DownloadedMessage (6)[.]zip

DownloadedMessage (6).zip

SHA256 f153355b43f85a2baee9408859206a9523e04ea74a95d883199f11ae5f3b58fe
MD5 ae4d02584b95553b27381e1222d1e2dc
SHA1 ff1e12761ee7842c06ae92ad12d7ee57e0cc5b40
SHA512 1255463a89aee63ee18427d11b21348ebeaa204e5685697f2ccc2e639cbd3bcb9d2bc298ed6c5c1d094cfcc6f41f98670802fd1e829fd26716a8030a1acbcc84
SSDEEP 6144:4S4M8HAQAIxvhZb1I9pxh0YJfSQdmB2uKc2rVgv1vi0SWavb5II:D4vHA+xvhZb1Mf0+KQdM2fEiJvd
TLSH
T15C4423155F5036C292DCBF7144A39BD1CEADA6F538C6D92A83B6229844D01EF3073B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

Message.eml

SHA256 ad6cfcc42a551be084ce094f406c99b753f5cd1eefda0bc72e0cfc2120a61359
MD5 e1869371e7480e69794e15d44666791c
SHA1 180d7c4073a49e37c74639b5bcfa9cfb3a9de4e5
SHA512 f4aa551702f5f715f9bc154947821ec21101bcbed19b8d68fb9a2e8a7e7da4520e4b8fa50c7cf36801980cb8db639ea1842fa2cf6e7fee199e31fbfbfa057679
SSDEEP 6144:4K20c4sPw0I1alRR/TnzMgM6/oOgIkEvGJQATKhKbcZ5MhQOvMXUk/dOyJ43PAFR:4K20cNtXN/MOr4JQA8jbV+PUmrET
TLSH
T1CA94027116876FDE433B285591087E052CA42B0B9325A065A65C72E83CFF134EFEADBD
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

Email Headers

To

[email protected]

From

[email protected]

Return-Path

[email protected]

Date

Fri, 25 Sep 2026 21:11:29 +0000

Subject

Records Request - 26.QIQ-10XLAW

Content-Type

multipart/mixed; boundary="_004_MN2PR14MB2557BC3EA28176C767CE0FD2CA802MN2PR14MB2557namp_"

Received

from CYXPR09CA0006.namprd09.prod.outlook.com (2603:10b6:930:d4::17) by PH0PR09MB11295.namprd09.prod.outlook.com (2603:10b6:510:2c7::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.18; Fri, 25 Sep 2026 21:11:34 +0000

from SJ1PEPF000037B0.namprd09.prod.outlook.com (2603:10b6:930:d4:cafe::1a) by CYXPR09CA0006.outlook.office365.com (2603:10b6:930:d4::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.19 via Frontend Transport; Fri, 25 Sep 2026 21:11:34 +0000

from PH8PR06CU001.outbound.protection.outlook.com (2a01:111:f403:c107::1) by SJ1PEPF000037B0.mail.protection.outlook.com (2603:10b6:a0f:fc02::594) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Fri, 25 Sep 2026 21:11:33 +0000

from MN2PR14MB2557.namprd14.prod.outlook.com (2603:10b6:208:ca::19) by DSVPR14MB958203.namprd14.prod.outlook.com (2603:10b6:8:38b::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.19; Fri, 25 Sep 2026 21:11:29 +0000

from MN2PR14MB2557.namprd14.prod.outlook.com ([fe80::baa0:644a:6b5a:7367]) by MN2PR14MB2557.namprd14.prod.outlook.com ([fe80::baa0:644a:6b5a:7367%3]) with mapi id 15.21.0451.014; Fri, 25 Sep 2026 21:11:29 +0000

Received-Spf

Pass (protection.outlook.com: domain of 10xlaw.com designates 2a01:111:f403:c107::1 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c107::1; helo=PH8PR06CU001.outbound.protection.outlook.com; pr=C

Message-Id

<MN2PR14MB2557BC3EA28176C767CE0FD2CA802@MN2PR14MB2557.namprd14.prod.outlook.com>

10XLAW.xls

SHA256 cc8f52bf9f87d587afb8f1e0109ca86cb008fc1e56cbebf91ffcefa3b0df901e
MD5 47c05383c411378229659e9ac984e6c5
SHA1 ad7a10526550b257b8fd19de699aa2f6200b8f2e
SHA512 8b37fccfdb35d40453f2c3341f9dafe1a38ed530f368dc702ad863fad86728d775e40ca28cc430745071440a4220c79f3c6c83a82071330bf15ad3c15a07bb3e
SSDEEP 6144:mSFsv66g3KnF439NKC54kk6n+W2XdQNCVRJYDgnwIoSI4x3hbwDYEynIhzbxBDDC:HDqw/8J5wDISjDo404Fy1mniGz0
TLSH
T190540266F7828D1AE897433D48E317153736FE21576B930E3968BB0D19B0984CE2B35E
MD5 SHA1 SHA512 SSDEEP TLSH

windows office2003

email-html-2.txt

SHA256 ee80f924f954c4a55c7bf37eb92e71f3ea088d619c7cfb58c8d1e9876bdedf46
MD5 43503b02af9f44bf6614fdbc63133228
SHA1 c1ad4d232febce55e8ffc861f782513da1f0b1b3
SHA512 9642e0a44af1dbd450360d185953b0303817e763c5e4ffc554aac188388fdb0451e07c2431f441494f16f908a7c213661d37dda93d413de62d291416acac5848
TLSH
T1E6618E07F342060BA1E36679F193B38A3BD75684AB43597511B2336BCACDD6122F369C
MD5 SHA1 SHA512 TLSH

email-plain-1.txt

SHA256 593faa51fbc2bed6f9b9ddc19d934aebd628c7364f4501411db2430283ed6e27
MD5 57c1d4cf50ca70a5200dc174ff4822ef
SHA1 57eaa0a0109f0bbd0dd33458c40ea33540f070a7
SHA512 34a5accb692f4cf51e4378d6105e8542b47459238d42ecd8106696ffa29261bb4d5d1d464aae3fb40c2dbf513bf06934a436ce13ea678ed5fa4b464f5d1ef4b0
TLSH
T10AE02D3E030313F241326082A50893838A73E040364B8F20B009488C2360B4CB4F4EEE
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer