Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
original (2).eml

Overview

General Information

Sample name:original (2).eml
Analysis ID:1640938
MD5:c5f449000ffab5ae9bc32a3e4614ea76
SHA1:c174c66215ff3e94f878843c938e479c444fe0db
SHA256:553ebc2e1c7a6ed03ec6cdb0df5be7f60ad28e033b396d04ae36e5423bce0c4d
Infos:

Detection

Score:48
Range:0 - 100
Confidence:100%

Signatures

AI detected suspicious Javascript
AI detected suspicious elements in Email content
Creates files inside the system directory
Deletes files inside the Windows folder
Detected suspicious crossdomain redirect
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores large binary data to the registry

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 7024 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original (2).eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 7156 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "C8DC6384-3A0B-426B-8760-C7F8DC604A86" "95BBAE79-6410-4E7F-A7B0-1FF9DF940318" "7024" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • OUTLOOK.EXE (PID: 6536 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7D5VXBYN\phish_alert_iocp_v1.4.85.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • chrome.exe (PID: 6656 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.com/url?hl=en&q=https://cdn.ampproject.org/c/s/dai1vzajkb.p%25c2%25adu%25C2%25adt%25C2%25ADr%25C2%25Adp%25C2%25ADo%25C2%25Adt%25c2%25adh%25C2%25aDm%25c2%25aDw%25c2%25ADe%25C2%25adr%25C2%25ADo%25C2%25aDr%25C2%25aDp%25c2%25adiw.t%25E2%2580%258bop%25E2%2580%258B%25E2%2580%258B/y2TYDIZDf&source=gmail&ust=1742307258851000&usg=AOvVaw2GgUzI0hp2jnZrbCF192Lv&LtfWxQqmrRSGf=MVTqSyHMki&JWbYjMpGB=iOSznYK&sIEKwEPjJiYw=ibQinnVwBu&BPkNYjbo=jILTWBcexOfcPwj&cuCoqckCZU=JJBfUKXheHPA&AwNCDi=PtROASWZhakuofg&PQoWKvrRr=roohznaOp&rqUwXvE=GcSfNGrMzVkLSzS&QtKuvWMoLiTSs=rJaGmQxqY&GoiSqFtcFyQUd=skLuWTpZuxeVu&WBlHgoKfBm=uxKbOQLTTECfim&CLagPILMHCaAR=xdswEZhoNqvOX&navhvgpnQg=ONXVKVjKH&uaaoQIrvhbZR=https://HQIOnJwkRcNfdR&pygAZxjSA=cGqHEKBg&MLdRMa=DQoyvELfJx&CELnAYgGvfGE=hiRTITUMwqjfHsb&aYXzjuNZs=vDJTADq&zZBBJRM=gRqAsccEFxeNi&ulDWzDukgBx=WzasrvbeuiJsVqh&HvvphPGs=XNLKzAXQbGax&cwvFccS=YyyAvkHxpvwHcI&DzMPlvyNlvOL=OKzNITUK MD5: E81F54E6C1129887AEA47E7D092680BF)
      • chrome.exe (PID: 6204 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,2454400271209340085,3763998520828507470,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7024, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected suspicious Javascript
Source: 0.0..script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://37pj6q4eh7dxt5finjn4afsirfm7h3uyt3mjp3jzqm... This script demonstrates high-risk behavior by using obfuscated code to redirect the user to a suspicious domain, which is a common tactic in phishing and malware attacks. The use of `location.replace()` to redirect the user, combined with the heavily encoded URL, indicates a strong likelihood of malicious intent.
AI detected suspicious elements in Email content
Source: EmailJoe Sandbox AI: Detected potential phishing email: Contains suspicious obfuscated/encoded URLs with unusual patterns and random-looking domains (e.g., rvkqovku2797.com). Mismatched sender domain (firstontario.com) with newsletter subscription content and suspicious recipient domain (phisher.knowbe4.com). Uses common phishing tactics like fake confirmation buttons and social media links leading to suspicious domains
Source: EmailClassification: Credential Stealer
Source: unknownHTTPS traffic detected: 142.250.184.228:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 216.58.206.33:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.13.45:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.13.45:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: chrome.exeMemory has grown: Private usage: 1MB later: 39MB
Source: C:\Program Files\Google\Chrome\Application\chrome.exeHTTP traffic: Redirect from: www.google.com to https://cdn.ampproject.org/c/s/dai1vzajkb.p%c2%adu%c2%adt%c2%adr%c2%adp%c2%ado%c2%adt%c2%adh%c2%adm%c2%adw%c2%ade%c2%adr%c2%ado%c2%adr%c2%adp%c2%adiw.t%e2%80%8bop%e2%80%8b%e2%80%8b/y2tydizdf
Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /url?hl=en&q=https://cdn.ampproject.org/c/s/dai1vzajkb.p%25c2%25adu%25C2%25adt%25C2%25ADr%25C2%25Adp%25C2%25ADo%25C2%25Adt%25c2%25adh%25C2%25aDm%25c2%25aDw%25c2%25ADe%25C2%25adr%25C2%25ADo%25C2%25aDr%25C2%25aDp%25c2%25adiw.t%25E2%2580%258bop%25E2%2580%258B%25E2%2580%258B/y2TYDIZDf&source=gmail&ust=1742307258851000&usg=AOvVaw2GgUzI0hp2jnZrbCF192Lv&LtfWxQqmrRSGf=MVTqSyHMki&JWbYjMpGB=iOSznYK&sIEKwEPjJiYw=ibQinnVwBu&BPkNYjbo=jILTWBcexOfcPwj&cuCoqckCZU=JJBfUKXheHPA&AwNCDi=PtROASWZhakuofg&PQoWKvrRr=roohznaOp&rqUwXvE=GcSfNGrMzVkLSzS&QtKuvWMoLiTSs=rJaGmQxqY&GoiSqFtcFyQUd=skLuWTpZuxeVu&WBlHgoKfBm=uxKbOQLTTECfim&CLagPILMHCaAR=xdswEZhoNqvOX&navhvgpnQg=ONXVKVjKH&uaaoQIrvhbZR=https://HQIOnJwkRcNfdR&pygAZxjSA=cGqHEKBg&MLdRMa=DQoyvELfJx&CELnAYgGvfGE=hiRTITUMwqjfHsb&aYXzjuNZs=vDJTADq&zZBBJRM=gRqAsccEFxeNi&ulDWzDukgBx=WzasrvbeuiJsVqh&HvvphPGs=XNLKzAXQbGax&cwvFccS=YyyAvkHxpvwHcI&DzMPlvyNlvOL=OKzNITUK HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.X-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /c/s/dai1vzajkb.p%c2%adu%C2%adt%C2%ADr%C2%Adp%C2%ADo%C2%Adt%c2%adh%C2%aDm%c2%aDw%c2%ADe%C2%adr%C2%ADo%C2%aDr%C2%aDp%c2%adiw.t%E2%80%8bop%E2%80%8B%E2%80%8B/y2TYDIZDf HTTP/1.1Host: cdn.ampproject.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /c/s/dai1vzajkb.p%C2%ADu%C2%ADt%C2%ADr%C2%ADp%C2%ADo%C2%ADt%C2%ADh%C2%ADm%C2%ADw%C2%ADe%C2%ADr%C2%ADo%C2%ADr%C2%ADp%C2%ADiw.t%E2%80%8Bop%E2%80%8B%E2%80%8B/y2TYDIZDf HTTP/1.1Host: 37pj6q4eh7dxt5finjn4afsirfm7h3uyt3mjp3jzqm4x53yiuk7a.cdn.ampproject.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Browser-Channel: stableX-Browser-Year: 2025X-Browser-Validation: wTKGXmLo+sPWz1JKKbFzUyHly1Q=X-Browser-Copyright: Copyright 2025 Google LLC. All rights reserved.Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /y2TYDIZDf HTTP/1.1Host: dai1vzajkb.putrpothmwerorpiw.topConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://37pj6q4eh7dxt5finjn4afsirfm7h3uyt3mjp3jzqm4x53yiuk7a.cdn.ampproject.org/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: cdn.ampproject.org
Source: global trafficDNS traffic detected: DNS query: 37pj6q4eh7dxt5finjn4afsirfm7h3uyt3mjp3jzqm4x53yiuk7a.cdn.ampproject.org
Source: global trafficDNS traffic detected: DNS query: dai1vzajkb.putrpothmwerorpiw.top
Source: global trafficDNS traffic detected: DNS query: wjak.1loms8mxr2scry5yj.com
Source: global trafficDNS traffic detected: DNS query: google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49673
Source: unknownNetwork traffic detected: HTTP traffic on port 49679 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49671 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownHTTPS traffic detected: 142.250.184.228:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 216.58.206.33:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.13.45:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.13.45:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\scoped_dir6656_389474121
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile deleted: C:\Windows\SystemTemp\scoped_dir6656_389474121
Source: classification engineClassification label: mal48.winEML@31/6@25/190
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250317T1647470029-7024.etl
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original (2).eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "C8DC6384-3A0B-426B-8760-C7F8DC604A86" "95BBAE79-6410-4E7F-A7B0-1FF9DF940318" "7024" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7D5VXBYN\phish_alert_iocp_v1.4.85.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "C8DC6384-3A0B-426B-8760-C7F8DC604A86" "95BBAE79-6410-4E7F-A7B0-1FF9DF940318" "7024" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.com/url?hl=en&q=https://cdn.ampproject.org/c/s/dai1vzajkb.p%25c2%25adu%25C2%25adt%25C2%25ADr%25C2%25Adp%25C2%25ADo%25C2%25Adt%25c2%25adh%25C2%25aDm%25c2%25aDw%25c2%25ADe%25C2%25adr%25C2%25ADo%25C2%25aDr%25C2%25aDp%25c2%25adiw.t%25E2%2580%258bop%25E2%2580%258B%25E2%2580%258B/y2TYDIZDf&source=gmail&ust=1742307258851000&usg=AOvVaw2GgUzI0hp2jnZrbCF192Lv&LtfWxQqmrRSGf=MVTqSyHMki&JWbYjMpGB=iOSznYK&sIEKwEPjJiYw=ibQinnVwBu&BPkNYjbo=jILTWBcexOfcPwj&cuCoqckCZU=JJBfUKXheHPA&AwNCDi=PtROASWZhakuofg&PQoWKvrRr=roohznaOp&rqUwXvE=GcSfNGrMzVkLSzS&QtKuvWMoLiTSs=rJaGmQxqY&GoiSqFtcFyQUd=skLuWTpZuxeVu&WBlHgoKfBm=uxKbOQLTTECfim&CLagPILMHCaAR=xdswEZhoNqvOX&navhvgpnQg=ONXVKVjKH&uaaoQIrvhbZR=https://HQIOnJwkRcNfdR&pygAZxjSA=cGqHEKBg&MLdRMa=DQoyvELfJx&CELnAYgGvfGE=hiRTITUMwqjfHsb&aYXzjuNZs=vDJTADq&zZBBJRM=gRqAsccEFxeNi&ulDWzDukgBx=WzasrvbeuiJsVqh&HvvphPGs=XNLKzAXQbGax&cwvFccS=YyyAvkHxpvwHcI&DzMPlvyNlvOL=OKzNITUK
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,2454400271209340085,3763998520828507470,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7D5VXBYN\phish_alert_iocp_v1.4.85.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.com/url?hl=en&q=https://cdn.ampproject.org/c/s/dai1vzajkb.p%25c2%25adu%25C2%25adt%25C2%25ADr%25C2%25Adp%25C2%25ADo%25C2%25Adt%25c2%25adh%25C2%25aDm%25c2%25aDw%25c2%25ADe%25C2%25adr%25C2%25ADo%25C2%25aDr%25C2%25aDp%25c2%25adiw.t%25E2%2580%258bop%25E2%2580%258B%25E2%2580%258B/y2TYDIZDf&source=gmail&ust=1742307258851000&usg=AOvVaw2GgUzI0hp2jnZrbCF192Lv&LtfWxQqmrRSGf=MVTqSyHMki&JWbYjMpGB=iOSznYK&sIEKwEPjJiYw=ibQinnVwBu&BPkNYjbo=jILTWBcexOfcPwj&cuCoqckCZU=JJBfUKXheHPA&AwNCDi=PtROASWZhakuofg&PQoWKvrRr=roohznaOp&rqUwXvE=GcSfNGrMzVkLSzS&QtKuvWMoLiTSs=rJaGmQxqY&GoiSqFtcFyQUd=skLuWTpZuxeVu&WBlHgoKfBm=uxKbOQLTTECfim&CLagPILMHCaAR=xdswEZhoNqvOX&navhvgpnQg=ONXVKVjKH&uaaoQIrvhbZR=https://HQIOnJwkRcNfdR&pygAZxjSA=cGqHEKBg&MLdRMa=DQoyvELfJx&CELnAYgGvfGE=hiRTITUMwqjfHsb&aYXzjuNZs=vDJTADq&zZBBJRM=gRqAsccEFxeNi&ulDWzDukgBx=WzasrvbeuiJsVqh&HvvphPGs=XNLKzAXQbGax&cwvFccS=YyyAvkHxpvwHcI&DzMPlvyNlvOL=OKzNITUK
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,2454400271209340085,3763998520828507470,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935} DeviceTicket
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation21
Browser Extensions		1
Process Injection		11
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Modify Registry		LSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable Media1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
Extra Window Memory Injection		1
Process Injection		Security Account Manager13
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture3
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
File Deletion		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Extra Window Memory Injection		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://cdn.ampproject.org/c/s/dai1vzajkb.p%c2%adu%C2%adt%C2%ADr%C2%Adp%C2%ADo%C2%Adt%c2%adh%C2%aDm%c2%aDw%c2%ADe%C2%adr%C2%ADo%C2%aDr%C2%aDp%c2%adiw.t%E2%80%8bop%E2%80%8B%E2%80%8B/y2TYDIZDf0%Avira URL Cloudsafe
https://dai1vzajkb.putrpothmwerorpiw.top/y2TYDIZDf0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
google.com
142.251.36.78
truefalse
    		high
    dai1vzajkb.putrpothmwerorpiw.top
    		104.21.13.45
    		truefalse
      		unknown
      www.google.com
      		142.250.184.228
      		truefalse
        		high
        s-0005.dual-s-msedge.net
        		52.123.128.14
        		truefalse
          		high
          cdn-content.ampproject.org
          		142.250.186.129
          		truefalse
            		high
            wjak.1loms8mxr2scry5yj.com
            		unknown
            		unknownfalse
              		high
              cdn.ampproject.org
              		unknown
              		unknownfalse
                		high
                37pj6q4eh7dxt5finjn4afsirfm7h3uyt3mjp3jzqm4x53yiuk7a.cdn.ampproject.org
                		unknown
                		unknownfalse
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  https://dai1vzajkb.putrpothmwerorpiw.top/y2TYDIZDffalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://37pj6q4eh7dxt5finjn4afsirfm7h3uyt3mjp3jzqm4x53yiuk7a.cdn.ampproject.org/c/s/dai1vzajkb.p%C2%ADu%C2%ADt%C2%ADr%C2%ADp%C2%ADo%C2%ADt%C2%ADh%C2%ADm%C2%ADw%C2%ADe%C2%ADr%C2%ADo%C2%ADr%C2%ADp%C2%ADiw.t%E2%80%8Bop%E2%80%8B%E2%80%8B/y2TYDIZDffalse
                    		unknown
                    https://cdn.ampproject.org/c/s/dai1vzajkb.p%c2%adu%C2%adt%C2%ADr%C2%Adp%C2%ADo%C2%Adt%c2%adh%C2%aDm%c2%aDw%c2%ADe%C2%adr%C2%ADo%C2%aDr%C2%aDp%c2%adiw.t%E2%80%8bop%E2%80%8B%E2%80%8B/y2TYDIZDffalse
                    • Avira URL Cloud: safe
                    		unknown

