Edit tour

Windows Analysis Report
EXTERNALInvoice 3388 from Mazzitti Sullivan EAP.msg

Overview

General Information

Sample name:	EXTERNALInvoice 3388 from Mazzitti Sullivan EAP.msg
Analysis ID:	1513514
MD5:	de35cce729f4b9fd1c121a8f30ca8c90
SHA1:	ce6b7b19656364b2be8bc455d0048c85ff2cbdd1
SHA256:	7820a2b4ef4b37d81d5c211dcd9a032fb55214676703a4a71db784eda5e59df8
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

Blob-based file download detected

Very long command line found

HTML page contains hidden javascript code

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Outlook Security Settings Updated - Registry

Sigma detected: Suspicious Office Outbound Connections

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6840 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\EXTERNALInvoice 3388 from Mazzitti Sullivan EAP.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 7112 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "6118F2AD-E6EB-42C1-B4F2-2BAC0E956394" "24884A70-D376-447B-890F-5B3BBC8D5C9D" "6840" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 5496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://links.notification.intuit.com/ls/click?upn=u001.Hu9nToJLxsJSQR8ZHWn8Ib7JikYF6PNXv5VK-2BAfeSpVHPRNy-2BFDtJ-2BhNUfKXTverofrKjvXVKH4ba5KbTX-2BS4XXVpTr6OWRfgQQrNZl2n-2FNa7oMnlQoBVFEkBCL0dPdyReNnlqRAy4g-2FoSILQFoT-2BdgTBuL1QK42pN5lorERf-2F9vLJYpcNKn1GkGuwoGDgl6Bp-2F-2FQW4Jss4CpwybSy-2FU19k-2F15qAjdtPIek1SOzjcjqZccYDuYtCB2PpknCfT-2FO6rT1feRhtHb1c5TkuI5vvcA-3D-3DWna4_B-2BgI58rqp1d012zIBePxT0Vp-2Fb4avSQpQnu-2Bj6sZauDgFEA708Rle1fCrSP5gQna7dJH2cxzpLGT9u4R-2Fgd-2BfDa0FGPFRo7VzICaW9jgo4jV8EMj-2FfgUfsvcBbvy8Nd1oIq-2BOHAmqkjusafHoBokpQnI7LuwcWoQSjoajeVb1XtwPo77K2QGdxzz1TE-2BUJajkaJ5r3ksJZEcJl3qRwMRrT1eBIxNugGHcobV3kxdUiEYuWDF7amrrUGEVEoUAR-2Fl5qAcJK0DMsG0-2F8yhUvifFgY8GPzRvkkCBEqB6khHesGRBzujEJ6KahStbZGhL65JBubDshrvGLWng96PEBUsIeXgYEPc9lIVudxX1LCdOW70-2FIaDrmKYLV8V1q2hwCBessv6rWoGlVm0tz0A4JhgTxqwoyWZ176Sy8bnXHHf8ViNCTsaR-2BEAxrzKdhHlmyjMir4CCh3C-2BTl20SV3-2Bu5GbFzluhWR9b3LVP1N9HnoWJGTk1K3eDEvmLwRBmBNBWmOadN8ArMS4MHJg9BtfCAf2zyS3qHRmFwQwI6lNgBlMW4FkHiisQxMpPEFCJIC5udkIYgRD8h3xvjrpBYMRCaecubD5QBfr1-2BTztgNtVYbkcW5sdpqcXH22rSErP5JSWTRt-2FHj9Lyd3If1-2BBLAB5su-2ByFTwiko5dFVHO0-2FsRNfjFH9Kwz5u1iq1rY0nSPSkPB-2FMaIi6so5tVUStXoV-2FTtZAbCSuwpPRteFeVOXzhZhpXGuHuvsALAVsqRQKkssRA62-2BZZiELOntguG2U4-2FcwXsJO14fwkxr-2BqoK-2B0q6V656LsIK1z0L-2BvWP-2B5JQ6UkrNtgzCp8XY9fYtV7xpuZD9CirEirx02QXpXl6quJgne7LXdbrC-2FfNvO3unqdL5r-2BevhPAPLg-2FfBEd3tprw03gLvqqOnnfn7KfJc-2BRs-2Fmj-2BVwHKYqVqzWThucT6SvblKqnfH5hHWKYStwt2rQbNlP-2FdRVh3AD157-2BR43j2s0Fxbm7CKgefaB8dtRBVvQ7pYmdNp3P3roEX-2B6U18U0jhscVwoNGOUBrC-2Ff4x-2BBXoUzlFcwzTY19Ht2t7bpRqTh09Lj0Mr0O7fjvfKFVRT-2BTAdN6-2BPu6vt0D70WHQmx4mA7UsI2Wifv8s-2FmwXUz-2B3DYcjQWOL50ry5e5QlTNvfwlEgaiWTjTLeCXAOWqZ2UOBnJIX6Q0J86fDGi1hzbDptqRMb5YqvyZNOQ7ZDuRRg6prKDlituSuhqLBHV81m-2BC0jL9rLHwIk2qACDlJY-2FkHM4M5wXt6taHbpiJH36EzqMmKurk-2FsJG4LanERJkrWtPyaRZPSXR9tGCuppzjYckdPF-2BVnGT6uznSosK4mok-2F0EEH8tYJE10JAekbkwNIGuIuS3ARy3nuPAuBemw3wWmHAWHSUcfEofbWK11obFtE-2BEmily-2FAVfSO80KFjy1N92wqnSIW1thWTcHFMNmuf7ax-2FBFCMyVRqxJFdfdUvMFgEnVGU1Zr3TpApyWH3lnXAytbczXGxUGfI-3D MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2008,i,8797809356631026283,1473486625596280885,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

Acrobat.exe (PID: 3428 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\NOJ14QF0\INVOICE_3388_from_MAZZITTI SULLIVAN EAP.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7592 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1860 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1548,i,14139581390169339457,9791267880498957622,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Sigma Signatures

System Summary

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6840, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\NOJ14QF0\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6840, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.17, DestinationIsIpv6: false, DestinationPort: 49715, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, Initiated: true, ProcessId: 6840, Protocol: tcp, SourceIp: 35.82.250.81, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://connect.intuit.com/t/scs-v1-b510207a562d4f598e9904227305b55d014f5d8c2e2c4e6f81e5a32c1643cba2522bc5b215a943a3afdba3d550857c35?cta=viewinvoicenow&locale=en_US

