efc905d88351
SHA256:175b644a56028c4b5d614f9dff616aa5d256883854295800e81780564fa0890c
Infos:

Detection

Score:48
Range:0 - 100
Confidence:100%

Signatures

AI detected landing page (webpage, office document or email)
AI detected suspicious elements in Email content
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Suspicious Office Outbound Connections
Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 3908 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_iocp_v1.4.48 - 2025-03-10T103931.828.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 5108 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A7AA8E00-3D76-440D-806E-9BCDD442001A" "F481DEE6-C4BF-4969-B1A9-87987709AC1B" "3908" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 304 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://sg.bill.com/ls/click%3Fupn%3Du001.se4SimOEkqgQ32qtQ-2B6PfENJc9OeuRJf-2BPvH9hzualBqq862VNdWFoQcB8PhGtxS15IipRR9HZk8O-2BQYszE7D3PsT-2FINfrqCDiSUTt88S09O-2BVFex1EzTdX6o7-2BfpkBvnoi6hIrQa7iZgIlryVXxKSxbISsfRdbnu6UDO47N4kM-3Dt4yx_w56szRjYzswIa-2F5MVvf3SMgRlmvH9dtJrEm6r9x2-2BeyyzJ0mni4PctFs5gMl4UpusQz1jVpcNSMElL09fYbwQPCqAJjNBMfClyPcVBusR6OdrNDDncs6W2QLk4iJJkXMZ7DR34EK6LVTDxiBOC79Y3h5xUqOS3mbQ5k7cs8O4EKqUWNw297pNP-2BetvXNqsijdQX-2BVg-2FhLmUnZB6XPMcw4Q-3D-3D&E=loanservicing%40firstfedweb.com&X=XID118dcHwnR0588Xd1&T=FF1001&HV=U,E,X,T&H=c813b49f3a909cbf5303914d4347d6c401d2ebd9 MD5: E81F54E6C1129887AEA47E7D092680BF)
    • chrome.exe (PID: 692 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://sg.bill.com/ls/click%3Fupn%3Du001.se4SimOEkqgQ32qtQ-2B6PfENJc9OeuRJf-2BPvH9hzualBqq862VNdWFoQcB8PhGtxS15IipRR9HZk8O-2BQYszE7D3PsT-2FINfrqCDiSUTt88S09O-2BVFex1EzTdX6o7-2BfpkBvnoi6hIrQa7iZgIlryVXxKSxbISsfRdbnu6UDO47N4kM-3Dt4yx_w56szRjYzswIa-2F5MVvf3SMgRlmvH9dtJrEm6r9x2-2BeyyzJ0mni4PctFs5gMl4UpusQz1jVpcNSMElL09fYbwQPCqAJjNBMfClyPcVBusR6OdrNDDncs6W2QLk4iJJkXMZ7DR34EK6LVTDxiBOC79Y3h5xUqOS3mbQ5k7cs8O4EKqUWNw297pNP-2BetvXNqsijdQX-2BVg-2FhLmUnZB6XPMcw4Q-3D-3D&E=loanservicing%40firstfedweb.com&X=XID118dcHwnR0588Xd1&T=FF1001&HV=U,E,X,T&H=c813b49f3a909cbf5303914d4347d6c401d2ebd9 MD5: E81F54E6C1129887AEA47E7D092680BF)
      • chrome.exe (PID: 1624 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1956,i,1025835801749021756,13280479111595613558,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 3908, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
Sigma detected: Suspicious Office Outbound Connections
Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.18, DestinationIsIpv6: false, DestinationPort: 49712, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, Initiated: true, ProcessId: 3908, Protocol: tcp, SourceIp: 52.123.128.14, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2025-03-10T18:55:35.719906+010020283713Unknown Traffic192.168.2.184971252.123.128.14443TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected landing page (webpage, office document or email)
Source: EmailJoe Sandbox AI: Email contains prominent button: 'accept invitation'
AI detected suspicious elements in Email content
Source: EmailJoe Sandbox AI: Detected potential phishing email: The sender email domain 'hq.bill.com' appears legitimate but the contact name 'Lukle Cleveland' with personal Yahoo email (l.cleveland1@yahoo.com) for business communications is suspicious. Multiple redirecting URLs through clicktime.cloud that ultimately lead to different domains is a common phishing tactic. The urgency to set up electronic payments combined with a generic company name 'WEST COAST LIFT INC' and unusual formatting/capitalization are red flags
Source: EmailClassification: Invoice Scam
Source: chrome.exeMemory has grown: Private usage: 1MB later: 36MB
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49712 -> 52.123.128.14:443
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknownTCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.136
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: clicktime.cloud.postoffice.net
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49688
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49688 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
Source: classification engineClassification label: mal48.winEML@29/3@6/101
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250310T1354020633-3908.etl
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_iocp_v1.4.48 - 2025-03-10T103931.828.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A7AA8E00-3D76-440D-806E-9BCDD442001A" "F481DEE6-C4BF-4969-B1A9-87987709AC1B" "3908" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A7AA8E00-3D76-440D-806E-9BCDD442001A" "F481DEE6-C4BF-4969-B1A9-87987709AC1B" "3908" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://sg.bill.com/ls/click%3Fupn%3Du001.se4SimOEkqgQ32qtQ-2B6PfENJc9OeuRJf-2BPvH9hzualBqq862VNdWFoQcB8PhGtxS15IipRR9HZk8O-2BQYszE7D3PsT-2FINfrqCDiSUTt88S09O-2BVFex1EzTdX6o7-2BfpkBvnoi6hIrQa7iZgIlryVXxKSxbISsfRdbnu6UDO47N4kM-3Dt4yx_w56szRjYzswIa-2F5MVvf3SMgRlmvH9dtJrEm6r9x2-2BeyyzJ0mni4PctFs5gMl4UpusQz1jVpcNSMElL09fYbwQPCqAJjNBMfClyPcVBusR6OdrNDDncs6W2QLk4iJJkXMZ7DR34EK6LVTDxiBOC79Y3h5xUqOS3mbQ5k7cs8O4EKqUWNw297pNP-2BetvXNqsijdQX-2BVg-2FhLmUnZB6XPMcw4Q-3D-3D&E=loanservicing%40firstfedweb.com&X=XID118dcHwnR0588Xd1&T=FF1001&HV=U,E,X,T&H=c813b49f3a909cbf5303914d4347d6c401d2ebd9
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://sg.bill.com/ls/click%3Fupn%3Du001.se4SimOEkqgQ32qtQ-2B6PfENJc9OeuRJf-2BPvH9hzualBqq862VNdWFoQcB8PhGtxS15IipRR9HZk8O-2BQYszE7D3PsT-2FINfrqCDiSUTt88S09O-2BVFex1EzTdX6o7-2BfpkBvnoi6hIrQa7iZgIlryVXxKSxbISsfRdbnu6UDO47N4kM-3Dt4yx_w56szRjYzswIa-2F5MVvf3SMgRlmvH9dtJrEm6r9x2-2BeyyzJ0mni4PctFs5gMl4UpusQz1jVpcNSMElL09fYbwQPCqAJjNBMfClyPcVBusR6OdrNDDncs6W2QLk4iJJkXMZ7DR34EK6LVTDxiBOC79Y3h5xUqOS3mbQ5k7cs8O4EKqUWNw297pNP-2BetvXNqsijdQX-2BVg-2FhLmUnZB6XPMcw4Q-3D-3D&E=loanservicing%40firstfedweb.com&X=XID118dcHwnR0588Xd1&T=FF1001&HV=U,E,X,T&H=c813b49f3a909cbf5303914d4347d6c401d2ebd9
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1956,i,1025835801749021756,13280479111595613558,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://sg.bill.com/ls/click%3Fupn%3Du001.se4SimOEkqgQ32qtQ-2B6PfENJc9OeuRJf-2BPvH9hzualBqq862VNdWFoQcB8PhGtxS15IipRR9HZk8O-2BQYszE7D3PsT-2FINfrqCDiSUTt88S09O-2BVFex1EzTdX6o7-2BfpkBvnoi6hIrQa7iZgIlryVXxKSxbISsfRdbnu6UDO47N4kM-3Dt4yx_w56szRjYzswIa-2F5MVvf3SMgRlmvH9dtJrEm6r9x2-2BeyyzJ0mni4PctFs5gMl4UpusQz1jVpcNSMElL09fYbwQPCqAJjNBMfClyPcVBusR6OdrNDDncs6W2QLk4iJJkXMZ7DR34EK6LVTDxiBOC79Y3h5xUqOS3mbQ5k7cs8O4EKqUWNw297pNP-2BetvXNqsijdQX-2BVg-2FhLmUnZB6XPMcw4Q-3D-3D&E=loanservicing%40firstfedweb.com&X=XID118dcHwnR0588Xd1&T=FF1001&HV=U,E,X,T&H=c813b49f3a909cbf5303914d4347d6c401d2ebd9
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://sg.bill.com/ls/click%3Fupn%3Du001.se4SimOEkqgQ32qtQ-2B6PfENJc9OeuRJf-2BPvH9hzualBqq862VNdWFoQcB8PhGtxS15IipRR9HZk8O-2BQYszE7D3PsT-2FINfrqCDiSUTt88S09O-2BVFex1EzTdX6o7-2BfpkBvnoi6hIrQa7iZgIlryVXxKSxbISsfRdbnu6UDO47N4kM-3Dt4yx_w56szRjYzswIa-2F5MVvf3SMgRlmvH9dtJrEm6r9x2-2BeyyzJ0mni4PctFs5gMl4UpusQz1jVpcNSMElL09fYbwQPCqAJjNBMfClyPcVBusR6OdrNDDncs6W2QLk4iJJkXMZ7DR34EK6LVTDxiBOC79Y3h5xUqOS3mbQ5k7cs8O4EKqUWNw297pNP-2BetvXNqsijdQX-2BVg-2FhLmUnZB6XPMcw4Q-3D-3D&E=loanservicing%40firstfedweb.com&X=XID118dcHwnR0588Xd1&T=FF1001&HV=U,E,X,T&H=c813b49f3a909cbf5303914d4347d6c401d2ebd9
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1956,i,1025835801749021756,13280479111595613558,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation21
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Process Injection		LSASS Memory13
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
Extra Window Memory Injection		1
DLL Side-Loading		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Extra Window Memory Injection		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
clicktime.cloud.postoffice.net
165.212.65.140
truefalse
    		high
    www.google.com
    		142.250.186.68
    		truefalse
      		high
      s-0005.dual-s-msedge.net
      		52.123.128.14
      		truefalse
        		high

        World Map of Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public IPs

        IPDomainCountryFlagASNASN NameMalicious
        142.250.186.68
        		www.google.comUnited States
        		15169GOOGLEUSfalse
        142.250.186.78
        		unknownUnited States
        		15169GOOGLEUSfalse
        1.1.1.1
        		unknownAustralia
        		13335CLOUDFLARENETUSfalse
        173.194.76.84
        		unknownUnited States
        		15169GOOGLEUSfalse
        216.58.206.78
        		unknownUnited States
        		15169GOOGLEUSfalse
        172.217.18.3
        		unknownUnited States
        		15169GOOGLEUSfalse
        52.123.128.14
        		s-0005.dual-s-msedge.netUnited States
        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        165.212.65.140
        		clicktime.cloud.postoffice.netUnited States
        		14454PERIMETER-ESECURITYUSfalse
        142.250.181.227
        		unknownUnited States
        		15169GOOGLEUSfalse
        142.250.185.174
        		unknownUnited States
        		15169GOOGLEUSfalse
        52.109.32.97
        		unknownUnited States
        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        40.79.167.8
        		unknownUnited States
        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        142.250.186.131
        		unknownUnited States
        		15169GOOGLEUSfalse
        64.233.184.84
        		unknownUnited States
        		15169GOOGLEUSfalse
        23.60.203.209
        		unknownUnited States
        		16625AKAMAI-ASUSfalse