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    142.250.184.195
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    1.1.1.1
                    		unknownAustralia
                    		13335CLOUDFLARENETUSfalse
                    173.194.76.84
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    216.58.206.33
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    52.109.89.119
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    52.123.128.14
                    		s-0005.dual-s-msedge.netUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    216.58.206.35
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    20.189.173.17
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    8.8.8.8
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    52.109.32.38
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    142.250.186.129
                    		cdn-content.ampproject.orgUnited States
                    		15169GOOGLEUSfalse
                    52.109.28.47
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    142.250.185.142
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    142.250.186.142
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    104.21.13.45
                    		dai1vzajkb.putrpothmwerorpiw.topUnited States
                    		13335CLOUDFLARENETUSfalse
                    142.250.186.110
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    2.16.62.186
                    		unknownEuropean Union
                    		20940AKAMAI-ASN1EUfalse
                    142.250.184.228
                    		www.google.comUnited States
                    		15169GOOGLEUSfalse
                    23.60.203.209
                    		unknownUnited States
                    		16625AKAMAI-ASUSfalse
                    142.250.186.99
                    		unknownUnited States
                    		15169GOOGLEUSfalse

                    Private

                    IP
                    192.168.2.16

                    General Information

                    Joe Sandbox version:42.0.0 Malachite
                    Analysis ID:1640938
                    Start date and time:2025-03-17 21:47:18 +01:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:defaultwindowsinteractivecookbook.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:20
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • EGA enabled
                    Analysis Mode:stream
                    Analysis stop reason:Timeout
                    Sample name:original (2).eml
                    Detection:MAL
                    Classification:mal48.winEML@31/6@25/190
                    Cookbook Comments:
                    • Found application associated with file extension: .eml

                    Warnings

                    • Exclude process from analysis (whitelisted): svchost.exe
                    • Excluded IPs from analysis (whitelisted): 23.60.203.209, 52.109.28.47, 2.16.62.186, 2.16.62.187, 52.109.32.38, 52.109.32.39, 52.109.32.46, 52.109.32.47, 52.123.128.14
                    • Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, fs.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, eur.roaming1.live.com.akadns.net, osiprod-uks-buff-azsc-000.uksouth.cloudapp.azure.com, roaming.officeapps.live.com, prod1.naturallanguageeditorservice.osi.office.net.akadns.net, dual-s-0005-office.config.skype.com, uks-azsc-000.roaming.officeapps.live.com, nleditor.osi.office.net, prod-eu-resolver.naturallanguageeditorservice.osi.office.net.akadns.net, ecs.office.trafficmanager.net, prod.fs.microsoft.com.akadns.net, c.pki.goog, omex.cdn.office.net.akamaized.net, a1864.dscd.akamai.net
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size getting too big, too many NtOpenFile calls found.
                    • Report size getting too big, too many NtQueryAttributesFile calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • Report size getting too big, too many NtReadVirtualMemory calls found.
                    • Report size getting too big, too many NtSetValueKey calls found.
                    • VT rate limit hit for: dai1vzajkb.putrpothmwerorpiw.top