HTTP Parser: Base64 decoded: {"alg":"HS256","typ":"JWT"}

Source: https://connect.intuit.com/t/scs-v1-b510207a562d4f598e9904227305b55d014f5d8c2e2c4e6f81e5a32c1643cba2522bc5b215a943a3afdba3d550857c35?cta=viewinvoicenow&locale=en_US	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.7:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.156.60.47:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.82.250.81:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.239.83.80:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49826 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.7
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.7
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /wf/open?upn=u001.-2B7HLscYREF2Awl457kLJsaVkRB0DFhH9ZiiVX94nPWUAGt04lvWv55L5nmqt72v9dqIx0XhWxuFEBc8X19M1DCDZj4166k3dZEvrpoF-2BbLf4KSQhz8h83ZKUA1OvIqSB8IZULeMasJ1Mqe-2BYe6Vm-2BKil02tK-2FOpSxJyQIZxahZYgMoXPrXhN8TZNc9G-2B2DI3SDK7SlHScdiBgwJCWPOnQcvFiqYYY1fKEY5RkOfGAA4BI8VvuE6bjfHLZ4lAXR3T6NMIMLH9reYhydBNCV59yl-2FBaOMXPcy5a-2Bzc0dQjY-2BokOOh3lRG8VqopZ6Nn3iOoyw34AKsuurYvj30eptkYjrqelHp-2Bh5fa0PnX-2FALUEQViGR3SADrIMBYTJIihAuu5VEiBLSqBF-2BD0LyQCnFW2v2uoG0dfBDQitQGeFeH7l8rlSuVSoL3yJgDq-2BeofP3YHd5pTv8pTNhamFlKJN-2FXIP8Qvuww9i-2BD73jIJmATbr5ZcsQQNSglYegjM9KRrDTVtBgTaAVXY7GjXTvfPPm-2BLKFX8qPTtDcwLVzw6cTEFH8BzozhgxLMYbFw3U-2F3VpjpEVw0t1hY23RnZW6KFazAsaSd57BG1Ds-2BUxJRXZuo24vu3vRUkePjtKG-2FxWSWB-2B-2FG1Gvo-2FSoUxJDRrO7hpKgzNglpgMBNVE73-2Bx3JA3j1eEGNErO7fM8X-2FRv9QL1y1-2FKcaHpI22UGHXg4zpGjJh8MP2AG9rPyeXrlYkJGPEnellFlPgCIEHqS6mWw-2B6njUkgqH3Qy8azgI-2BwRaaW4W97-2BGEqyDQAVBXaAJUWTid8PF3gKS-2FOwdeAMxSMcG6UYUy-2BXOknyjnP15e1YwYkbrjARk88Aio-2FI4lix0uuhLmZeR4xfy7L5sEZAyesAvNLssJojs5QKczH4SRkkbywCBLCjaHR0LpVEcgmwW6oJAvUeiwf79oMGzJL71NX6baXwC00lMdytH88DTApXgrR69r0a5-2FU7Y1o-2B-2FVzF2OasXhTKhvC-2F9VlqV0IEyHEZwjoVq8qk6jWOh593AsJ8VdZwwVbjP8I8-2FTLJHfCQn9H4wMaGQ7-2BnxDAJc9BZ1nOZ-2FEOMGL-2BXqjdUi-2FOlLFjB4kJvHWeN62Lb2BsEkPrGcVjVNnW1F1WTs-2FaibrRIMSlEiBw81FIiMfZWR7rWtfvaPK2-2F9oWaXAoAbwVyjiDFZggfmJXjqxhyr-2Fg60K3-2BWoHq3Di6RCJBxesEM7IGDz0GpmEB1-2F5SOH3ivUcTV76K0eFTfgnQ70KHhcwByDtYyjF-2FjK7d2563WlRgYd50-2FV-2Bed0WquNwv-2FOtj-2Fsvf3-2BZnyyKFtKUTstrYXhVmBGaMSv9NNW1JhrG4fKg1uJOoaBRtvLhXng9oKF9bYVw-2BZYkLUYGaVN5eVjjY85XkOvfBiDlxLx55HIVhvaKmoPxuS9WEEawh5rvlGeVK2iiuy2oVSmW6DmXjVOmPmINIdDURKnefKydLTjK1R6fdR-2B89m2NUJ-2FZ-2B9Q8jyiyy61f15Gz4hsgIjiV6XblQ-3D HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: links.notification.intuit.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ls/click?upn=u001.Hu9nToJLxsJSQR8ZHWn8Ib7JikYF6PNXv5VK-2BAfeSpVHPRNy-2BFDtJ-2BhNUfKXTverofrKjvXVKH4ba5KbTX-2BS4XXVpTr6OWRfgQQrNZl2n-2FNa7oMnlQoBVFEkBCL0dPdyReNnlqRAy4g-2FoSILQFoT-2BdgTBuL1QK42pN5lorERf-2F9vLJYpcNKn1GkGuwoGDgl6Bp-2F-2FQW4Jss4CpwybSy-2FU19k-2F15qAjdtPIek1SOzjcjqZccYDuYtCB2PpknCfT-2FO6rT1feRhtHb1c5TkuI5vvcA-3D-3DWna4_B-2BgI58rqp1d012zIBePxT0Vp-2Fb4avSQpQnu-2Bj6sZauDgFEA708Rle1fCrSP5gQna7dJH2cxzpLGT9u4R-2Fgd-2BfDa0FGPFRo7VzICaW9jgo4jV8EMj-2FfgUfsvcBbvy8Nd1oIq-2BOHAmqkjusafHoBokpQnI7LuwcWoQSjoajeVb1XtwPo77K2QGdxzz1TE-2BUJajkaJ5r3ksJZEcJl3qRwMRrT1eBIxNugGHcobV3kxdUiEYuWDF7amrrUGEVEoUAR-2Fl5qAcJK0DMsG0-2F8yhUvifFgY8GPzRvkkCBEqB6khHesGRBzujEJ6KahStbZGhL65JBubDshrvGLWng96PEBUsIeXgYEPc9lIVudxX1LCdOW70-2FIaDrmKYLV8V1q2hwCBessv6rWoGlVm0tz0A4JhgTxqwoyWZ176Sy8bnXHHf8ViNCTsaR-2BEAxrzKdhHlmyjMir4CCh3C-2BTl20SV3-2Bu5GbFzluhWR9b3LVP1N9HnoWJGTk1K3eDEvmLwRBmBNBWmOadN8ArMS4MHJg9BtfCAf2zyS3qHRmFwQwI6lNgBlMW4FkHiisQxMpPEFCJIC5udkIYgRD8h3xvjrpBYMRCaecubD5QBfr1-2BTztgNtVYbkcW5sdpqcXH22rSErP5JSWTRt-2FHj9Lyd3If1-2BBLAB5su-2ByFTwiko5dFVHO0-2FsRNfjFH9Kwz5u1iq1rY0nSPSkPB-2FMaIi6so5tVUStXoV-2FTtZAbCSuwpPRteFeVOXzhZhpXGuHuvsALAVsqRQKkssRA62-2BZZiELOntguG2U4-2FcwXsJO14fwkxr-2BqoK-2B0q6V656LsIK1z0L-2BvWP-2B5JQ6UkrNtgzCp8XY9fYtV7xpuZD9CirEirx02QXpXl6quJgne7LXdbrC-2FfNvO3unqdL5r-2BevhPAPLg-2FfBEd3tprw03gLvqqOnnfn7KfJc-2BRs-2Fmj-2BVwHKYqVqzWThucT6SvblKqnfH5hHWKYStwt2rQbNlP-2FdRVh3AD157-2BR43j2s0Fxbm7CKgefaB8dtRBVvQ7pYmdNp3P3roEX-2B6U18U0jhscVwoNGOUBrC-2Ff4x-2BBXoUzlFcwzTY19Ht2t7bpRqTh09Lj0Mr0O7fjvfKFVRT-2BTAdN6-2BPu6vt0D70WHQmx4mA7UsI2Wifv8s-2FmwXUz-2B3DYcjQWOL50ry5e5QlTNvfwlEgaiWTjTLeCXAOWqZ2UOBnJIX6Q0J86fDGi1hzbDptqRMb5YqvyZNOQ7ZDuRRg6prKDlituSuhqLBHV81m-2BC0jL9rLHwIk2qACDlJY-2FkHM4M5wXt6taHbpiJH36EzqMmKurk-2FsJG4LanERJkrWtPyaRZPSXR9tGCuppzjYckdPF-2BVnGT6uznSosK4mok-2F0EEH8tYJE10JAekbkwNIGuIuS3ARy3nuPAuBemw3wWmHAWHSUcfEofbWK11obFtE-2BEmily-2FAVfSO80KFjy1N92wqnSIW1thWTcHFMNmuf7ax-2FBFCMyVRqxJFdfdUvMFgEnVGU1Zr3TpApyWH3lnXAytbczXGxUGfI-3D HTTP/1.1Host: links.notification.intuit.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: ips-logos-cdn.ips.sbg.a.intuit.com
Source: global traffic	DNS traffic detected: DNS query: connect.intuit.com
Source: global traffic	DNS traffic detected: DNS query: links.notification.intuit.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: static.cns-icn-prod.a.intuit.com
Source: global traffic	DNS traffic detected: DNS query: cdn.segment.com
Source: global traffic	DNS traffic detected: DNS query: smx.intuit.com
Source: global traffic	DNS traffic detected: DNS query: prd.sentry-io.a.intuit.com
Source: global traffic	DNS traffic detected: DNS query: eventbus.intuit.com
Source: global traffic	DNS traffic detected: DNS query: quickbooks.intuit.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.7:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.156.60.47:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.82.250.81:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.239.83.80:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49826 version: TLS 1.2

System Summary

Blob-based file download detected

Source: C:\Users\user\Downloads\downloaded.pdf

File download: blob:https://connect.intuit.com/2342bd38-1b60-4509-be40-6ea04a2253dfC:\Users\user\Downloads\downloaded.pdf

Very long command line found

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: Commandline size = 2082
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: Commandline size = 2082