        Private

        IP
        192.168.2.18

        General Information

        Joe Sandbox version:42.0.0 Malachite
        Analysis ID:1634133
        Start date and time:2025-03-10 18:53:24 +01:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:defaultwindowsinteractivecookbook.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:11
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • EGA enabled
        Analysis Mode:stream
        Analysis stop reason:Timeout
        Sample name:phish_alert_iocp_v1.4.48 - 2025-03-10T103931.828.eml
        Detection:MAL
        Classification:mal48.winEML@29/3@6/101
        Cookbook Comments:
        • Found application associated with file extension: .eml

        Warnings

        • Exclude process from analysis (whitelisted): SIHClient.exe
        • Excluded IPs from analysis (whitelisted): 52.109.32.97
        • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, config.officeapps.live.com, prod.configsvc1.live.com.akadns.net, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, europe.configsvc1.live.com.akadns.net
        • Not all processes where analyzed, report is missing behavior information
        • Report size getting too big, too many NtOpenFile calls found.
        • Report size getting too big, too many NtQueryAttributesFile calls found.
        • Report size getting too big, too many NtQueryValueKey calls found.
        • Report size getting too big, too many NtReadVirtualMemory calls found.

        Created / dropped Files

        C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250310T1354020633-3908.etl

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:data
        Category:modified
        Size (bytes):102400
        Entropy (8bit):4.489626444897004
        Encrypted:false
        SSDEEP:
        MD5:C0CC5D64F1B3BBB3A98930A4FF72D4AA
        SHA1:A09F2DA22EABB33839360BA672A17DEAE9EAE6FA
        SHA-256:57FAF363E687802A2E5019A77E0B193EC5E510F2C149B5A40E254AF6AC8A9DD2
        SHA-512:2FFC5C423CB777ADD05C5D014ACA9D04B63A6B90E885F643D39AEA1BC5661A80C27E492DAAD86FC384E44CF59716CD60B983082734F820A44EE7B0D7887077E4
        Malicious:false
        Reputation:unknown
        Preview:............................................................................`.......D...e4.h...................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................Wp.9...........e4.h...........v.2._.O.U.T.L.O.O.K.:.f.4.4.:.8.0.3.c.a.f.7.e.6.4.d.f.4.8.5.f.8.b.d.4.6.d.c.4.b.f.5.0.d.e.3.a...C.:.\.U.s.e.r.s.\.n.o.r.d.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.5.0.3.1.0.T.1.3.5.4.0.2.0.6.3.3.-.3.9.0.8...e.t.l.......P.P.....D...e4.h...........................................................................................................................................................................................................................................................................................................

        C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:Microsoft Outlook email folder (>=2003)
        Category:dropped
        Size (bytes):271360
        Entropy (8bit):2.723530441694465
        Encrypted:false
        SSDEEP:
        MD5:92222C7DAF714C744D80F65DDB4122E6
        SHA1:23E3BC28E1FDDEACBBE9E7F716D9A470833BDDFD
        SHA-256:03D453E2F67FD5EDAE6C5C511DA94E8E87C44FF6511638FEA68CBA5EAFF944CC
        SHA-512:D4410463B62D1FA10DE2C50462C4C33CAF73C00D316921EBA84044ACE19C8EEE2BD80A2A29CB4DECF2A1B7B994E5BC588659A624BB3C119AE82166380DB9286A
        Malicious:true
        Reputation:unknown
        Preview:!BDN..MtSM......\....i..................X................@...........@...@...................................@...........................................................................$.......D.......W..........................................................................................................................................................................................................................................................................................................................`.......n..P..x.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

        C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

        Download File
        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
        File Type:data
        Category:dropped
        Size (bytes):131072
        Entropy (8bit):4.40519299604417
        Encrypted:false
        SSDEEP:
        MD5:FEE8E301146CABB168BA01821DED6AA9
        SHA1:BF86616AC74B21A750B0CC0DBDEF2DD186BEF82F
        SHA-256:3A138DF4D154D69DF7B68961E9F4FD1CBD5DA8BEF97180FF1E76862F859610AA
        SHA-512:8D2BA25FC27F84A264DF0EC7FD18FBBBC0C4A1476B48ECDB4EFF44DFCE7341547310779EEA3DCF66B86A373B4938622A38E85FBA10FA06904A1FC5177498C277
        Malicious:true
        Reputation:unknown
        Preview:....C...W.......D....ah.....................#.!BDN..MtSM......\....i..................X................@...........@...@...................................@...........................................................................$.......D.......W..........................................................................................................................................................................................................................................................................................................................`.......n..P..x..ah........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

        Static File Info

        General

        File type:RFC 822 mail, ASCII text, with very long lines (347), with CRLF line terminators
        Entropy (8bit):6.0445448343145785
        TrID:
        • E-Mail message (Var. 5) (54515/1) 100.00%
        File name:phish_alert_iocp_v1.4.48 - 2025-03-10T103931.828.eml
        File size:30'205 bytes
        MD5:3f55ce46bedf023effa8c71bd3779965
        SHA1:dc0176c32dc0445aff68180a20c1efc905d88351
        SHA256:175b644a56028c4b5d614f9dff616aa5d256883854295800e81780564fa0890c
        SHA512:2d82acc7f8f7380cdbc71bfecf4d52ebf7d711e6101a860c184d599501b2034cfc12f2e7a0589bf96bcfdc1f7a18213bcb017c0bbdb0d85cd8b14a2f7d5ddcbd
        SSDEEP:768:nu59ZHb1w83/RE99jZr7GI8tkAHeUwIihqNWG67:nu53HxgrqCUwNhqNWG6
        TLSH:EFD26BD249505174EAAA15C83E0976EF9E6A3BCBDDF3D8E4B3D122424EC34BB5B042C5
        File Content Preview:Received: from LV8PR22MB5551.namprd22.prod.outlook.com.. (2603:10b6:408:232::13) by PH0PR22MB2487.namprd22.prod.outlook.com with.. HTTPS; Sat, 8 Mar 2025 22:39:51 +0000..ARC-Seal: i=2; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=pass;.. b=KK9axy