                    Created / dropped Files

                    C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250317T1647470029-7024.etl

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:modified
                    Size (bytes):122880
                    Entropy (8bit):4.5318907258519765
                    Encrypted:false
                    SSDEEP:
                    MD5:CD46D692BF80C1E989D4B61B47339967
                    SHA1:561CA6C835A46AB559ACC38DDB18010C8FE202F2
                    SHA-256:A7DAD7C1E470AFFD2912D7964500129A356D5981EAEABB077F6381EC3AA94588
                    SHA-512:D540DBCAB6F928344DEEBC2093C5E242A102123149CF997710647728ED2F435FDD39A7BC778843669B4BC67F8302842769630094ED2FC9628B413C45881D0C38
                    Malicious:false
                    Reputation:unknown
                    Preview:............................................................................`...t...p.......}...................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1..............................................................|3...............}...........v.2._.O.U.T.L.O.O.K.:.1.b.7.0.:.3.e.2.8.3.5.4.1.d.0.4.d.4.3.b.e.a.9.7.a.b.b.7.7.3.0.e.0.8.e.e.6...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.5.0.3.1.7.T.1.6.4.7.4.7.0.0.2.9.-.7.0.2.4...e.t.l.......P.P.t...p.......}...........................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250317T1647580346-6536.etl

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):16384
                    Entropy (8bit):3.58525596986479
                    Encrypted:false
                    SSDEEP:
                    MD5:B763D1BE669D04F320EC6D5C6C01F54E
                    SHA1:9EB51DCD2459F578482E010C8CABF4B239049E52
                    SHA-256:42D6EA1420CC3D87BBD1E15D91FF3788B4C4CB8DEF9774CF9A5A8B2F39E15625
                    SHA-512:F66EDC40B4D7CC75F0E1CEEC626EE71095D6F08D9AC805C4D1293B511F3D054065B87D9187576E8969AEF30F525CD44AD47C569F998B0EDC933A337E8ABDCBCC
                    Malicious:false
                    Reputation:unknown
                    Preview:............................................................................`............~..}...................eJ.......B..}...Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1..............................................................|3............~..}...........v.2._.O.U.T.L.O.O.K.:.1.9.8.8.:.a.c.4.a.5.c.c.3.d.e.0.c.4.c.1.e.9.5.c.2.e.6.7.0.f.0.4.5.5.7.d.5...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.5.0.3.1.7.T.1.6.4.7.5.8.0.3.4.6.-.6.5.3.6...e.t.l.......P.P..........~..}...........................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\olk9258.tmp

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:ASCII text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):18263
                    Entropy (8bit):5.9288469312641245
                    Encrypted:false
                    SSDEEP:
                    MD5:D4F971145A0FC290C91E3C1BE9924CA0
                    SHA1:2B3ADF4EFED6496F5B4AC79C27BFB1DCF9717901
                    SHA-256:ECC2BBC213DED9910967B7FAC8E7CC8414FE967292E80789F79252017C5E72EE
                    SHA-512:02AA1ED642585391D2BA652A45A7C5F99E778170EF3D4DAB0833E5656954E7B74E2832607FB7720DF95F7BCC846FDFB2FBEC8DCD134D0B24EC9F6F1A6C6DC6EC
                    Malicious:false
                    Reputation:unknown
                    Preview:b41L59+3784x//5V/+5aOPPrpq1aqSkpIPwrabbbrnnnseeuihuXPn..Jh8ZRyKRefPmff3rXw+csnPnzi4pRdXQ0PDv//7vgf0iBg8e/J3vfCeZ2dATJ0785je/Gfgo..HTt2bMuWLWkPKS8v7xvf+EaLqWizIUOG3HfffYHG8vLyf/3Xf4399pCbm/uXf/mXLaaizQYP..HvzlL3850Hj69Okki7MdOXLkxRdfDDTOmzfvv//3/36pVLRZJBJZvHjxH//xHwfaX3/99cSv..9OQNHTr0r//6r1tMRZt179797rvvHj9+fKB97dq1XfuhE4wCAACQgnPnzj3//POJ7RMnTkyj..t8997nOtJxEdK3HBe+Juoa2rra3dtm1boLH1evQxY8eOTS/8HTFixJ133hlofPPNN5M598SJ..E4mjHTt27P3339+zZ89UR9L6JqrtL8GUWHZp3Lhx6S2ODvj4xz/eyrr+ysrKrVu3Pv300w89..9NBf/dVf/eQnP1m2bNnOnTvTKwfUCcaOHZveFNcJEyYEdlZtcVPXTrBx48bAdpy5ubl/9md/..lvyPK8OHD7/rrrsCjStXrkw7Zbv77ruT+ang6quvnjp1aqCxrq4u9o/Pf/7zhYWFbXYyYcKE..xE08tm/fnsw4f/vb3wZe48SJE+++++7kv14WLFhw7bXXxrc0NDQk+ZWSKCsr60//9E/bzGRj..sWxiJltaWnrq1Kn0Lt0hBKMAAAAk6/333/+3f/u3xMCoe/fuaczsmzRpUjKRYgeaNWtWYMbc..4cOH47c6bdPWrVsDmwxeddVVyUQh7XHdddcF8sE9e/Ykc2Jg389YinHvvfe2Ob81DVOmTOnX..r198S3Fxcfz+g62LRqOJ6+jbP100JjMz82tf+1r//v3bPLK8vPztt99eunTpj3/842984xsP..PfTQk08+uWnTpiTrUH3wffzjHw8E3EneSx0oGo2++uqrgcbbbrstfn/h