Source: classification engine

Classification label: mal52.winMSG@45/49@38/291

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240918T1556060116-6840.etl

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\EXTERNALInvoice 3388 from Mazzitti Sullivan EAP.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "6118F2AD-E6EB-42C1-B4F2-2BAC0E956394" "24884A70-D376-447B-890F-5B3BBC8D5C9D" "6840" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://links.notification.intuit.com/ls/click?upn=u001.Hu9nToJLxsJSQR8ZHWn8Ib7JikYF6PNXv5VK-2BAfeSpVHPRNy-2BFDtJ-2BhNUfKXTverofrKjvXVKH4ba5KbTX-2BS4XXVpTr6OWRfgQQrNZl2n-2FNa7oMnlQoBVFEkBCL0dPdyReNnlqRAy4g-2FoSILQFoT-2BdgTBuL1QK42pN5lorERf-2F9vLJYpcNKn1GkGuwoGDgl6Bp-2F-2FQW4Jss4CpwybSy-2FU19k-2F15qAjdtPIek1SOzjcjqZccYDuYtCB2PpknCfT-2FO6rT1feRhtHb1c5TkuI5vvcA-3D-3DWna4_B-2BgI58rqp1d012zIBePxT0Vp-2Fb4avSQpQnu-2Bj6sZauDgFEA708Rle1fCrSP5gQna7dJH2cxzpLGT9u4R-2Fgd-2BfDa0FGPFRo7VzICaW9jgo4jV8EMj-2FfgUfsvcBbvy8Nd1oIq-2BOHAmqkjusafHoBokpQnI7LuwcWoQSjoajeVb1XtwPo77K2QGdxzz1TE-2BUJajkaJ5r3ksJZEcJl3qRwMRrT1eBIxNugGHcobV3kxdUiEYuWDF7amrrUGEVEoUAR-2Fl5qAcJK0DMsG0-2F8yhUvifFgY8GPzRvkkCBEqB6khHesGRBzujEJ6KahStbZGhL65JBubDshrvGLWng96PEBUsIeXgYEPc9lIVudxX1LCdOW70-2FIaDrmKYLV8V1q2hwCBessv6rWoGlVm0tz0A4JhgTxqwoyWZ176Sy8bnXHHf8ViNCTsaR-2BEAxrzKdhHlmyjMir4CCh3C-2BTl20SV3-2Bu5GbFzluhWR9b3LVP1N9HnoWJGTk1K3eDEvmLwRBmBNBWmOadN8ArMS4MHJg9BtfCAf2zyS3qHRmFwQwI6lNgBlMW4FkHiisQxMpPEFCJIC5udkIYgRD8h3xvjrpBYMRCaecubD5QBfr1-2BTztgNtVYbkcW5sdpqcXH22rSErP5JSWTRt-2FHj9Lyd3If1-2BBLAB5su-2ByFTwiko5dFVHO0-2FsRNfjFH9Kwz5u1iq1rY0nSPSkPB-2FMaIi6so5tVUStXoV-2FTtZAbCSuwpPRteFeVOXzhZhpXGuHuvsALAVsqRQKkssRA62-2BZZiELOntguG2U4-2FcwXsJO14fwkxr-2BqoK-2B0q6V656LsIK1z0L-2BvWP-2B5JQ6UkrNtgzCp8XY9fYtV7xpuZD9CirEirx02QXpXl6quJgne7LXdbrC-2FfNvO3unqdL5r-2BevhPAPLg-2FfBEd3tprw03gLvqqOnnfn7KfJc-2BRs-2Fmj-2BVwHKYqVqzWThucT6SvblKqnfH5hHWKYStwt2rQbNlP-2FdRVh3AD157-2BR43j2s0Fxbm7CKgefaB8dtRBVvQ7pYmdNp3P3roEX-2B6U18U0jhscVwoNGOUBrC-2Ff4x-2BBXoUzlFcwzTY19Ht2t7bpRqTh09Lj0Mr0O7fjvfKFVRT-2BTAdN6-2BPu6vt0D70WHQmx4mA7UsI2Wifv8s-2FmwXUz-2B3DYcjQWOL50ry5e5QlTNvfwlEgaiWTjTLeCXAOWqZ2UOBnJIX6Q0J86fDGi1hzbDptqRMb5YqvyZNOQ7ZDuRRg6prKDlituSuhqLBHV81m-2BC0jL9rLHwIk2qACDlJY-2FkHM4M5wXt6taHbpiJH36EzqMmKurk-2FsJG4LanERJkrWtPyaRZPSXR9tGCuppzjYckdPF-2BVnGT6uznSosK4mok-2F0EEH8tYJE10JAekbkwNIGuIuS3ARy3nuPAuBemw3wWmHAWHSUcfEofbWK11obFtE-2BEmily-2FAVfSO80KFjy1N92wqnSIW1thWTcHFMNmuf7ax-2FBFCMyVRqxJFdfdUvMFgEnVGU1Zr3TpApyWH3lnXAytbczXGxUGfI-3D
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2008,i,8797809356631026283,1473486625596280885,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "6118F2AD-E6EB-42C1-B4F2-2BAC0E956394" "24884A70-D376-447B-890F-5B3BBC8D5C9D" "6840" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://links.notification.intuit.com/ls/click?upn=u001.Hu9nToJLxsJSQR8ZHWn8Ib7JikYF6PNXv5VK-2BAfeSpVHPRNy-2BFDtJ-2BhNUfKXTverofrKjvXVKH4ba5KbTX-2BS4XXVpTr6OWRfgQQrNZl2n-2FNa7oMnlQoBVFEkBCL0dPdyReNnlqRAy4g-2FoSILQFoT-2BdgTBuL1QK42pN5lorERf-2F9vLJYpcNKn1GkGuwoGDgl6Bp-2F-2FQW4Jss4CpwybSy-2FU19k-2F15qAjdtPIek1SOzjcjqZccYDuYtCB2PpknCfT-2FO6rT1feRhtHb1c5TkuI5vvcA-3D-3DWna4_B-2BgI58rqp1d012zIBePxT0Vp-2Fb4avSQpQnu-2Bj6sZauDgFEA708Rle1fCrSP5gQna7dJH2cxzpLGT9u4R-2Fgd-2BfDa0FGPFRo7VzICaW9jgo4jV8EMj-2FfgUfsvcBbvy8Nd1oIq-2BOHAmqkjusafHoBokpQnI7LuwcWoQSjoajeVb1XtwPo77K2QGdxzz1TE-2BUJajkaJ5r3ksJZEcJl3qRwMRrT1eBIxNugGHcobV3kxdUiEYuWDF7amrrUGEVEoUAR-2Fl5qAcJK0DMsG0-2F8yhUvifFgY8GPzRvkkCBEqB6khHesGRBzujEJ6KahStbZGhL65JBubDshrvGLWng96PEBUsIeXgYEPc9lIVudxX1LCdOW70-2FIaDrmKYLV8V1q2hwCBessv6rWoGlVm0tz0A4JhgTxqwoyWZ176Sy8bnXHHf8ViNCTsaR-2BEAxrzKdhHlmyjMir4CCh3C-2BTl20SV3-2Bu5GbFzluhWR9b3LVP1N9HnoWJGTk1K3eDEvmLwRBmBNBWmOadN8ArMS4MHJg9BtfCAf2zyS3qHRmFwQwI6lNgBlMW4FkHiisQxMpPEFCJIC5udkIYgRD8h3xvjrpBYMRCaecubD5QBfr1-2BTztgNtVYbkcW5sdpqcXH22rSErP5JSWTRt-2FHj9Lyd3If1-2BBLAB5su-2ByFTwiko5dFVHO0-2FsRNfjFH9Kwz5u1iq1rY0nSPSkPB-2FMaIi6so5tVUStXoV-2FTtZAbCSuwpPRteFeVOXzhZhpXGuHuvsALAVsqRQKkssRA62-2BZZiELOntguG2U4-2FcwXsJO14fwkxr-2BqoK-2B0q6V656LsIK1z0L-2BvWP-2B5JQ6UkrNtgzCp8XY9fYtV7xpuZD9CirEirx02QXpXl6quJgne7LXdbrC-2FfNvO3unqdL5r-2BevhPAPLg-2FfBEd3tprw03gLvqqOnnfn7KfJc-2BRs-2Fmj-2BVwHKYqVqzWThucT6SvblKqnfH5hHWKYStwt2rQbNlP-2FdRVh3AD157-2BR43j2s0Fxbm7CKgefaB8dtRBVvQ7pYmdNp3P3roEX-2B6U18U0jhscVwoNGOUBrC-2Ff4x-2BBXoUzlFcwzTY19Ht2t7bpRqTh09Lj0Mr0O7fjvfKFVRT-2BTAdN6-2BPu6vt0D70WHQmx4mA7UsI2Wifv8s-2FmwXUz-2B3DYcjQWOL50ry5e5QlTNvfwlEgaiWTjTLeCXAOWqZ2UOBnJIX6Q0J86fDGi1hzbDptqRMb5YqvyZNOQ7ZDuRRg6prKDlituSuhqLBHV81m-2BC0jL9rLHwIk2qACDlJY-2FkHM4M5wXt6taHbpiJH36EzqMmKurk-2FsJG4LanERJkrWtPyaRZPSXR9tGCuppzjYckdPF-2BVnGT6uznSosK4mok-2F0EEH8tYJE10JAekbkwNIGuIuS3ARy3nuPAuBemw3wWmHAWHSUcfEofbWK11obFtE-2BEmily-2FAVfSO80KFjy1N92wqnSIW1thWTcHFMNmuf7ax-2FBFCMyVRqxJFdfdUvMFgEnVGU1Zr3TpApyWH3lnXAytbczXGxUGfI-3D
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2008,i,8797809356631026283,1473486625596280885,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\NOJ14QF0\INVOICE_3388_from_MAZZITTI SULLIVAN EAP.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1548,i,14139581390169339457,9791267880498957622,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 05DFF23F89A3C3EDE6C1C58EB0A72C82
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\NOJ14QF0\INVOICE_3388_from_MAZZITTI SULLIVAN EAP.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1548,i,14139581390169339457,9791267880498957622,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\InProcServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email

LLM: Email contains prominent button: 'view details'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	14 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
file:///C:/Users/user/Downloads/downloaded.pdf	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
d296je7bbdd650.cloudfront.net	13.227.222.191	true	false	unknown
d3tatcadpk4130.cloudfront.net	18.239.83.80	true	false	unknown
ips-logos-cdn.ips.sbg.a.intuit.com	108.156.60.47	true	false	unknown
www.google.com	142.250.186.164	true	false	unknown
eventbus.a.intuit.com	34.223.34.110	true	false	unknown
prd-sb04.apigwsbgprdusw2.iks2.a.intuit.com	35.82.250.81	true	false	unknown
static.cns-icn-prod.a.intuit.com	13.225.78.17	true	false	unknown
platformexps-prd-sentry-io-stable.qbcapitalprdusw2.iks2.a.intuit.com	44.231.10.24	true	false	unknown
connect.intuit.com	unknown	unknown	true	unknown
cdn.segment.com	unknown	unknown	false	unknown
prd.sentry-io.a.intuit.com	unknown	unknown	false	unknown
smx.intuit.com	unknown	unknown	false	unknown
x1.i.lencr.org	unknown	unknown	false	unknown
quickbooks.intuit.com	unknown	unknown	false	unknown
links.notification.intuit.com	unknown	unknown	false	unknown
eventbus.intuit.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Downloads/downloaded.pdf	false	Avira URL Cloud: safe	unknown
https://connect.intuit.com/t/scs-v1-b510207a562d4f598e9904227305b55d014f5d8c2e2c4e6f81e5a32c1643cba2522bc5b215a943a3afdba3d550857c35?cta=viewinvoicenow&locale=en_US	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.245.86.67	unknown	United States	16509	AMAZON-02US	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false
18.239.83.80	d3tatcadpk4130.cloudfront.net	United States	16509	AMAZON-02US	false
13.227.222.191	d296je7bbdd650.cloudfront.net	United States	16509	AMAZON-02US	false
108.156.60.66	unknown	United States	16509	AMAZON-02US	false
108.156.60.47	ips-logos-cdn.ips.sbg.a.intuit.com	United States	16509	AMAZON-02US	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
199.232.214.172	bg.microsoft.map.fastly.net	United States	54113	FASTLYUS	false
13.89.178.27	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.41.194.36	unknown	United States	16509	AMAZON-02US	false
23.192.240.149	unknown	United States	16625	AKAMAI-ASUS	false
142.250.184.200	unknown	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.99	unknown	United States	15169	GOOGLEUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
23.198.214.140	unknown	United States	26769	BANDCONUS	false
52.26.176.68	unknown	United States	16509	AMAZON-02US	false
74.125.71.84	unknown	United States	15169	GOOGLEUS	false
44.231.10.24	platformexps-prd-sentry-io-stable.qbcapitalprdusw2.iks2.a.intuit.com	United States	16509	AMAZON-02US	false
13.225.78.17	static.cns-icn-prod.a.intuit.com	United States	16509	AMAZON-02US	false
18.66.102.113	unknown	United States	3	MIT-GATEWAYSUS	false
108.156.60.61	unknown	United States	16509	AMAZON-02US	false
52.37.216.74	unknown	United States	16509	AMAZON-02US	false
13.225.78.36	unknown	United States	16509	AMAZON-02US	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false
2.23.197.184	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.197.9.160	unknown	United States	16625	AKAMAI-ASUS	false
35.82.250.81	prd-sb04.apigwsbgprdusw2.iks2.a.intuit.com	United States	237	MERIT-AS-14US	false
23.57.18.228	unknown	United States	16625	AKAMAI-ASUS	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
184.28.90.27	unknown	United States	16625	AKAMAI-ASUS	false
34.223.34.110	eventbus.a.intuit.com	United States	16509	AMAZON-02US	false
172.217.18.104	unknown	United States	15169	GOOGLEUS	false
18.207.85.246	unknown	United States	14618	AMAZON-AESUS	false
23.203.104.175	unknown	United States	16625	AKAMAI-ASUS	false
18.245.86.37	unknown	United States	16509	AMAZON-02US	false
52.109.76.144	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.17
192.168.2.16
192.168.2.14

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1513514
Start date and time:	2024-09-18 21:55:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	EXTERNALInvoice 3388 from Mazzitti Sullivan EAP.msg
Detection:	MAL
Classification:	mal52.winMSG@45/49@38/291
Cookbook Comments:	Found application associated with file extension: .msg

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 184.28.90.27, 192.229.221.95, 13.89.178.27, 74.125.71.84, 216.58.206.46, 142.250.185.195, 34.104.35.123
Excluded domains from analysis (whitelisted): ecs.office.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, onedscolprdcus03.centralus.cloudapp.azure.com, clientservices.googleapis.com, s-0005-office.config.skype.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, mobile.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, ecs-office.s-0005.s-msedge.net, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, s-0005.s-msedge.net, e16604.g.akamaiedge.net, ecs.office.trafficmanager.net, clients.l.google.com, prod.fs.microsoft.com.akadns.net, mobile.events.data.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetValueKey calls found.
VT rate limit hit for: EXTERNALInvoice 3388 from Mazzitti Sullivan EAP.msg

LLM Input / Output

Input	Output
URL: Email Model: jbxai	{ "brand":["Cox Manufacturing Company, Inc."], "contains_trigger_text":true, "prominent_button_name":"View details", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: PDF document Model: jbxai	{ "brand":["Mazzitti & Sullivan EAP", "Cox Manufacturing Company, Inc."], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://connect.intuit.com/t/scs-v1-b510207a562d4f598e9904227305b55d014f5d8c2e2c4e6f81e5a32c1643cba2522bc5b215a943a3afdba3d550857c35?cta=viewinvoicenow&locale=en_US Model: jbxai	{ "brand":["intuit", "quickbooks"], "contains_trigger_text":true, "prominent_button_name":"yes, let them know", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://connect.intuit.com/t/scs-v1-b510207a562d4f598e9904227305b55d014f5d8c2e2c4e6f81e5a32c1643cba2522bc5b215a943a3afdba3d550857c35?cta=viewinvoicenow&locale=en_US Model: jbxai	{ "brand":["intuit", "quickbooks"], "contains_trigger_text":true, "prominent_button_name":"yes, let them know", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: file:///C:/Users/user/Downloads/downloaded.pdf Model: jbxai	{ "brand":["Globi"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://connect.intuit.com/t/scs-v1-b510207a562d4f598e9904227305b55d014f5d8c2e2c4e6f81e5a32c1643cba2522bc5b215a943a3afdba3d550857c35?cta=viewinvoicenow&locale=en_US Model: jbxai	{ "brand":["intuit quickbooks"], "contains_trigger_text":true, "prominent_button_name":"view invoice", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240918195656Z-175.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	1.9064771199455504
Encrypted:	false
SSDEEP:
MD5:	88C8460825ED74062F7CC0896CF5ACA8
SHA1:	E560B0684AC5ECE3D66A626BBB1EA03C783E487D
SHA-256:	F99F303BB6ACEDB4ABCBE14354ABB3AE4DD18AF90E3DA142644258263DAE4EE7
SHA-512:	6340512A83BFF8776188167689E8FB2DEFB4CDC79196E3A9154611225B00156ED5C038802D88342B5E981A7A47C5FCF15BAEE6B04F20D16BB013B8ED9C3F08E6
Malicious:	false
Reputation:	unknown
Preview:	BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.44505409661201
Encrypted:	false
SSDEEP:
MD5:	7E631822358131E9A4B7D978FDF253CE
SHA1:	180FE9E2E91F6B6201FAAE83AB257678FDB067B9
SHA-256:	84B5BC558A73E85B7938FB1665363FE9BE14176FEE16BBB7C8ABFE536064C97B
SHA-512:	93CC8526D987B26D1F93E86C42E877CEA6952083E7921DC1A81A4522E0454D831DAFF91CDD31F9EE6497DFCC2A6975CE53ACAB3B54B1C3C654E24B6939D45377
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2156703010895384
Encrypted:	false
SSDEEP:
MD5:	6825C113A8179BACEC8B7683E44DE353
SHA1:	59244DBD0AD5AE2E6D40384BF2366AE3CB9AB080
SHA-256:	23D57FB30935F19DBB5A66C0B7B95FDADA2E3E0621A54ED261708D0E36D224EA
SHA-512:	4C97D483207A87D3E4CE54AD9AA6043C754A7A6F034AB53D79C268F331214259E0EE4DC10AD56819CC366076C5F5F0E026EE0498ADE7E4F69D0D189CD6F2D838
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....!\.2........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	unknown
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2147337192094576
Encrypted:	false
SSDEEP:
MD5:	CB16E2494A4182434F2BAF40A2239B26
SHA1:	58D0E89D16FC380E2DEE11643CA3FCCDFB4476C9
SHA-256:	DDA55DD235E7C3C7ACC449BC61EAD52397408F4003B28DBBFC2AF301A3482E1C
SHA-512:	2ED996DA6384510A7BE091C135604122FC4DEFD545B48F1FB47DC648863702FFFE66F708EC2930F82B7F779838CF8692F40F77DDBADE981D48AEE00E6942CE9D
Malicious:	false
Reputation:	unknown
Preview:	p...... .........d......(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.389401458234085
Encrypted:	false
SSDEEP:
MD5:	672421A0D213690AA771B1984B426EFB
SHA1:	9EA0535031DDB3D082145F709C587F02A19B583F
SHA-256:	770897D03D4A22EC0BBCE6416FD23D020F0E6384C69BB8680171A1F9CA19E91F
SHA-512:	EBCA40372A6DCD9C56E14C3622BD7B1FFAFA4AB543DD1B100C10A28DFFBE0ADBACCF3ECCFD787B07D0F55E672A410906F0D6D61B0B5D47B579FDFA4AEE4A4180
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.338817932296024
Encrypted:	false
SSDEEP:
MD5:	111A41E9B5F0B2565BC209B2EF3CAE8E
SHA1:	E9ADE3F0DFC5EFAB43EF4CDA314B5B28DBB9EE89
SHA-256:	EE9886BE99B98428F2AF67746021027A396E0FE67ABE5E0B43C51AEB9E30F7CA
SHA-512:	64DB014BB20FEA2C1194B96997BE89A655D1094F6244E0D35C13681984126BF247457B455702215A5466521ED3B4BC31A9E7FD4F509A6CE049C0AE029EB40F83
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.317077427653831
Encrypted:	false
SSDEEP:
MD5:	8CFCDA5AFA85DC2B1486224C002EAC59
SHA1:	476291210D0FE22B58386AA97DDA4CAEE81FB730
SHA-256:	95297CE978FB75477BC9F81530F867BCA36CB166254089000A3E401196694BB2
SHA-512:	8A1A780AD9BA84B60A44CAE25F910188E5A2FD03FE946EBAF1F1216A37E6A790176AEE95346E50466B2778C23D37858AF869F119885A72B2EEA34256610945C7
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.376411558556075
Encrypted:	false
SSDEEP:
MD5:	C8B11860F3772499EB3A32DB0CB30226
SHA1:	8B2AC3D219A2B2EA94FD6A08A44D3C5D20D72D1B
SHA-256:	D42C975BFBAAAE66C60BBBC5554116B1B0C3494D01A4D3284D6FFF816B5335C3
SHA-512:	E18031AD547D8399ACFC163C7C278C8DC049CB2A0662CECD76AAF566BE1248E9934025DAB772454B9A79A9A7123AB63B42556AAE1ADA4157D1C4E8C084AEC093
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	5.673552659508506
Encrypted:	false
SSDEEP:
MD5:	F83176371A025888631D598776DE933E
SHA1:	0DC03ACF22A84256CDF6EBE9AB13184041483B49
SHA-256:	E1A8837B8460B6DD520B9FF2F2350E75A315E60A38A4346A1E645950C5E9F323
SHA-512:	272159B7D15C5D8AB2324E08BFE9DBEFDDCD9F46458DE53B1FF97B0B2A70253BE47387EEC2FA621E57A29D00DDC497E8D7F564A3EA5ED5939EB4E03570A8E869
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_2","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"afb9c2a3-eaf4-41f9-9d73-768e72f72282","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgZmlsZXMgdG8gYW5kIGZyb20gUERGXG53aXRob3V0IGxpbWl0cy4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingSc

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.662174092425733
Encrypted:	false
SSDEEP:
MD5:	26027C5E4748A6340E1E01D34DB24041
SHA1:	709351DA0109FE397663DC259C5DD0D07FCF056C
SHA-256:	6BE2AB3A5C3B017A725499EF136185C8DE9033FFC62EF00E46B5855FBE1AED01
SHA-512:	7090F4AE537B52DE757A068DD65D746EF78FE6CAA2DF54E6990EDB3723CFD6EFBD590C4BD18C641C2D08D93AE2B1B6D5BC85C07A049C262B6887734959DE7D24
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.326995962102163
Encrypted:	false
SSDEEP:
MD5:	7A6052FF450316356D0D536D5C6FC134
SHA1:	B15D47C1C87630873911405BBCBD92973F496528
SHA-256:	00060594A1F8E8563A5542E169922B4D08A7225C1EDAE0C8B62B9B91CB8B723F
SHA-512:	0AF2B3F7258D03DD4ED6ED5DAB26A5F4A66B261EC772063338705155E5807D13E06D7F2961286AC35DCDFC2E43294FDC5CCFD11FC75380E11A0A297CF7662D2A
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	5.654870753549781
Encrypted:	false
SSDEEP:
MD5:	633313ABACC26F8302A35D4FD9693BC7
SHA1:	FF851223F5C4191C21B07530E526FA1BA38C71C2
SHA-256:	119F42A17AC5E1D543C737FD683D8EFB638480B3B80F670C110EE75478A93524
SHA-512:	583425B8DF9191E3F2E9CFC341FB8C50B106DA60F36EB98BAAFA5237303B3A7745C45C08E6EE8027B141AF35B3F06A29E729E4538651961460CB425910F2D2D1
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.703255120501091
Encrypted:	false
SSDEEP:
MD5:	3969179BE2313B42BCB708E30C2D4CBB
SHA1:	F481C6163F738CDB32C8CA0ACAF2E19CA9322850
SHA-256:	669BF8A0B64851B9D2BEA0FA498A59E7B879D377D2DEA115ED29DBF354FF2B78
SHA-512:	B1F612A89D7A39994D59C521975A4E8C0D2BFD03541A6E151806AC0E935D6BBE7582B43D1673F40B13664AF4B0D3C2AA8B24B3ADE2E4D488B754DC087BAD4244
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.333854265811992
Encrypted:	false
SSDEEP:
MD5:	7435402D7CD0FDBCE67E3C2A33EC27C5
SHA1:	698629ED835B90E3946AE9D6708451976E7E51E3
SHA-256:	4881F43E9958316380218BC9692739E9E79129906CC8959D49DC0D9A457E166A
SHA-512:	834E63B2D32DC2B8496FD8F694B5B2CEB0683FFD11566A61ABB8C48432E75D7C474AF1E341E67BE1DD72B7B1A3FC535052D6D97BD1103F8C800549C74B71CC21
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.779105263288398
Encrypted:	false
SSDEEP:
MD5:	FEBC4A90A342DDE156E523F5E73ABCEE
SHA1:	C3589783CADD795A2EF540DA9ECDB20640223DC7
SHA-256:	DF3B26A3EB4DA56FA7A8C484EA56C815A94564A321BCA4AC9569B73ABB845F42
SHA-512:	1E6B9D869EF92DB4599C826A9329744AE55B5A1E0B622061B46A0789634BFB51288C987A2C014D49D3986E95A9859C8631299E386193E2BDE6CC20C943CC3A59
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.317168688119449
Encrypted:	false
SSDEEP:
MD5:	97988C343F45B5F939A1B00AECF17F7E
SHA1:	FF88E93F72BD106CE3995B7B74987547101CCE11
SHA-256:	2BAE9A5D510079AD1661D6CA1840D3C9722F1365158D9D9D64E1D6A82CDCF844
SHA-512:	8FFA857D6A7CC34CEF5415F12C6A051D701CA102382A76A946A778B167E3970DC7671C54C55E086D7110A73806F22427B2E735CF21FC2D7FEFA52B60FCA4D745
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.318660750907502
Encrypted:	false
SSDEEP:
MD5:	5927F95B8319257F4E75FC5F63E6A1BC
SHA1:	4DB8C856AC033AA6B195B6FEB96B221F91E7D52F
SHA-256:	ADD3145786DBCEE038397DD1952AF7922AB00DABA130BC0A492762836D1D38DF
SHA-512:	5845ECD1F792178B0CF34267484DA732BA233049FF95804F90C4B9103E499A5AF9D37627CA9B3911A3E8014AA7E6CF3378066B9B4DDCC11FE8F8787681B27B62
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1058
Entropy (8bit):	5.662304138142374
Encrypted:	false
SSDEEP:
MD5:	93FBAD5385DBF07280500A39DC45682D
SHA1:	C4441D6806B792FC1CCA8B9725DDBB491BE88B82
SHA-256:	8DD87E77D3FD07B6A1CF1817896A66E31281623D8225B42F91FAFCD0477FF389
SHA-512:	14E5B53F8710A8C1F24E91FEC40BFB907E42E2A8536E4B3C18A34909C1690B90470701DE8E9CA5ECF4B3A29F7C6D213061C31F1178202C4D6AFB5F0C6546E105
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_3","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"ece07729-7db6-4f20-9f8d-7976ad373049","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlNlbmQgZG9jdW1lbnRzICYgZm9ybXNcbmZvciBmYXN0IGUtc2lnbmluZyBvbmxpbmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.293919062387662
Encrypted:	false
SSDEEP:
MD5:	E8D063892A12C3126851031AAA925B68
SHA1:	D497CA95D692227F9803DADFBD1EBB6420450109
SHA-256:	A2D0A60885216465BE05353CA0068A5796C1869CC0C0E6EB1BC91BF653964E34
SHA-512:	977FA89DB93515BD375504C0114016B1BF4D984F9E4DC473C36745B089A37756D93E4FCDEFA117F6A42CE3D48FA4FC782D58BDE045F1ADFA08BCD1151DAA7F85
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.373669696663354
Encrypted:	false
SSDEEP:
MD5:	0471EDE1215A9BF5593E1491B5CBF94C
SHA1:	F078E271C222C0A4CA0B4ABACBF369AAE90388B3
SHA-256:	9E734170AF3CBC7C19E73A998822963646BAF9F56C3218759A4C5C84171AFFF2
SHA-512:	BF3F719889C2779D28CCB37E12D6297C84C40D0E7293CE3512E31779A2CC1804327BCC9B679639338EF53696B857FB8CBA37A2FB2B986CE1D15FB70A801CE9D6
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"3d627dc1-bf51-4747-9230-e52d65b591c5","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1726868097948,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1726689417975}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Reputation:	unknown
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2818
Entropy (8bit):	5.136347543655631
Encrypted:	false
SSDEEP:
MD5:	0C8892F28FB58A72250E6560CB98A936
SHA1:	8BFF92427590360E496A2088C61DB0166E3DF803
SHA-256:	DCC41C8DB3DE238C4C319F417143B7BD63D57909E865DBD059117A3AE0B1294E
SHA-512:	7D80FB4C3A55BCD978BEDF802717190F8EAB8A22C67FAA8256AB7CBF6B024AA5D895A1646EC736B12F53FED899412AEDF3DFA8737DB0D983FE6D0F7F58BD8C9B
Malicious:	false
Reputation:	unknown
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"75a1abf345eff9404ce4c8102d78aa20","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1726689417000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"19bcf31f468a885d8a5634b80657ab07","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1726689417000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1c802fa071b4d3a71fda8f67b72c9016","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1058,"ts":1726689417000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"0a8c881b2e6005d4da8049be17b7489f","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1063,"ts":1726689417000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"1cfca430ee117bfc8fa7cbb9b482eea8","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1726689417000},{"id":"Edit_InApp_Aug2020","info":{"dg":"2642afd3867b49a466949a19c09bca97","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 23, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 23
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.357637218779789
Encrypted:	false
SSDEEP:
MD5:	14873FCDDCAF719F62F1D4CD75403A52
SHA1:	1350DF36704DA97249D3627BE1F6538A12981014
SHA-256:	287FCB06CA9A7845E6333D2E5B8DB5381745921140F9C4E1EE6561BE4CBF0C98
SHA-512:	E4A94CD1A4DABE04901B0C87595B6B4DC3C979FD90DBFFE800E36BE02B66AD4F1DBCA5205EB712DA22C004F767452B4F3F7EB14A7CDCC1752506A0760EB91929
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8327329347799497
Encrypted:	false
SSDEEP:
MD5:	A20F2F04DBC65A731D96EF9B1915F16F
SHA1:	D1D775FEB32243298EE260AF79E405EDBB4EADB5
SHA-256:	7217F8D09266476310555D89B2EE09FCA8A1FD1A50DAA24C42F80552FC1DA251
SHA-512:	D788E4D9FF901384FA798CAFF118C2D03619EFEDA880016B8201EB3A1467320ED9ECF68730BBE9C190A82159FB0679B0A78069DE5D49D789656BEE0E3DC1C170
Malicious:	false
Reputation:	unknown
Preview:	.... .c.......\|.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././.-.-.-.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	231348
Entropy (8bit):	4.391816716876814
Encrypted:	false
SSDEEP:
MD5:	054CC2929F896CDD4642BDAE53558726
SHA1:	67DF1A212DF1AB0A5E597F1DF7167AB2D9E1209B
SHA-256:	65B2F75C66FB75683257EF3FB25333ACD028ACA084FB4D493ABD680AF8AA283F
SHA-512:	767BAEA9EBFF29F20313E99C4EC22280C7BF1A3123B37B36F41C9F1CD3F72F711896C8EE78A4B1B10F9BF0A6D23EB32159FCDFB4BD1E6D0BC36736D381575FCA
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ...l.........SM01X...,...@.[.............IPM.Activity...........h...............h............H..h..u........g...h.........I..H..h\tor ...AppD...hh...0...P.u....hz..............h........_`.k...h6...@...I.+w...h....H...8..k...0....T...............d.........2h...............k..............!h.............. h.Z.%....h.u...#h....8.........$h.I......8....."h.t.......s....'h..............1hz...<.........0h....4.....k../h....h......kH..h....p.....u...-h .........u...+h.........u......... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Reputation:	unknown
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Reputation:	unknown
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\NOJ14QF0\INVOICE_3388_from_MAZZITTI SULLIVAN EAP (002).pdf:Zone.Identifier (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	B4E28BC3BDFF6831578DCD185D09B624
SHA1:	953FB62FD801A4ECB8F8C672F0084EBE086531E0
SHA-256:	25041819B934FBE134D6239923B81DBA099D30115BBE29070FEF78FC3A7CD21F
SHA-512:	C3B3C395F257747EA42E9E4959C11E13E2814CD1952225AA418A713082D2446C3572165205BB3D7A3713FD8C5D549E8669C64DE4718539569BDD0844580A4384
Malicious:	false
Reputation:	unknown
Preview:	%PDF-1.4.%.....1 0 obj.<</Creator (Chromium)./Producer (Skia/PDF m112)./CreationDate (D:20240903134840+00'00')./ModDate (D:20240903134840+00'00')>>.endobj.3 0 obj.<</ca 1./BM /Normal>>.endobj.6 0 obj.<</Type /XObject./Subtype /Image./Width 371./Height 200./ColorSpace /DeviceRGB./BitsPerComponent 8./Filter /DCTDecode./ColorTransform 0./Length 42448>> stream.......JFIF.....d.d......Ducky.......d.....C....................................................................C.........................................................................s..............................................X..............................!..1A"Q..aq.2B..#$9rx.......%358RSt......&():WYbcu.wy......................................T.........................!.1."A..Qa.#2q..Bt....$35Rbr..4CD....6cs......STUu....%..............?...)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..+.j&...G"..B...1NC.r..r..%9.Q....).{...+.)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\NOJ14QF0\INVOICE_3388_from_MAZZITTI SULLIVAN EAP.pdf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	66225
Entropy (8bit):	7.963376605387259
Encrypted:	false
SSDEEP:
MD5:	B4E28BC3BDFF6831578DCD185D09B624
SHA1:	953FB62FD801A4ECB8F8C672F0084EBE086531E0
SHA-256:	25041819B934FBE134D6239923B81DBA099D30115BBE29070FEF78FC3A7CD21F
SHA-512:	C3B3C395F257747EA42E9E4959C11E13E2814CD1952225AA418A713082D2446C3572165205BB3D7A3713FD8C5D549E8669C64DE4718539569BDD0844580A4384
Malicious:	false
Reputation:	unknown
Preview:	%PDF-1.4.%.....1 0 obj.<</Creator (Chromium)./Producer (Skia/PDF m112)./CreationDate (D:20240903134840+00'00')./ModDate (D:20240903134840+00'00')>>.endobj.3 0 obj.<</ca 1./BM /Normal>>.endobj.6 0 obj.<</Type /XObject./Subtype /Image./Width 371./Height 200./ColorSpace /DeviceRGB./BitsPerComponent 8./Filter /DCTDecode./ColorTransform 0./Length 42448>> stream.......JFIF.....d.d......Ducky.......d.....C....................................................................C.........................................................................s..............................................X..............................!..1A"Q..aq.2B..#$9rx.......%358RSt......&():WYbcu.wy......................................T.........................!.1."A..Qa.#2q..Bt....$35Rbr..4CD....6cs......STUu....%..............?...)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..+.j&...G"..B...1NC.r..r..%9.Q....).{...+.)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\NOJ14QF0\INVOICE_3388_from_MAZZITTI SULLIVAN EAP.pdf:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\open[1].gif

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	GIF image data, version 89a, 1 x 1
Category:	modified
Size (bytes):	43
Entropy (8bit):	3.0314906788435274
Encrypted:	false
SSDEEP:
MD5:	325472601571F31E1BF00674C368D335
SHA1:	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
SHA-256:	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
SHA-512:	717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\af7e8ade-9f88-4259-ada9-93f7bddaf1cf_template[1].jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 371x200, components 3
Category:	dropped
Size (bytes):	42448
Entropy (8bit):	7.966088056191233
Encrypted:	false
SSDEEP:
MD5:	00290A802AD82661FCAA8AB4199AE0CF
SHA1:	5657625EB72CE74743163EAC3B20E33362325293
SHA-256:	B91C09DC2D49760D26EAAD7FB6E28B11BF863945C13515E07242D0F762936302
SHA-512:	B6877A9DE5D93E1081CDF4587B8D4F3F670875AAA6C4CA1A8A995ACA141D794B1EE41CA47F84FF2739E210272CD488C20A5196063DF632BD7E18E7301A3059D9
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....d.d......Ducky.......d.....C....................................................................C.........................................................................s..............................................X..............................!..1A"Q..aq.2B..#$9rx.......%358RSt......&():WYbcu.wy......................................T.........................!.1."A..Qa.#2q..Bt....$35Rbr..4CD....6cs......STUu....%..............?...)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..+.j&...G"..B...1NC.r..r..%9.Q....).{...+.)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb.A..C...=...........h.{..[......v....v..."...x.........:..gK..i...0..&BN......O...v...i.%..T..d....v....".b..E...0-.....Af'.yG.>.0?X..LO..._( n..R6j6>b.A..D.&.Qr.....%....1.`....z..eRr..uTA....*.3...`......0 ....pA..A..r+n.0..A... .. ..#.....U.)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\scs-v1-b510207a562d4f598e9904227305b55d014f5d8c2e2c4e6f81e5a32c1643cba2522bc5b215a943a3afdba3d550857c35[1].gif

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:
MD5:	C2196DE8BA412C60C22AB491AF7B1409
SHA1:	5FBD472222FEB8A22CF5B8AA5DC5B8E13AF88E2B
SHA-256:	6ADC3D4C1056996E4E8B765A62604C78B1F867CCEB3B15D0B9BEDB7C4857F992
SHA-512:	84E24A70B78E9DE9C9D0DFEB49F3F4247DBC1C715D8844471EE40669270682E199D48F5FBEC62BD984C9C0270534B407C4D2561DD6C05ADEC3C83C1534F32D5C
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\open[1].htm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.459637879457414
Encrypted:	false
SSDEEP:
MD5:	F5D40B7259645010F9A248858AD14178
SHA1:	B3051D17A6EC8C9E166BF09A62B48261AB86957B
SHA-256:	7F5007068D2B56EA9735E2490D60CFF2E72CAE312024AC1F6C91158EBA47D05D
SHA-512:	1E82BC2D067F726670B3E6054D73E57868F6E7C50EB979696BF927DAEEF699F2D8F8DE201E8252B86B0E9F86DC69E5037FC9FA08EF6C271B033F29D4F0F4C1AA
Malicious:	false
Reputation:	unknown
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>CloudFront</center>..</body>..</html>..

C:\Users\user\AppData\Local\Temp\MSIe0ab2.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5441332632710916
Encrypted:	false
SSDEEP:
MD5:	4CF64B4D79950A47810407D09E9B898C
SHA1:	5D3A5D7023241A75A259CE367DB7ADB2A8AD83FB
SHA-256:	340D02C341FDC6F857F78227724383B5ECB86A2389B89DC545F56C81A863EF2C
SHA-512:	F29F71F45A5904D9DB3DB509ED7082CD0493848A61E57DF387D24E7FF91B163FBAF5CA0978DBE9DBF38E04D150679E44F87B5D0A365637C90D2BF3E231F664FB
Malicious:	false
Reputation:	unknown
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.8./.0.9./.2.0.2.4. . .1.5.:.5.6.:.5.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-18 15-56-54-266.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.359827924713262
Encrypted:	false
SSDEEP:
MD5:	06DEAEDB81D09FD8FB5FF668D8E09CB2
SHA1:	28A02BCBD5975117B97A08AFB049F2C94F334726
SHA-256:	D98DE785425112A2D7A41B16073812FA4FA4955F2D5139AE87C9A5FBC4717D64
SHA-512:	948E3B56E5A8D818A5FE9D74B82A898F7264909ADF2C49E5D096CB90F4D28ED95990545A4857933F0E06D493AA0F6D41F6109C74B44BC0E4B84346B519681936
Malicious:	false
Reputation:	unknown
Preview:	SessionID=c98ebd97-9477-4d7e-bd0c-12efa5f01bab.1696586972755 Timestamp=2023-10-06T12:09:32:755+0200 ThreadID=6536 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=c98ebd97-9477-4d7e-bd0c-12efa5f01bab.1696586972755 Timestamp=2023-10-06T12:09:32:756+0200 ThreadID=6536 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=c98ebd97-9477-4d7e-bd0c-12efa5f01bab.1696586972755 Timestamp=2023-10-06T12:09:32:756+0200 ThreadID=6536 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=c98ebd97-9477-4d7e-bd0c-12efa5f01bab.1696586972755 Timestamp=2023-10-06T12:09:32:756+0200 ThreadID=6536 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=c98ebd97-9477-4d7e-bd0c-12efa5f01bab.1696586972755 Timestamp=2023-10-06T12:09:32:756+0200 ThreadID=6536 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.428922875147178
Encrypted:	false
SSDEEP:
MD5:	782F88FDF70654D8B25598AA9EB5B379
SHA1:	C3A9A142235BAD4DB48A92202C888ED81EDE2863
SHA-256:	A0920FC1D940A8BD434D046D9CE870EFB1E9EE24D1033958505F25E1980C1CA9
SHA-512:	560E540244F52BE0DED8C5D9A337C81196986F5E733BD2090CBDAF33EEF1CA45042F08E6BC04797D65BCB7B5D461E0C664CA5C6B1A5FA08402DCE102DE895647
Malicious:	false
Reputation:	unknown
Preview:	06-10-2023 11:44:59:.---2---..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 11:44:59:.Closing File..06-10-