        Static Mail

        General

        Subject:WEST COAST LIFT INC. wants to pay you
        From:"Lukle Cleveland on behalf of WEST COAST LIFT INC." <invites@hq.bill.com>
        To:Loan Servicing <LoanServicing@firstfedweb.com>
        Cc:
        BCC:
        Date:Sat, 08 Mar 2025 15:39:15 -0700
        Communications:
        • [EXTERNAL EMAIL: Take caution with links and attachments. ] <https://appb1.paymentsinvoicing.bankofamerica.com/img/background_images/email-logo-60x40.png> Hi First Federal, WEST COAST LIFT INC. is inviting you to start receiving electronic payments through BILL. This is our preferred method for making payments and its free to sign up. Once you've successfully added a bank account, we may then pay you directly to your account. Your account information will be secure and not be visible to WEST COAST LIFT INC.. If you have any questions about getting paid through BILL, please contact WEST COAST LIFT INC. at l.cleveland1@yahoo.com or 5035502024. Ready to get started? Accept Invitation <https://clicktime.cloud.postoffice.net/clicktime.php?U=https://sg.bill.com/ls/click%3Fupn%3Du001.se4SimOEkqgQ32qtQ-2B6PfENJc9OeuRJf-2BPvH9hzualBqq862VNdWFoQcB8PhGtxS15IipRR9HZk8O-2BQYszE7D3PsT-2FINfrqCDiSUTt88S09O-2BVFex1EzTdX6o7-2BfpkBvnoi6hIrQa7iZgIlryVXxKSxbISsfRdbnu6UDO47N4kM-3Dt4yx_w56szRjYzswIa-2F5MVvf3SMgRlmvH9dtJrEm6r9x2-2BeyyzJ0mni4PctFs5gMl4UpusQz1jVpcNSMElL09fYbwQPCqAJjNBMfClyPcVBusR6OdrNDDncs6W2QLk4iJJkXMZ7DR34EK6LVTDxiBOC79Y3h5xUqOS3mbQ5k7cs8O4EKqUWNw297pNP-2BetvXNqsijdQX-2BVg-2FhLmUnZB6XPMcw4Q-3D-3D&E=loanservicing%40firstfedweb.com&X=XID118dcHwnR0588Xd1&T=FF1001&HV=U,E,X,T&H=c813b49f3a909cbf5303914d4347d6c401d2ebd9> If the button above doesn't work, copy and paste the following link into your web browser: https://clicktime.cloud.postoffice.net/clicktime.php?U=https://app-signup.us.bill.com/InviteSignup%3Finvite%3D0578483DD7FB4AB136E564A942945A392316403E74B9391EB2567592BE96D350%26p%3D1&E=loanservicing%40firstfedweb.com&X=XID118dcHwnR0588Xd1&T=FF1001&HV=U,E,X,T&H=836e5a293d7410ebab9f54afc8a0623c8c5fddad <https://clicktime.cloud.postoffice.net/clicktime.php?U=https://sg.bill.com/ls/click%3Fupn%3Du001.se4SimOEkqgQ32qtQ-2B6PfENJc9OeuRJf-2BPvH9hzualBqq862VNdWFoQcB8PhGtxS15IipRR9HZk8O-2BQYszE7D3PsT-2FINfrqCDiSUTt88S09O-2BVFex1EzTdX6o7-2BfpkBvnoi6hIrQa7iZgIlryVXxKSxbISsfRdbnu6UDO47N4kM-3DOaAz_w56szRjYzswIa-2F5MVvf3SMgRlmvH9dtJrEm6r9x2-2BeyyzJ0mni4PctFs5gMl4UpusQz1jVpcNSMElL09fYbwQDWgptWmbG4xqiZeYgbpA91mEZGlG-2BDWl-2Bw75k-2ByceMc6yar6QsOxVBws4JOB9-2F6s55Oq2TZ33CQhWVj7eq-2FENI-2FBJTOp6SS-2BOgKZLqwHhf9CDJA5lJr-2FZRQJSB0B7ypOA-3D-3D&E=loanservicing%40firstfedweb.com&X=XID118dcHwnR0588Xd1&T=FF1001&HV=U,E,X,T&H=43e188004790252b78342c666e8edec6dd775757> . Using this link will ensure that your account is created quickly and accurately. This custom URL was generated just for First Federal by WEST COAST LIFT INC. and will connect you to WEST COAST LIFT INC.. Thank you, Lukle Cleveland on behalf of WEST COAST LIFT INC. For technical questions or issues, please visit the BILL Help Center <https://clicktime.cloud.postoffice.net/clicktime.php?U=https://sg.bill.com/ls/click%3Fupn%3Du001.C9x8OaRFjVsM-2FT3cTXGCxIihb-2F1U8c1NLs8fnD3mPPTUWilwviLUxyPW62ZnIQRcrWOwSHTWYq9tdCc2y-2BqpvA-3D-3D99ub_w56szRjYzswIa-2F5MVvf3SMgRlmvH9dtJrEm6r9x2-2BeyyzJ0mni4PctFs5gMl4UpusQz1jVpcNSMElL09fYbwQNwZX3r1qNyurbVw6l4npgNXMlOjk2S8P6XK3BaQqBCN02BwDuXFnWUe1tKVkqE-2FsBQ4Zt3MOWHuvwywOut4fczMGGQpdDCd5799R2IyHQBw34Bl0-2Fk2LEUeWYf-2F32i8vg-3D-3D&E=loanservicing%40firstfedweb.com&X=XID118dcHwnR0588Xd1&T=FF1001&HV=U,E,X,T&H=89e07d579f409a40e6911c1e0a63ade04a45d508> . For your security, double check all email links before clicking them to make sure they're safe. Our links always start with https://clicktime.cloud.postoffice.net/clicktime.php?U=http://www.bill.com&E=loanservicing%40firstfedweb.com&X=XID118dcHwnR0588Xd1&T=FF1001&HV=U,E,X,T&H=b746449a63c17022e9c12fb51ff2be4169c55834, https://clicktime.cloud.postoffice.net/clicktime.php?U=https://app-signup.us.bill.com&E=loanservicing%40firstfedweb.com&X=XID118dcHwnR0588Xd1&T=FF1001&HV=U,E,X,T&H=0fe888656fc83eb7d16d86321984e2eba86b9ff3 or https://clicktime.cloud.postoffice.net/clicktime.php?U=http://www.cashflow.bill.com&E=loanservicing%40firstfedweb.com&X=XID118dcHwnR0588Xd1&T=FF1001&HV=U,E,X,T&H=c7d6b47ce1fccbb8a35fd06b422b52e48ae56a0f. Be cautious when sharing your information by email or phone. Please don't reply to this automated email. 2025 BILL Operations, LLC ip-10-128-201-225.101.37 0b5e848f OTID0069-21-1 Pb1 <https://sg.bill.com/wf/open?upn=u001.S9THkt7c5Xlxm4SROb-2BdW5XNgblWtacNCI8qa38F6ecCWwCdfhUJwWS77TiOBXV7gvH1OMp7E-2B8uVs0R69-2BVaqCQMEPo655deV-2BS3RGwHCFbnZN4Nwsw-2F19AcXWPqAK408hUpWW77NZ2eKWdBYx-2BM7G9bTde67JQhpe1wDBf75kVH604Udjx5RDaVgiOp0qeu4K-2BcYB-2FQYm3oUtdsGP6ss1LHmcP-2BYVj-2FXMz2pXZsvE-3D>
        Attachments:

          Headers

          Key Value
          ReceivedSat, 8 Mar 2025 14:39:53 -0700
          ARC-Seali=1; a=rsa-sha256; d=silversky.com; s=silversky-20150623192408; t=1741473585; cv=none; b=MeXSypX+N29mJ8n49sxO83OwsOTF9KICsOZolPaiexMEazPGIpkmBm5K4xB2JfE87jGq+pXeNSoRvb7fMC3f9P8H5efa01n09kWbX5Rx2IebYOukhWABsQEomIbXr9R3rDzsxPMgrs4L73fHVxjKRb5IvPKFq0rhew1nt9EqPZo=
          ARC-Message-Signaturei=1; a=rsa-sha256; d=silversky.com; s=silversky-20150623192408; t=1741473585; c=relaxed/simple; bh=x9tKwcvJeN42fOfdPVt/cduh6DXVZRSw8Lf1+RDbGgQ=; h=Date:From:Subject:To; b=V7aNvXeeDdp/pjkrVzqFHlJbJuxdJyZaPEc7ePA31yp5vePZQ0XL5FsDD0VTEGhQf5/sREOm+ivtzGY1/m03b47hQN59oDlKhNfAIgaG4rZ03h6e+NidgYfuxxCmA4rsp6EKWoNDVj0c+XO1dhz3rXflLff1b0brq3Z+g3xgmSI=
          ARC-Authentication-Resultsi=1; gwsin.silversky.com; dmarc=pass policy.dmarc=none header.from=hq.bill.com; dkim=pass header.d=hq.bill.com; spf=pass smtp.mailfrom=em5377.hq.bill.com; arc=none smtp.remote-ip=149.72.128.52
          Authentication-Resultsspf=fail (sender IP is 165.212.64.14) smtp.mailfrom=em5377.hq.bill.com; dkim=fail (body hash did not verify) header.d=hq.bill.com;dmarc=fail action=oreject header.from=hq.bill.com;compauth=none reason=451
          received-spfFail (protection.outlook.com: domain of em5377.hq.bill.com does not designate 165.212.64.14 as permitted sender) receiver=protection.outlook.com; client-ip=165.212.64.14; helo=postin01.mbox.net;
          X-USANET-Receivedfrom emd1.mbox.net [165.212.64.8] by gws1.mbox.net via mtad (GIT.BUILD.5.0.3133) with ESMTP id 862dcHwnR9888Ms1; Sat, 08 Mar 2025 22:39:17 -0000
          X-USANET-TAP-Score1
          Authentication-Results-Originalgwsin.silversky.com; dmarc=pass policy.dmarc=none header.from=hq.bill.com; dkim=pass header.d=hq.bill.com; spf=pass smtp.mailfrom=em5377.hq.bill.com; arc=none smtp.remote-ip=149.72.128.52
          X-USANET-Routed100 IN-RELAY R:gwsin-int:625
          X-USANET-GWS2-Servicegwsdin-tap preclick-never
          X-USANET-GWS2-Tenantfirstfedweb.com
          X-USANET-GWS2-TagidFF1001
          X-USANET-GWS2-MailFromDnsResultDnsFound
          X-USANET-GWS2-SecurityTLSv1.2;ECDHE-RSA-AES128-GCM-SHA256
          X-USANET-Source149.72.128.52 IN bounces+2B526498-6337-loanservicing+3Dfirstfedweb.com@em5377.hq.bill.com wrqvvhpq.outbound-mail.sendgrid.net TLS
          X-USANET-MsgIdXID118dcHwnR0588Xd1
          X-BAEAI-Trust-Score90
          X-BAEAI-Trust-ReasonsSNDRAUTH; PAYTRM; SNDRNEW; DOMFRQ,bill.com;
          DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed; d=hq.bill.com; h=from:subject:mime-version:to:content-type:cc:content-type:from: subject:to; s=s1; bh=1WxR+ZP19M4DHiHFdMPneDM0+d4ulY78hgRh/Go0q5s=; b=C7G5+3lBK31WcMBjVVSJUq7w4mvhWOoZiFRWAPKprF27KZmPehMeF+BU9bFmVrShd00T 09m5E+ESaR/62IQmOxTFAWuY3xz4NClN1uEE++74LceaOs6JMgQZoCEtBeo3Yx0gmxNY4Q s7Ealb0o9rZduMv2rBm5399wxzejR9a3/k8Fp/TCTBtQD7ir3eMdXpBWWxSozs4+W2Ilu5 sennMQp8CmoViyRnkplB7ist7jy2agUDvmSn2345J2LQuBfpG+ujhAGZncRwWPQH76FWMN sVGFE5BRE6yRonFmiON6tbR5lmQ+lzdHYYWbyNauYi+Fs0bnN5nCE1kp0DasLMRA==
          X-SG-EID u001.B3LYw0NprumTN6JEy3AAkeJfECRd017jabd2pPRejJIex0Yo0IKmo9IhVsmwln9nNxML8rjyRuByqRgVAvq7w10DhUYV24qT5wU03+uQkWqKxpCpDcRPW6c9VaY7GTWzWRsavbD5VL0WwqwWPHRyA2H3yJjKrHs5clQvozNHSOFB7QcI+iabXpnEDunIKSP1FDZH6iR7xAIwjY4rVKcsAE5W8uDkfn827ViZFWdeU9xmznMHvsPE/X/YCQjlNQ9Fq3Efdd8/R7VolH8ae1CFIu29MryU2XYbrgBUJikkO7M=
          X-Entity-IDu001.cm2fyd4f648f2mJLuWZZAA==
          X-Cloudmark-Trackerv=2.4 cv=IqfVc6/g c=1 sm=1 tr=0 ts=67ccc716 b=1 cx=a_idp_d a=SX/qHkiwMAyfMaBIrEnGfg==:117 a=SX/qHkiwMAyfMaBIrEnGfg==:17 a=YOPK0i2xdaerViwT:21 a=Vs1iUdzkB0EA:10 a=GYNJNCkMMaEA:10 a=mfME2mdEJfMA:10 a=V2p9s2bUAAAA:8 a=SeT8-YqtAAAA:8 a=CjxXgO3LAAAA:8 a=KPb-humwnmALI6FJnvIA:9 a=ZyoC9iuhgnMp8nfH:21 a=_W_S_7VecoQA:10 a=QEXdDO2ut3YA:10 a=_B9hD41s0cwA:10 a=Hh3LwlnKEGHl6qqxw-UQ:22
          X-USANET-SpamSbulk
          X-LASED-VersionAntispam-Engine: 5.1.4, AntispamData: 2025.3.8.214228
          X-LASED-SpamProbability0.087066
          X-LASED-SpamNonSpam