                    C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:Microsoft Outlook email folder (>=2003)
                    Category:dropped
                    Size (bytes):2302976
                    Entropy (8bit):1.8707551578913786
                    Encrypted:false
                    SSDEEP:
                    MD5:CB189A1E975739A0D900C35D27100DE9
                    SHA1:543D0A34C06CEB231078DDC5778E5E704555CB8A
                    SHA-256:8CBD1D9A7078BF2758188584D09A0200536A5C899F47781342A6718BA7A8DF77
                    SHA-512:8E1C1ACA269908B950CF29E21E18F430E5667000FFA73E978FBEB50DA75A4BF7650C79F6B58A0C33924722D14FAEAAB8EE17A6DB45887070599992AD4177BA97
                    Malicious:true
                    Reputation:unknown
                    Preview:!BDN..SM......\........O..............w................@...........@...@...................................@...........................................................................$#......D.......Y..............}........D...............,..................................................................................................................................................................................................................................................................................T.........'..vp.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):524288
                    Entropy (8bit):5.673331929436221
                    Encrypted:false
                    SSDEEP:
                    MD5:9D3B0B4777EF78E6D1F6C583EE465386
                    SHA1:131334F2F13ACA785FC6B5CB34F559632AD19240
                    SHA-256:63C717DBECAA4B166FE0EC0431DBD3E11090276EEEAA2AC282A9BDAE0D699A1F
                    SHA-512:B08D57340FD8D12590CB71A14F3DCA0930707D273C2B88E12F366DB4111CABBB99A1BA7A504979AE989885A38D0ED6BFF4FC5C3CAA0C88DCAC080125751E50E0
                    Malicious:true
                    Reputation:unknown
                    Preview:...S0...........p...zB..}........$............#...........................................~..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................qL..$......0L.0...........p...zB..}........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                    Chrome Cache Entry: 70

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:HTML document, ASCII text, with CRLF, LF line terminators
                    Category:downloaded
                    Size (bytes):571
                    Entropy (8bit):5.159618675390344
                    Encrypted:false
                    SSDEEP:
                    MD5:2FCD74FD3AAAB854F294EC9E025D41A9
                    SHA1:00E20A0966E0A5287C30575993EABCC47B387465
                    SHA-256:BC4356DB1267348C17CA05EAA2B898A96FF297B1FB721E8A3405AF168DBB2848
                    SHA-512:818BD59E9617F97EF12D83ECF8E5A923BEE22921780E5F4CD3259F703508ADD11B83FABE6031A5EE0C29F9F363F9F103AEB25F0CED54261255C0D0058072E4B4
                    Malicious:false
                    Reputation:unknown
                    URL:https://37pj6q4eh7dxt5finjn4afsirfm7h3uyt3mjp3jzqm4x53yiuk7a.cdn.ampproject.org/c/s/dai1vzajkb.p%C2%ADu%C2%ADt%C2%ADr%C2%ADp%C2%ADo%C2%ADt%C2%ADh%C2%ADm%C2%ADw%C2%ADe%C2%ADr%C2%ADo%C2%ADr%C2%ADp%C2%ADiw.t%E2%80%8Bop%E2%80%8B%E2%80%8B/y2TYDIZDf
                    Preview:<HTML><HEAD>.<meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>Redirecting</TITLE>.<META HTTP-EQUIV="refresh" content="0; url=https://dai1vzajkb.p%C2%ADu%C2%ADt%C2%ADr%C2%ADp%C2%ADo%C2%ADt%C2%ADh%C2%ADm%C2%ADw%C2%ADe%C2%ADr%C2%ADo%C2%ADr%C2%ADp%C2%ADiw.t%E2%80%8Bop%E2%80%8B%E2%80%8B/y2TYDIZDf">.</HEAD>.<BODY onLoad="location.replace('https://dai1vzajkb.p%C2%ADu%C2%ADt%C2%ADr%C2%ADp%C2%ADo%C2%ADt%C2%ADh%C2%ADm%C2%ADw%C2%ADe%C2%ADr%C2%ADo%C2%ADr%C2%ADp%C2%ADiw.t%E2%80%8Bop%E2%80%8B%E2%80%8B/y2TYDIZDf'+document.location.hash)">.</BODY></HTML>..

                    Static File Info

                    General

                    File type:SMTP mail, ASCII text, with very long lines (459), with CRLF line terminators
                    Entropy (8bit):6.003217536604825
                    TrID:
                    • E-Mail message (Var. 1) (20512/2) 100.00%
                    File name:original (2).eml
                    File size:251'176 bytes
                    MD5:c5f449000ffab5ae9bc32a3e4614ea76
                    SHA1:c174c66215ff3e94f878843c938e479c444fe0db
                    SHA256:553ebc2e1c7a6ed03ec6cdb0df5be7f60ad28e033b396d04ae36e5423bce0c4d
                    SHA512:cd7c5f9df61f86c48abaa43d363c7a165788cf7dcfcd8c52c0cdca32e6a880f4335a6db23e889c7d53f4061d9382a3fd7f0cb22137bb4bf41d1f80426fcffccf
                    SSDEEP:3072:pL61ZvVHPDPw/6OHgzk9XYC90SMG6n7c0JXJWYvcxAt24I/oC:pL+ZvVHQWkiCuS+n79XQYcxf4I/oC
                    TLSH:67348D259F032E4D12307867D81E6D84CBFA475AD65309CC76DAF24B4FBCE9148B7A88
                    File Content Preview:Return-Path: <davina.macdonald@firstontario.com>..Received: from smtp.defend.email (smtp.defend.email [34.209.23.4]).. by inbound-smtp.us-east-1.amazonaws.com with SMTP id j0efc2l52d7sor30av0bnn90buv1ef1roinjq0o1.. for d7e8457b-1c59-44ac-b5fe-ee555e2d0dc3

                    Static Mail

                    General

                    Subject:[Phish Alert] FW: .Firstontario's shared ''f_irstontario_pdf_735917419'' on Monday, 17th March 2025
                    From:"MacDonald, Davina" <Davina.MacDonald@firstontario.com>
                    To:"d7e8457b-1c59-44ac-b5fe-ee555e2d0dc3@phisher.knowbe4.com" <d7e8457b-1c59-44ac-b5fe-ee555e2d0dc3@phisher.knowbe4.com>
                    Cc:
                    BCC:
                    Date:Mon, 17 Mar 2025 15:50:39 +0000
                    Communications:
                    • CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the source and know the content is safe. ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- __________________________________________________ [cid:rqUHTi] [cid:njMdNL] [cid:RzrAKu] [cid:uvvYfpwOA] <https://www.google.com/url?hl=en&q=https://cdn.ampproject.org/c/s/dai1vzajkb.p%25c2%25adu%25C2%25adt%25C2%25ADr%25C2%25Adp%25C2%25ADo%25C2%25Adt%25c2%25adh%25C2%25aDm%25c2%25aDw%25c2%25ADe%25C2%25adr%25C2%25ADo%25C2%25aDr%25C2%25aDp%25c2%25adiw.t%25E2%2580%258bop%25E2%2580%258B%25E2%2580%258B/y2TYDIZDf&source=gmail&ust=1742307258851000&usg=AOvVaw2GgUzI0hp2jnZrbCF192Lv&LtfWxQqmrRSGf=MVTqSyHMki&JWbYjMpGB=iOSznYK&sIEKwEPjJiYw=ibQinnVwBu&BPkNYjbo=jILTWBcexOfcPwj&cuCoqckCZU=JJBfUKXheHPA&AwNCDi=PtROASWZhakuofg&PQoWKvrRr=roohznaOp&rqUwXvE=GcSfNGrMzVkLSzS&QtKuvWMoLiTSs=rJaGmQxqY&GoiSqFtcFyQUd=skLuWTpZuxeVu&WBlHgoKfBm=uxKbOQLTTECfim&CLagPILMHCaAR=xdswEZhoNqvOX&navhvgpnQg=ONXVKVjKH&uaaoQIrvhbZR=https://HQIOnJwkRcNfdR&pygAZxjSA=cGqHEKBg&MLdRMa=DQoyvELfJx&CELnAYgGvfGE=hiRTITUMwqjfHsb&aYXzjuNZs=vDJTADq&zZBBJRM=gRqAsccEFxeNi&ulDWzDukgBx=WzasrvbeuiJsVqh&HvvphPGs=XNLKzAXQbGax&cwvFccS=YyyAvkHxpvwHcI&DzMPlvyNlvOL=OKzNITUK> [cid:dkqdBxCeitdxdfFRsTmK] [cid:vOOLmL] Thank you for your interest in our newsletter! [X]<https://inqtjomc2796.com/129294> Confirm your email address Please click the button below to confirm that HumNW@ICOoZvB.HumNW.com is the correct email address to receive our newsletter. Confirm your email<https://rvkqovku2797.com/370275> If you didn't subscribe, you can just delete this email. You will not be subscribed to this newsletter unless you click the confirmation button above. [linkedin]<https://nezsunqf2798.com/545207> [twitter] <https://ptdkvnir2799.com/555714> [instagram] <https://ccikmumc2800.com/878832> Protein Report 8 The Grn Ste 7101, Dover United States of America
                    Attachments:
                    • phish_alert_iocp_v1.4.85.eml