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Reputation:	unknown
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Reputation:	unknown
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Sep 18 18:56:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9883724401422613
Encrypted:	false
SSDEEP:
MD5:	40757E85C35AA35766D0BFA241E2FEE8
SHA1:	17F107DF0949D5038F33B624D9FBA6D569A3965F
SHA-256:	DAAD23D7003D9B6F06A5BA828B6A67E82B199F8E2D424530641B56265E36D161
SHA-512:	A6E6206F5D2D99F3E0415806266A831BF9CB6A70A3810DAD3D025CC62CB36A2E9F06CB7844D6A8772DD7F9FE2E2D3D7497097E7B3131180C0D46235027D87C09
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....n...........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I2Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V2Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V2Y......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V2Y.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V2Y.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............2.a.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Sep 18 18:56:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.006121276730994
Encrypted:	false
SSDEEP:
MD5:	E01EBE2203DE7F7ABEC5B9CB73C4D12A
SHA1:	D1EA69899AEDA0FE2B4041E8C6782D2BAE4BF546
SHA-256:	92F050DEE85463A13F8B8B7A3F0866F98801453C1B917E586D933B2CFD7E0ADF
SHA-512:	B7E6E3982E2260EC597C9F7587533FDDF4826D7FB10D88F5246BD1BA43032A9AD0A62660B6C9A2CFD3B0648008DD50A390445BE5EDD877AF232289E694308124
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,...............y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I2Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V2Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V2Y......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V2Y.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V2Y.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............2.a.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.014636517841176
Encrypted:	false
SSDEEP:
MD5:	BB3C041BA93E3A46829171E34C0C7B18
SHA1:	D47BB7B91A6AAF31DAD20E427F2B256671523452
SHA-256:	8EED03131868568119657FE1059DDA429370C1F393A14978CF4B05C43F3663DE
SHA-512:	0EFD3648590C0E874FAE5C7E4A8428C62F274F956099A5F2CA9B0986FDEB0A25D4339D3612618929D0828EC020238DC493F4031E2FAC1A72FBDE89020B5FA0A0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I2Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V2Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V2Y......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V2Y.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............2.a.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Sep 18 18:56:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.004869315192377
Encrypted:	false
SSDEEP:
MD5:	A677D637445DD145BD187126712BEDA7
SHA1:	B1F0028FDEAB7384CB0441DE1E55C273E0666CA5
SHA-256:	0DD80800E0343E07D8BFD926B926B4D55EF2020C6B1EFF69655885D7B4A04346
SHA-512:	83A080DA9579A8F859E997E79E93A9085C761F9021C9D92E0FFDD9790C802E4989D59F374F8C5FB5689E10CA4471E9FFC3C0F9FEFFE1B0E947929ED13CB6DA64
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....."..........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I2Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V2Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V2Y......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V2Y.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V2Y.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............2.a.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Sep 18 18:56:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.993856513080987
Encrypted:	false
SSDEEP:
MD5:	AD33DD6B0429FA8F0C2E5A161081531A
SHA1:	C5B4E91401C28C3C75088FB45AFEB688D5ECA728
SHA-256:	C562DF9A4472A5C7FE3DED7EDFBCB1E53AA71D5438C1917487856FE759103F23
SHA-512:	B6DD19AAC480546AB9CB9E438BD59A48D8EC9911CEA249A40A4ADDA0BC8558D80382A51E4169F95FCED59E7A7BCDCFC6C84A97DC9E44C19F1B43BD35B095BBCD
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,...............y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I2Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V2Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V2Y......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V2Y.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V2Y.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............2.a.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Sep 18 18:56:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.00333828566394
Encrypted:	false
SSDEEP:
MD5:	3D7D541A2B3E823C13D513E357DB4B21
SHA1:	FB1CCAC5EB146883EB998557AB9BBF6365C6BF00
SHA-256:	EB71E989EFBF173DDDBD8203D91DB1CB78DF47E4C6DD938B1F9A3A2416B55FC0
SHA-512:	BFCB530B536B186B5B393BC77B0CABFF7C11949BCB13186692936E10C61123BCA102246B9074D842B64ED735DDEF99694266597D1BA696CFA6DB291A12010712
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....0..........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I2Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V2Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V2Y......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V2Y.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V2Y.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............2.a.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\352f9bb0-8cf3-4720-b6c4-c4f4090c72c8.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	66209
Entropy (8bit):	7.963735682524246
Encrypted:	false
SSDEEP:
MD5:	2B40FF9985516E865BBC68E14C64C3C6
SHA1:	C5BB34DED0D5CB550AD504E8C1DA30B61CDE6B98
SHA-256:	890A0CE8D7BDC357398D3DEEF05286F7A6B114CBD75B6F8F3DFEB20843514724
SHA-512:	55A15A531DDA13E48276404C1933901DB90D6627CD96C4EE40827A651A9225651F0A382AA4CF2602DBECDE3110509AE5A50DF570898E6A58D16C4759D4525D97
Malicious:	false
Reputation:	unknown
Preview:	%PDF-1.4.%.....1 0 obj.<</Creator (Chromium)./Producer (Skia/PDF m112)./CreationDate (D:20240918195638+00'00')./ModDate (D:20240918195638+00'00')>>.endobj.3 0 obj.<</ca 1./BM /Normal>>.endobj.6 0 obj.<</Type /XObject./Subtype /Image./Width 371./Height 200./ColorSpace /DeviceRGB./BitsPerComponent 8./Filter /DCTDecode./ColorTransform 0./Length 42448>> stream.......JFIF.....d.d......Ducky.......d.....C....................................................................C.........................................................................s..............................................X..............................!..1A"Q..aq.2B..#$9rx.......%358RSt......&():WYbcu.wy......................................T.........................!.1."A..Qa.#2q..Bt....$35Rbr..4CD....6cs......STUu....%..............?...)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..+.j&...G"..B...1NC.r..r..%9.Q....).{...+.)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)L

C:\Users\user\Downloads\downloaded.pdf (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	2B40FF9985516E865BBC68E14C64C3C6
SHA1:	C5BB34DED0D5CB550AD504E8C1DA30B61CDE6B98
SHA-256:	890A0CE8D7BDC357398D3DEEF05286F7A6B114CBD75B6F8F3DFEB20843514724
SHA-512:	55A15A531DDA13E48276404C1933901DB90D6627CD96C4EE40827A651A9225651F0A382AA4CF2602DBECDE3110509AE5A50DF570898E6A58D16C4759D4525D97
Malicious:	true
Reputation:	unknown
Preview:	%PDF-1.4.%.....1 0 obj.<</Creator (Chromium)./Producer (Skia/PDF m112)./CreationDate (D:20240918195638+00'00')./ModDate (D:20240918195638+00'00')>>.endobj.3 0 obj.<</ca 1./BM /Normal>>.endobj.6 0 obj.<</Type /XObject./Subtype /Image./Width 371./Height 200./ColorSpace /DeviceRGB./BitsPerComponent 8./Filter /DCTDecode./ColorTransform 0./Length 42448>> stream.......JFIF.....d.d......Ducky.......d.....C....................................................................C.........................................................................s..............................................X..............................!..1A"Q..aq.2B..#$9rx.......%358RSt......&():WYbcu.wy......................................T.........................!.1."A..Qa.#2q..Bt....$35Rbr..4CD....6cs......STUu....%..............?...)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..+.j&...G"..B...1NC.r..r..%9.Q....).{...+.)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)L

C:\Users\user\Downloads\downloaded.pdf.crdownload (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	2B40FF9985516E865BBC68E14C64C3C6
SHA1:	C5BB34DED0D5CB550AD504E8C1DA30B61CDE6B98
SHA-256:	890A0CE8D7BDC357398D3DEEF05286F7A6B114CBD75B6F8F3DFEB20843514724
SHA-512:	55A15A531DDA13E48276404C1933901DB90D6627CD96C4EE40827A651A9225651F0A382AA4CF2602DBECDE3110509AE5A50DF570898E6A58D16C4759D4525D97
Malicious:	true
Reputation:	unknown
Preview:	%PDF-1.4.%.....1 0 obj.<</Creator (Chromium)./Producer (Skia/PDF m112)./CreationDate (D:20240918195638+00'00')./ModDate (D:20240918195638+00'00')>>.endobj.3 0 obj.<</ca 1./BM /Normal>>.endobj.6 0 obj.<</Type /XObject./Subtype /Image./Width 371./Height 200./ColorSpace /DeviceRGB./BitsPerComponent 8./Filter /DCTDecode./ColorTransform 0./Length 42448>> stream.......JFIF.....d.d......Ducky.......d.....C....................................................................C.........................................................................s..............................................X..............................!..1A"Q..aq.2B..#$9rx.......%358RSt......&():WYbcu.wy......................................T.........................!.1."A..Qa.#2q..Bt....$35Rbr..4CD....6cs......STUu....%..............?...)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..+.j&...G"..B...1NC.r..r..%9.Q....).{...+.)LR..1Jb..).S..)LR..1Jb..).S..)LR..1Jb..).S..)L