          X-LASED-HitsBODYTEXTH_SIZE_10000_LESS 0.000000, BODYTEXTH_SIZE_3000_MORE 0.000000, BODY_SIZE_6000_6999 0.000000, BODY_SIZE_7000_LESS 0.000000, BULK_EMAIL_SENDER 0.000000, DKIM_ALIGNS 0.000000, DKIM_SIGNATURE 0.000000, ECARD_KNOWN_DOMAINS 0.000000, FROM_NAME_PHRASE 0.000000, HREF_LABEL_TEXT_ONLY 0.000000, HTML_90_100 0.100000, HTML_FONT_INVISIBLE 0.100000, LEGITIMATE_SIGNS 0.000000, LINK_TO_IMAGE 0.000000, MIME_HTML_ONLY_MP_MIXED 0.050000, OBFUSCATION 0.000000, SENDER_NO_AUTH 0.000000, SUPERLONG_LINE 0.050000, SXL_IP_TFX_ESP 0.000000, TO_NAME_IS_ADDY 0.000000, __ANY_URI 0.000000, __ATTACH_CTE_QUOTED_PRINTABLE 0.000000, __BODY_NO_MAILTO 0.000000, __BODY_TEXT_X4 0.000000, __CP_URI_IN_BODY 0.000000, __CT 0.000000, __CTYPE_HAS_BOUNDARY 0.000000, __CTYPE_MULTIPART 0.000000, __CTYPE_MULTIPART_MIXED 0.000000, __DKIM_ALIGNS_1 0.000000, __DKIM_ALIGNS_2 0.000000, __FRAUD_BODY_WEBMAIL 0.000000, __FRAUD_URGENCY 0.000000, __FRAUD_WEBMAIL 0.000000, __FROM_3RD_PARTY 0.000000, __FROM_ADDY_SHORT_LC 0.000000, __FROM_NAME_NOT_IN_ADDR 0.000000, __FROM_NAME_NOT_IN_BODY 0.000000, __FUR_HEADER 0.000000, __FUR_RDNS_SENDGRID 0.000000, __HAS_FROM 0.000000, __HAS_HTML 0.000000, __HAS_MSGID 0.000000, __HIGHBIT_ASCII_MIX 0.000000, __HREF_LABEL_TEXT 0.000000, __HREF_LABEL_URI 0.000000, __HTML_AHREF_TAG 0.000000, __HTML_ENTITIES_X4 0.000000, __HTML_HREF_TAG_X2 0.000000, __HTML_TAG_DIV 0.000000, __HTML_TAG_IMG_X2 0.000000, __HTML_TAG_TABLE 0.000000, __HTTPS_URI 0.000000, __HTTP_IMAGE_TAG 0.000000, __ID_RETURN_PATH 0.000000, __IMG_THEN_TEXT 0.000000, __INVOICE_MULTILINGUAL 0.000000, __LETTER_HEX_MIX 0.000000, __MIME_HTML 0.000000, __MIME_HTML_ONLY 0.000000, __MIME_TEXT_H 0.000000, __MIME_TEXT_H1 0.000000, __MIME_TEXT_H2 0.000000, __MIME_VERSION 0.000000, __MSGID_DOMAIN_NOT_IN_HDRS 0.000000, __MSGID_HOMEUSER 0.000000, __MULTIPLE_URI_HTML 0.000000, __MULTIPLE_URI_TEXT 0.000000, __PART_TYPE_HTML 0.000000, __RATWARE_SIGNATURE_3_N1 0.000000, __SANE_MSGID 0.000000, __SENDGRID_RCVD 0.000000, __SENDGRID_RCVD_SG_ESMTP 0.000000, __SUBJ_ALPHA_END 0.000000, __TAG_EXISTS_BODY 0.000000, __TAG_EXISTS_HTML 0.000000, __TO_MALFORMED_2 0.000000, __TO_NAME 0.000000, __TO_NO_NAME 0.000000, __URI_HAS_HYPHEN_USC 0.000000, __URI_HREF_DIFF_LABEL 0.000000, __URI_IN_BODY 0.000000, __URI_MAILTO 0.000000, __URI_NOT_IMG 0.000000, __URI_NS 0.000000, __URI_WITHOUT_PATH 0.000000, __URI_WITH_PATH 0.000000
          X-LASED-ImpersonationFalse
          X-LASED-MailTypeBULK
          X-Sophos-Tracker0.087066 c1a73f0575d6eed94f88290848b079f6e66a8c4e
          X-BAEAI-Source-GeoIP"US" "N/A" "N/A"
          X-BAEAI-SPFPASS
          X-BAEAI-DKIMPASS
          X-BAEAI-DMARCpass
          X-SilverSky-ARCnone
          X-BAEAI-Authentication-Ratingstrong
          X-BAEAI-Trust-Levelgreen
          Return-Path bounces+526498-6337-loanservicing=firstfedweb.com@em5377.hq.bill.com
          X-MS-Exchange-Organization-ExpirationStartTime08 Mar 2025 22:39:46.3060 (UTC)
          X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
          X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
          X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
          X-MS-Exchange-Organization-Network-Message-Id 5c2e1917-4819-4927-180a-08dd5e9220af
          X-EOPAttributedMessage0
          X-EOPTenantAttributedMessage3778f0b2-789a-4d43-b25e-d4fe25a4c3c0:0
          X-MS-Exchange-Organization-MessageDirectionalityIncoming
          x-ms-publictraffictypeEmail
          X-MS-TrafficTypeDiagnostic BN3PEPF0000B070:EE_|LV8PR22MB5551:EE_|PH0PR22MB2487:EE_
          x-ms-exchange-organization-authsource BN3PEPF0000B070.namprd21.prod.outlook.com
          x-ms-exchange-organization-authasAnonymous
          X-MS-Office365-Filtering-Correlation-Id 5c2e1917-4819-4927-180a-08dd5e9220af
          X-MS-Exchange-AtpMessagePropertiesSA|SL
          X-MS-Exchange-Organization-SCL-1
          X-MS-Exchange-Organization-BypassClutter$true
          X-Microsoft-Antispam BCL:0;ARA:13230040|3072899012|29132699027|12012899012|69100299015|82310400026|5073199012|2092899012|13003099007|4076899003|8096899003;
          X-Forefront-Antispam-Report CIP:165.212.64.14;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:NSPM;H:postin01.mbox.net;PTR:postin01.mbox.net;CAT:NONE;SFS:(13230040)(3072899012)(29132699027)(12012899012)(69100299015)(82310400026)(5073199012)(2092899012)(13003099007)(4076899003)(8096899003);DIR:INB;