                    Headers

                    Key Value
                    Return-Path<davina.macdonald@firstontario.com>
                    Receivedfrom YT1PR01MB3706.CANPRD01.PROD.OUTLOOK.COM ([fe80::13e0:1b22:8f49:9939]) by YT1PR01MB3706.CANPRD01.PROD.OUTLOOK.COM ([fe80::13e0:1b22:8f49:9939%5]) with mapi id 15.20.8534.031; Mon, 17 Mar 2025 15:50:39 +0000
                    Received-SPFpass (spfCheck: domain of firstontario.com designates 34.209.23.4 as permitted sender) client-ip=34.209.23.4; envelope-from=davina.macdonald@firstontario.com; helo=smtp.defend.email;
                    Authentication-Resultsamazonses.com; spf=pass (spfCheck: domain of firstontario.com designates 34.209.23.4 as permitted sender) client-ip=34.209.23.4; envelope-from=davina.macdonald@firstontario.com; helo=smtp.defend.email; dkim=pass header.i=@firstontario.onmicrosoft.com; dkim=pass header.i=@defend.email; dmarc=pass header.from=firstontario.com;
                    X-SES-RECEIPTAEFBQUFBQUFBQUFGb1lTeE5SbkJSMXN2dWpEbEx1VnhhOEFVbFNHLysvbmJXNW02bmF5SjV6UmlLWFlqMmUyZGk4ZlVlT2hEYndzeXRoTmh3eHB6QWNuNnNlQUZGbmNhZXdrRGo2OFd4eXhiTFZ3YWszSUtQbi9IMHBZTlQ4OUx0R0lWazdDYXVjbHM0NFJieTNFaDVyMHlnTWx3dWE3R2d6cVkvYWhXTmR5SmhxRk44MlkwekIwYUxOUm1aR09JT09MUndQdnFhK2ZLUzB2ZjdnVUczN05Da0FmeC9KZmtHN0tOU0FPS05FRzhXZ0RvRUpNbVVnTEc3V1dBMGZ6QXV1b25jUFRUVmhLU1FOMTBHYkpNZHVyeExZUEtVaEMwaS9ncHJiYlNkM09LeUIzckRqRjZpOW01NlNFdGxFbnI0RWt1UmRCcWlSK289
                    X-SES-DKIM-SIGNATUREa=rsa-sha256; q=dns/txt; b=KVaqcTAd4Cln8pqm7yl7MzaRlgSoEuYHSerHwW31nq8dXsrSlm3TembFw8FRXs31+97lkhgs82NiqURvVpRkfU6RkC+S6RIBoXwdImlIx1djIz1J4S98dmRSQrg3ajG9QY9LYcxJhXcjxJzCrUfAlaiFehMvbjwCNomOWWRDygw=; c=relaxed/simple; s=6gbrjpgwjskckoa6a5zn6fwqkn67xbtw; d=amazonses.com; t=1742226649; v=1; bh=C1dYWG2iGDFosJET2eMvNS9R5IJtrHZ083Vka1+wpEQ=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT;
                    DKIM-FilterOpenDKIM Filter v2.11.0 smtp.defend.email 4ZGfZb4mC2z3qr6
                    DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed; d=firstontario.onmicrosoft.com; s=selector1-firstontario-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=l4CnBYKrc6Z+NKy7n8SsvFXLK2IuVxraQswVKdf//A8=; b=Cjs7zXdKot9wKqFS7zZMHwPOFDIdORF6a7sT11iqcaHGYxIezsNNCW6Mqd11QO2WoFTlB3WQBuuf/wddBweaY+vv08+jQWdUzWXRg647mKA8widQ8Run8/fG7y2zIUdBmMUx1W1lHwEeQGASQVsTtsgaiEmeRQfebtHAnXi99yQ=
                    ARC-Seali=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=htsF3JZr52dHSSmMNrUWZSBHnHB2AMddFgK3HcLdLN2If7UnHKM78Ozc1V2F+KgWjaa8lVFYnfNvjnCpMRVZf7hBKx6bL2TI8MnpFdPrBKrqI1k2PfH3RRTOm4d2G98MtEvhaQjXqctQw/No4mS/X1NtL3BbcSRXxT/10NgHdUxC08DtIMY+TIl9CRIyYJCOtWvD7ak1B2iLOw/eLNSn7Nd1Vh9Rze1z+vgd9BYQzNcrYMx1rq/TFZxDinPy6Drrsa3AXeGVTgqxc5StXrBw90t1ckfDxbR4RSTq7bmQo+Ab7c7F/yRwVVfEOnXhDSBLlI+eL4peBE4iOI1FHXjfyQ==
                    ARC-Message-Signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=l4CnBYKrc6Z+NKy7n8SsvFXLK2IuVxraQswVKdf//A8=; b=Ul+0ITF/TEp6rviACpekwrbHZx9sr5AR4DwrRehJ4NYwxFCWUMEsTmCeK/xaCzkK+FYlGws3COGkjGpJ6dlU5gF9kHWRl9A35ar/UED+cO4X0kK0RO2IgYxe5kD3S93bolWyDuccmFVlcV4yWunstWXMdIB/fqwf5PTbkW79tIuMCJr9dtwCw61AVhDgW3C3/w4cFTicil3NEshxHDQIif3vvpMhCccc+tLEpN3DagkpDDW0ZvO/0PnyMapTqRG5nKnxAztkhEJBsmKXMFkSqqKempRsWF7pckAG3SBHG49i2DOWUH77rsz26e+EfACkB/VR6ZUfGjpIVOF35rtmXg==
                    ARC-Authentication-Resultsi=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=firstontario.com; dmarc=pass action=none header.from=firstontario.com; dkim=pass header.d=firstontario.com; arc=none
                    From"MacDonald, Davina" <Davina.MacDonald@firstontario.com>
                    To"d7e8457b-1c59-44ac-b5fe-ee555e2d0dc3@phisher.knowbe4.com" <d7e8457b-1c59-44ac-b5fe-ee555e2d0dc3@phisher.knowbe4.com>
                    Subject[Phish Alert] FW: .Firstontario's shared ''f_irstontario_pdf_735917419'' on Monday, 17th March 2025
                    Thread-Topic[Phish Alert] FW: .Firstontario's shared ''f_irstontario_pdf_735917419'' on Monday, 17th March 2025
                    Thread-IndexAQHbl0dK8AGQkYf0VUyEKyZI1JJkZLN3ehcQ
                    DateMon, 17 Mar 2025 15:50:39 +0000
                    Message-ID <YT1PR01MB3706D01A95755B84FBF16627F7DF2@YT1PR01MB3706.CANPRD01.PROD.OUTLOOK.COM>
                    References <3fa496b6-ba06-49b0-9c40-19f008c61d5c@firstontario-fileshare-ttpezelov.barcbwhwlp.com>
                    In-Reply-To <3fa496b6-ba06-49b0-9c40-19f008c61d5c@firstontario-fileshare-ttpezelov.barcbwhwlp.com>
                    Accept-Languageen-US
                    Content-Languageen-US
                    X-MS-Has-Attachyes
                    X-MS-TNEF-Correlator
                    authentication-resultsdkim=none (message not signed) header.d=none;dmarc=none action=none header.from=firstontario.com;
                    x-ms-publictraffictypeEmail
                    x-ms-traffictypediagnosticYT1PR01MB3706:EE_|YT2PR01MB10323:EE_