Static File Info

General

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	6.351375251950434
TrID:	Outlook Message (71009/1) 58.92% Outlook Form Template (41509/1) 34.44% Generic OLE2 / Multistream Compound File (8008/1) 6.64%
File name:	EXTERNALInvoice 3388 from Mazzitti Sullivan EAP.msg
File size:	168'960 bytes
MD5:	de35cce729f4b9fd1c121a8f30ca8c90
SHA1:	ce6b7b19656364b2be8bc455d0048c85ff2cbdd1
SHA256:	7820a2b4ef4b37d81d5c211dcd9a032fb55214676703a4a71db784eda5e59df8
SHA512:	3f2400bedd2ce58e247a95fed0d38f9adac6f9bf954897cbb150e8ae884cf71c088186a3c2e16a6efa6fe36a0e4263fc4a7280fed25eccb051fcaa309f76bfc7
SSDEEP:	3072:m790YoowyeouRZr+6q2XFYKRZo+HLmeAJMOFtZi1zLXWpAcSlsc01:cqNPZrxmemeAxiZMfSl
TLSH:	7FF33C2539EA5605F2B7DF3189E6A097893ABC836D149A5F31C1330E0672941EC72F7B
File Content Preview:	........................>.......................................................p..............................................................................................................................................................................

Static Mail

General

Subject:	[EXTERNAL]Invoice 3388 from Mazzitti & Sullivan EAP
From:	MAZZITTI & SULLIVAN EAP <quickbooks@notification.intuit.com>
To:	sessic@coxmanufacturing.com
Cc:
BCC:
Date:	Tue, 03 Sep 2024 15:48:42 +0200
Communications:	EXTERNAL EMAIL This email originated outside of Cox Manufacturing Company, Inc. Please exercise caution when clicking on links or opening attachments. <https://ips-logos-cdn.ips.sbg.a.intuit.com/af7e8ade-9f88-4259-ada9-93f7bddaf1cf_template.jpeg> <https://connect.intuit.com/icnportal-server/rest/sale/viewed/scs-v1-b510207a562d4f598e9904227305b55d014f5d8c2e2c4e6f81e5a32c1643cba2522bc5b215a943a3afdba3d550857c35> Your invoice is ready! Total $1,066.56 BALANCE DUE$1,066.56 Dear Cox Manufacturing Company, Inc., We appreciate your business. Please find your invoice details here. Feel free to contact us if you have any questions. Reminder: Should you have an update to the person receiving invoices, please let us know so that we can update. Reminder: Please keep us updated on your employee counts so that we can invoice appropriately. Have a great day! M&S EAP View details Contact MAZZITTI & SULLIVAN EAP to pay. Or, to pay via ACH, please use the following Routing Number: 031308807 Account Number: 19010644 MAZZITTI & SULLIVAN EAP 479 Port View Dr Suite C30 Harrisburg, PA 17111 payments@mseap.com <mailto:payments@mseap.com> www.mseap.com If you receive an email that seems fraudulent, please check with the business owner before paying, or you can forward the email to <mailto:security@intuit.com> security@intuit.com so we can look into it. Read more at security.intuit.com. _____ Powered by QuickBooks 2024 Intuit, Inc. All rights reserved. Privacy \| Security \| Terms of Service
Attachments:	INVOICE_3388_from_MAZZITTI & SULLIVAN EAP.pdf

Headers

Key	Value
Received	from MjMyNzEzNQ (unknown)
SJ0PR20MB5256.namprd20.prod.outlook.com with HTTPS; Tue, 3 Sep 2024 13	50:00
by DM4PR20MB5727.namprd20.prod.outlook.com (2603	10b6:8:105::9) with
2024 13	48:44 +0000
(2603	10b6:802:20::27) with Microsoft SMTP Server (version=TLS1_2,
Transport; Tue, 3 Sep 2024 13	48:43 +0000
Authentication-Results	spf=pass (sender IP is 167.89.82.233)
Received-SPF	Pass (protection.outlook.com: domain of
via Frontend Transport; Tue, 3 Sep 2024 13	48:43 +0000
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=notification.intuit.com;
h=content-type	from:list-unsubscribe:mime-version:subject:reply-to:to:
cc	content-type:from:subject:to;
2024-09-03 13	48:42.218936572 +0000 UTC m=+1092772.978889826
Tue, 03 Sep 2024 13	48:42.178 +0000 (UTC)
Content-Type	multipart/mixed; boundary=b9b56a8e2551a6c56d37898306910a20af5c965453e1f25f6eb8ce1cbb70
Date	Tue, 03 Sep 2024 13:48:42 +0000 (UTC)
From	MAZZITTI & SULLIVAN EAP <quickbooks@notification.intuit.com>
List-Unsubscribe	=?us-ascii?Q?=3Chttps=3A=2F=2Fqbo=2Eintuit=2Ecom=2Funsubscribe=2Fpage=2Ehtm=3Fuid=3D3acd1000-69fb?=
Mime-Version	1.0
Subject	[EXTERNAL]Invoice 3388 from Mazzitti & Sullivan EAP
X-Accept-Language	en
X-SenderName-ClientID	3acd1000-69fb-11ef-856f-910d86b5f521
Message-ID	<GefOj-s2RTesgxdXvmyqkg@geopod-ismtpd-14>
Reply-To	payments@mseap.com
X-SG-EID	=?us-ascii?Q?u001=2ETQRS+SrLOUkPXieRZOLgBaqV8VKp18Pi6+g4+yPtsNYR15xP2T+YUTVlv?=
X-SG-ID	=?us-ascii?Q?u001=2ESdBcvi+Evd=2FbQef8eZF3BuC9tSviz1XiqwH7KmTTvosMv8qxqsj5y2Vx9?=
To	sessic@coxmanufacturing.com
X-Entity-ID	u001.fXpxriuEUg7tew6Rema50w==
Return-Path	bounces+2327135-8178-sessic=coxmanufacturing.com@e.notification.intuit.com
X-MS-Exchange-Organization-ExpirationStartTime	03 Sep 2024 13:48:43.6019
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	04b2ec4a-1625-4e52-ca4a-08dccc1f2032
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	c6c38305-3244-469b-8486-bf030d22f9f9:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	SA2PEPF00003AE8:EE_\|DM4PR20MB5727:EE_\|SJ0PR20MB5256:EE_
X-MS-Exchange-Organization-AuthSource	SA2PEPF00003AE8.namprd02.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Office365-Filtering-Correlation-Id	04b2ec4a-1625-4e52-ca4a-08dccc1f2032
X-MS-Exchange-AtpMessageProperties	SA\|SL
X-MS-Exchange-Organization-SCL	6
RPR	This message appears to be spam.
X-Forefront-Antispam-Report	CIP:167.89.82.233;CTRY:US;LANG:en;SCL:6;SRV:;IPV:NLI;SFV:BLK;H:o3.e.notification.intuit.com;PTR:o3.e.notification.intuit.com;CAT:SPM;SFS:(13230040)(6062899009)(2092899012)(12012899012)(5062899012)(3072899012)(4092899012)(3092899012)(13102899012)(13012899012)(29132699027)(69100299015)(4022899009)(5082899009)(5073199012)(4073199012)(3613699012);DIR:INB;
X-Microsoft-Antispam	BCL:0;ARA:13230040\|6062899009\|2092899012\|12012899012\|5062899012\|3072899012\|4092899012\|3092899012\|13102899012\|13012899012\|29132699027\|69100299015\|4022899009\|5082899009\|5073199012\|4073199012\|3613699012;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	03 Sep 2024 13:48:43.1488
X-MS-Exchange-CrossTenant-Network-Message-Id	04b2ec4a-1625-4e52-ca4a-08dccc1f2032
X-MS-Exchange-CrossTenant-Id	c6c38305-3244-469b-8486-bf030d22f9f9
X-MS-Exchange-CrossTenant-AuthSource	SA2PEPF00003AE8.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped	DM4PR20MB5727
X-MS-Exchange-Transport-EndToEndLatency	00:01:17.1030419
X-MS-Exchange-Processed-By-BccFoldering	15.20.7918.023
X-Microsoft-Antispam-Mailbox-Delivery	kl:1;ucf:0;jmr:0;auth:0;dest:J;OFR:SpamFilterAuthJ;ENG:(910001)(944506478)(944626604)(920097)(826154)(255002)(930097)(3100021)(140003);RF:JunkEmail;
X-Microsoft-Antispam-Message-Info	=?us-ascii?Q?uJLtTCaXhP3wEYSCmDxqRrHN1Hqkmv0puGuUUEIB7McycO5BrTiqhrNPM7Df?=
date	Tue, 03 Sep 2024 15:48:42 +0200

File Icon


Icon Hash:	c4e1928eacb280a2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EXTERNALInvoice 3388 from Mazzitti Sullivan EAP.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240918195656Z-175.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\NOJ14QF0\INVOICE_3388_from_MAZZITTI SULLIVAN EAP (002).pdf:Zone.Identifier (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\NOJ14QF0\INVOICE_3388_from_MAZZITTI SULLIVAN EAP.pdf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\NOJ14QF0\INVOICE_3388_from_MAZZITTI SULLIVAN EAP.pdf:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\open[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\af7e8ade-9f88-4259-ada9-93f7bddaf1cf_template[1].jpg

Windows Analysis Report
EXTERNALInvoice 3388 from Mazzitti Sullivan EAP.msg