          X-MS-Exchange-CrossTenant-OriginalArrivalTime08 Mar 2025 22:39:46.0716 (UTC)
          X-MS-Exchange-CrossTenant-Network-Message-Id 5c2e1917-4819-4927-180a-08dd5e9220af
          X-MS-Exchange-CrossTenant-Id3778f0b2-789a-4d43-b25e-d4fe25a4c3c0
          X-MS-Exchange-CrossTenant-AuthSource BN3PEPF0000B070.namprd21.prod.outlook.com
          X-MS-Exchange-CrossTenant-AuthAsAnonymous
          X-MS-Exchange-CrossTenant-FromEntityHeaderInternet
          X-MS-Exchange-Transport-CrossTenantHeadersStampedLV8PR22MB5551
          X-MS-Exchange-Transport-EndToEndLatency00:00:05.2154929
          X-MS-Exchange-Processed-By-BccFoldering15.20.8534.017
          X-Microsoft-Antispam-Mailbox-Delivery ucf:0;jmr:0;auth:0;dest:I;ENG:(910005)(944506478)(944626604)(4710117)(4712020)(920097)(930097)(140003);
          X-Microsoft-Antispam-Message-Info NxKmwOT3gwQqakYDj9K6abJLrTkt5OwnRZfMQVZKJ/VB24YEP+/3/BcyPmQHpbMUEH2GClyqpfvvqdpDPGcodwbEhzf0/qAV8fHoeb05q2mt9qkWQo9chJ0mEUHS0WaBn/GJ7sUva/VjPwUh8T/TTpmA5LjBeI4qqwrjGrWNGN7homAoTtkxzzOLep4Z5uhjhgzZ3JJ8aL4YArfy9hAi44nu7JZqDK1TlFukh95xh1Mf237AtmNFOWgNyqRYQy4DfkB5AWYIV/M23g3JhVq7TtPGOMPHAIPfHZH1oqCXgXSObRqFYm7ImL6lKKMyt8vxgO9aSeS7ek5helc1Z0CgncexiU4nGiBWot0s1DTrQt8UsyH++lbv+ezjgM0RHJqihhPPme5B3VJV0HQiUiWBNNU7M4WsjcUnIvjZYnMcvBrcj6/rGUzYvksTRR+J7com6j30mVodgtWMckz0+RM9sK1q+To8vGZvJTqFEeedoUUn2SXNCO8kw6w3dNwRjrORPLQA0Y1nhLR4TsP2KNTzAnnqEGT+aSy9Lp3+P4SxzlXRyVKADD8VjnptNzG4rVFWSgGh9b2dRdtBe/f1BDEIGnJyBes4z/l4MUy1+GcRkma2GXMgsGnR0gpz4fg8vBmH6JJaRG12klYy4JCb+wxujUGui5L3xrl6dzddfkHLsGyVBe43sxEGiVAMfdfYqskAD/ce50y5zYKcbAU/vncGYwm97eo5LKgHQ22uV19a8S9O+BkqUS0rh1b+xyU1mCy6zLP34v3PQoI2eI5Np5Xa7p24z+DJW299dlX6PnnxMqB+1W4j1kn3GSaKxpzlQk5+Ljk0zzZYQGvK6glK0TYmtWHawhHryp7i80Qzv5ydWQtb+BEGZpZFbRS2W1QXTUbg8WHTTFmfscUoISGpFYKkQmkvRNH9OlgouNLYgo/vj63pFtgCTBVyjfWRWEVDrsXU9RzGEoRHchb0bzU+v3/jwiRkH/Tcjr5eJ86XUqSm3LrwkS0oQj74hAzvne4SYp8tzO7jsf88HJaLbqBxveKwTEfML4FoCXQG99JEcrzo4b6eMxpjNODOScHJ9VwSvpLDt0JoR2rjtlqKkukGferSCMEhz+K+92rD/eD7koIiyYvipAJVPQTSV10Ya7QXj4q6GRTCwAskqTo8MsEn0EN5WWMSO7okjrbk9eKXAfNhHy7k7gsF0nDDmsdKkRpmGYw5zDnPUPt9AipOwus+CvRNvSgSyT0T7GBrPkOWRLF+te9iWOER9Q73HZog+QgPp5qSBYU4FUgI/HuoGTZ4TSRIKR3padn8fujho+mxoUG2WaMrPars4HvnG4K952jyuVCYb+HuLb81QrJHVAzheDBhFOjHCGs5Cn3xgL1bi9Ib+ROTW4a1+tZntetp8fF7MyBPY0hDtii74Nlq2ZjYHOST3VNRO08Xma8MExo7YIe+o8ck2J3KCeQeCfXcohkbCmSnX9x9kuXlEKp/rX6AEeNaOm2v/DPbRKjoBziIWtN/XHX4n1MYqZNdmokwMqkXjKxWI9PNvZGnKTZFuWY4mYvLhQJprGrCSjsLT8rJSd49AAvBK9iFWZILGjXtN6ropshSFPHc185bsvU+Bvcue3cHsTn1pASEJ7q8E5rcHH3GErQhb5j4l5guIMHFwMeNCSWqPR1qGLLaHNTXiy5oDT0BDU/WKQGWPIA7Rstd3DMGgXAALyom7/43E9f6WJXGQCA36MOOyVQtPya698EOiJkI4yDzNQ8m2yPg5sTfiPi7YbvDXlXmDI76hr0Hs5I/jg3iL8kvaTBMwpc3oukD52ScAnryKj83IcVkHdhd98rlyqD/okKTjfJRRax/GzzqQNSSoT8h5T5QtWKSSTPvXspM2MoG2ncCEK1lFCX5VvdWuEGT2ddh6Svcs4+G21oKiJywWmimiAidUbyyHyOJLnNrck/ZCrWPN1vJt9pviHAoQg+Gj8bYKp6x2Suog0VTMzdWKg6y3PSm1Px2/LZeYAGYajAACmBjod37ysF8OzBKH/IaZp1kGo85gvsoNAIdaxGUdYtWAjBQqkAOfbIgqrG5Cvyg/cyjUyTcDJH/3adAnlkvAp4Yg5s/fpFVynXIaHxAKgeEov50/wTHlh0U8EINsRJ76kvdx4IgStVPLb7/wl3zzEUf8+XCSflKFrigFkFNaqTeWdasLadlwwONMsx4o4idfmvAZVwYWii5Dj6WLEWxAOhgmgWqMvn2BO3ygViids+KjVn1EuLg13UwZcxIi7lG0AGDKf/ThUkMcROAHz4=
          x-ms-exchange-organization-originalclientipaddress165.212.64.14
          x-ms-exchange-organization-originalserveripaddress10.167.243.75
          X-Priority3
          X-MSMail-PriorityNormal
          Thread-IndexAQHbkHsBMKqsQ6MTNk2tdnS5UGcVZg==
          Message-ID <1314503140.349.1741473555450@ip-10-128-201-225.us-west-1.compute.internal>
          From"Lukle Cleveland on behalf of WEST COAST LIFT INC." <invites@hq.bill.com>
          ToLoan Servicing <LoanServicing@firstfedweb.com>
          SubjectWEST COAST LIFT INC. wants to pay you
          DateSat, 08 Mar 2025 15:39:15 -0700
          MIME-Version1.0
          Content-typeMultipart/alternative; charset="utf-8"; boundary="00B0FEED_message_boundary"
          Content-DescriptionMultipart message

          File Icon

          Icon Hash:46070c0a8e0c67d6