                    x-ms-office365-filtering-correlation-id44a907a8-a497-4bee-57bf-08dd656b7722
                    x-ms-exchange-senderadcheck1
                    x-ms-exchange-antispam-relay0
                    x-microsoft-antispam BCL:0;ARA:13230040|1800799024|376014|366016|4053099003|8096899003|38070700018;
                    x-microsoft-antispam-message-info FA8L9JOAFav5VnEzOqjZaknMZ54OUGBw731nISxbyyTCfIbCabS2RWFvKXPAy4QvKskEngUBbaf94Iii+CIMGWEcGL0DTAXxNV52m8NgzF3Gzot/LQNHyneW2TI1qcXKDJYaeeqRvo3Qby7LwvFZqsXUeLkmJLrpaKN1zNyGCpJHfEuEbmQNIxU3FmWOvDjxE3qujtMwoxqpCdTif8CZasZ0g63fFVDEYHqTuN9sEb1myUU9GaW2Kc33/E2BZsAdKwcxaD9qiHCsDGpcL2aV6M1/7GM774gBAwF5V461ccdGWufMoEJm2THerbF1DtqlRjxvx6G7uTSy25RqieGCD4slAYBv+CHEpPo90qN/lcZ/Sf7E/8YY62uWrMoU/BhWZ4NKPZa4ZmexQeGlkt3xZn6VrWL6puCuB5cJSF+XoCasZECFfi48pV1zFplqlYmz0hJwA1cRI66n6H1GFLeiBpecBaY3l9XYEUebJewNcwMrnI37Bw+0OJWtm/oarFzpobb80xl6t7/bFio6pVteBA404cezLSE0cEBktFSGRR/7uvRfj2xYCrW2UJ0Rvjgk+MS38NiDN5wb6mKSff1C+RObmrEATdWi4ZlfY6oYszYkPiFUEphr6lDqNXLvuzN6hulHKlza/N6Uyt2wvl/mSD1ropbZbzke9vRTApTNi3Mv0vFhEcI1+EyJzIpMZOxIWWIumdoYD595yRLRT1XzxslopX2kMcbyTdJWAtlEsKK+tBrK6jPd/iEuKQ8CLOxLDeNCTrxKInOunmFMZtw1sB3oCchnRTX1vX3KE1Qj3S/evx7cRyMdL83IHQCIsTR7schmMJ9Q6EEqBl1zRb1atHQsnBZAqhBj4O/PSiUpEcGM+FrAw8CHRds6fnvfPvh4wBjQSF/rcT69vE/IRMAvnp/B+t0/QA80db0grdUValUwUE+D8A1lS41tABMflrEjqnUfUA9/2d4B94WV3qx927P6BV6CyziIq3T12qP/r0+Pf37OczEZAuIDSNt0EGedbaJiuPPpVBFlMH/f+uliPEwXJmrtzvlpnwBbGU5jHg0fXWsBJVGFab2WhUZZwo9JwT8/Xp8YSY/V7yaHRY5nqSf/eddgz0MXEuiozUvvxYZsdn0lzws2oTwsQnJrT4ynpVo3/e6DRoh7mM4Z797R/MAObXf5Q6gCIQ8MWjyXaX1Bs2fcYd+LZF4IUakZPNOC1y2X1MorZ9Cde86aYhh0eUGrZ8SulWJkLWffMsjc4JIE/B4bCMqffnVsD0JjJOGANFBI1L8a+3VGRLkXuCtGLvi4qssM8HFMZLjZ9NgagjlRHuYEwDVpaZC9vLjHeDDfFRDa1RdmmeT6r0NSSF5JBi5HnNuG4GY9wussKi+NzDH3tiME/VK5nStzY9pfC2mK
                    x-forefront-antispam-report CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:YT1PR01MB3706.CANPRD01.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(4053099003)(8096899003)(38070700018);DIR:OUT;SFP:1102;
                    x-ms-exchange-antispam-messagedata-chunkcount1
                    x-ms-exchange-antispam-messagedata-0 ngSLjovrHQjFh3Vip7yzR7/ScKNM56t1TeaBPgKMtx8pulXm2b1aQ4YCto58bSgtiMJVeR36jBZTk1syL1mnwMPhwoWnmNLxXcRH2bZKY9tPJIeQaAtUFGZ/KdfkbRYUO80V7pq7TGXcZNg41Dg5mQEmzgX5u59uGO2e4rzBDDeR4rla0vkPIzIp97A5wBzQww/37E2a3+tUhEMfRa0vGQmlFle1wzqGqd/97iLC4b44+GSz1vjWoJYZP/bryBg+tlCWVMHVD3vjthIVsX4b2ln7jXUoeysxkxP82qrpnpSIcj5iQg67Lv0QjLED8CFEYYpWGvKmyVXOmqtEZoGSNIhYTM1oNJK94QKVipyzv72FyybYBIcwVKWIYvn4EiB4+FNXwk4kV20yhk8El21q1Tr7JsT+56mUJepMimEhdGbcf3JzaTHuRhnvd1IVzKcVbUU3xqQZ8YlSeQOCcxYgO0b0tkLOQjdhgUGtx+iC6HSctJlkSPDDA+4B9W92ev7cLQzNWuBOTmUPJnVK49UIV/hLfZXNDz7h69+G2jktFhvpwVIHLoBy8PvzQlQ3RcC8BeEgdtv7X6bXHSCQlQ7jhvNWrEzO6cR1Q1V04P9V9rmqT9Rw5NgQDsyxbzamDC91SD1kB71cqt/h2SItvyTML+YSSTMA0o7IfXz7jOfvqhM/wVT+E2MXVqFhaCQ9tH6nitdwVV56qZmjxrUZdB7rOa2S5MoyGyxMbAbIMBy637qkG2JHldq7Ge7EXoamWAnDmphsCbsRg8AKeAGFI1Ex+FxM8gB/PvjLKAVo3GHAK4aY18NxFJX8WI4MBSgnj3e0Z0xGcYa+tyUeg10gJ8Y28QGn+fMRNrpY0IDGjrNvkFvEhvIZDdVytxmHkBpuRFjb4V89zzsehZoEvZG52H9j2KfIZHPM614IGnHG44n6ZbIiF89CZOdmkGtLKrxulMH9SkPoVvldUE6fHC9UemYU0K6aHM7Djy60vSwpTf2z+OGNqp+QBsdCkHvGblo88GKSYuV2BAfHPPRWS+lVZ0RGhoQPkmYO9RD+2JCX1Zj/S1IBL1paB4+uk3LIfQNuRgwcAKg1ajqZvCn4c8oeN7+O5qtQDLsS9Px8IvyQxBohon0fKMTFjeSdHS1B/UkJjM+hHbDDYrckXZ+fPCg0gSY1OYQp9BWoZ4SDJuEKl8K+rBwJpZhGaX2Pipbk/Rqtb4ppbrFQB19wj4EVl80rDsr6FQBAEcfBw+EtciL3rd0ogS8OaEuIowMSeMoM04EBsqphGvJhxIDO2woMjiEoWr29vD3CIfQLWsafKSBNtO/G/97FpxN5VAeuZRpGy8HM8kA5dZcBsd0MFOHe83hs/2UOHBcyK5gBGUiylNwKjWf4yZt5QYKXC6+o/j4mo2fXEGtXnx0sDbZW9FuzG2Ll9NUUGWsVPK7oix2854AkzhnuXxKMtYQrnyJFd823XsvU2nuSjK59+ti/5vT9v1eoHKBYVV+fUrnakJrETSM9JPWuveJKc5vRfHBTPmMtVpo7A6SkAT3OHwiC6opR2mAggexlcoX6CEMQMdRbMWUZ0EgJ58wWug7mJhnyuESApRCV8YNA
                    Content-Typemultipart/mixed; boundary="_004_YT1PR01MB3706D01A95755B84FBF16627F7DF2YT1PR01MB3706CANP_"
                    MIME-Version1.0
                    X-OriginatorOrgfirstontario.com
                    X-MS-Exchange-CrossTenant-AuthAsInternal
                    X-MS-Exchange-CrossTenant-AuthSourceYT1PR01MB3706.CANPRD01.PROD.OUTLOOK.COM
                    X-MS-Exchange-CrossTenant-Network-Message-Id44a907a8-a497-4bee-57bf-08dd656b7722
                    X-MS-Exchange-CrossTenant-originalarrivaltime17 Mar 2025 15:50:39.1018 (UTC)
                    X-MS-Exchange-CrossTenant-fromentityheaderHosted
                    X-MS-Exchange-CrossTenant-id704f30be-15a6-482a-b249-cfe161841910
                    X-MS-Exchange-CrossTenant-mailboxtypeHOSTED
                    X-MS-Exchange-CrossTenant-userprincipalnamegJiRW0zIJmc5iw+MoKtVdeXsPwGCZMwlHh+DLeu+tSRpK85wLuW4Ir2uYmFExhcxk0awBfXs7vLi3NdYHNUdsi1VhuywooWROc2tVPtgtn8=
                    X-MS-Exchange-Transport-CrossTenantHeadersStampedYT2PR01MB10323

                    File Icon

                    Icon Hash:46070c0a8e0c67d6