Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
20240930_185453_p1uYhraXAa8FqoQDzs1lqwv0Fp3NVQrL.eml

Overview

General Information

Sample name:20240930_185453_p1uYhraXAa8FqoQDzs1lqwv0Fp3NVQrL.eml
Analysis ID:1533554
MD5:3ebbbccf126cae2c648bd2ae4343c1db
SHA1:81dd2b0db304a985d6aec1620b36ee42c1304eef
SHA256:5966fa9ddcaf71a46cad5fbd54ccbf88073b32c8b0c54486bb8875f5a65fc396
Infos:

Detection

GRQ Scam
Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected phishing page
AI detected phishing page (A)
Yara detected GRQ Scam
Performs DNS queries to domains with low reputation
HTML body contains low number of good links
HTML body contains password input but no form action
HTML page contains hidden javascript code
HTML title does not match URL
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Outlook Security Settings Updated - Registry
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 5528 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\20240930_185453_p1uYhraXAa8FqoQDzs1lqwv0Fp3NVQrL.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 3868 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "F399B17B-99B9-45D8-B476-1F239CDFA943" "47D9B38B-CC9A-44E2-BF59-B6AC773CED63" "5528" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • Acrobat.exe (PID: 5860 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\EVFBGGWB\nSmRlxixjVHpBwqQX.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
      • AcroCEF.exe (PID: 1284 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
        • AcroCEF.exe (PID: 7184 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1552,i,14400111012312811602,5881105292900386076,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • chrome.exe (PID: 7852 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.com.ai/amp/clck.ru/3DSSCz?hghghghHGVGvbbgffGFHGJdgddghfhghfgdgdgdgfhgg?sdfsewsrewrettfg MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
        • chrome.exe (PID: 8044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2108,i,6877927691327056616,16865259315949162672,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

HTML

SourceRuleDescriptionAuthorStrings
1.2.pages.csvJoeSecurity_GRQScamYara detected GRQ ScamJoe Security

    Sigma Signatures

    Sigma detected: Office Autorun Keys Modification
    Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 5528, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
    Sigma detected: Outlook Security Settings Updated - Registry
    Source: Registry Key setAuthor: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\EVFBGGWB\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 5528, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    Phishing

    barindex
    AI detected phishing page
    Source: http://a1034295.xsph.ru/vew/ye/worke/LLM: Score: 9 Reasons: The brand 'Bitcoin' is well-known and is primarily associated with the domain 'bitcoin.org'., The URL 'a1034295.xsph.ru' does not match the legitimate domain associated with Bitcoin., The domain 'xsph.ru' is unrelated to Bitcoin and uses a Russian domain extension, which is unusual for Bitcoin's official sites., The presence of a subdomain 'a1034295' and the domain 'xsph.ru' suggests a potential phishing attempt, as it does not align with any known Bitcoin-related domains. DOM: 0.0.pages.csv
    AI detected phishing page (A)
    Source: http://a1034295.xsph.ru/vew/ye/worke/LLM: Score: 9 Reasons: The brand 'Bitcoin' is well-known and is typically associated with the domain 'bitcoin.org'., The URL 'a1034295.xsph.ru' does not match the legitimate domain name associated with Bitcoin., The domain 'xsph.ru' is unrelated to Bitcoin and uses a Russian domain extension, which is unusual for a global brand like Bitcoin., The subdomain 'a1034295' appears random and does not provide any indication of legitimacy., The input fields 'Are you a person?' and '4+6=?' are simplistic and often used in phishing sites to appear legitimate while collecting user data. DOM: 0.0.pages.csv
    Source: https://btcswitch.fun/payouts/HTTP Parser: Number of links: 0
    Source: https://btcswitch.fun/payouts/HTTP Parser: <input type="password" .../> found but no <form action="...
    Source: https://btcswitch.fun/payouts/HTTP Parser: Base64 decoded: {"app_id":1207}
    Source: https://btcswitch.fun/payouts/HTTP Parser: Title: Bitcoin Mining does not match URL
    Source: https://btcswitch.fun/payouts/HTTP Parser: <input type="password" .../> found
    Source: http://a1034295.xsph.ru/vew/ye/worke/HTTP Parser: No favicon
    Source: https://btcswitch.fun/payouts/HTTP Parser: No <meta name="author".. found
    Source: https://btcswitch.fun/payouts/HTTP Parser: No <meta name="copyright".. found
    Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 20.190.159.23:443 -> 192.168.2.16:49709 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49710 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49714 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49848 version: TLS 1.2

    Networking

    barindex
    Performs DNS queries to domains with low reputation
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeDNS query: autecological.xyz
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeDNS query: autecological.xyz
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
    Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.23
    Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
    Source: global trafficHTTP traffic detected: GET /3DSSCz HTTP/1.1Host: clck.ruConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /vew/ye/worke/ HTTP/1.1Host: a1034295.xsph.ruConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: a1034295.xsph.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://a1034295.xsph.ru/vew/ye/worke/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
    Source: global trafficDNS traffic detected: DNS query: clck.ru
    Source: global trafficDNS traffic detected: DNS query: sba.yandex.ru
    Source: global trafficDNS traffic detected: DNS query: www.google.ad
    Source: global trafficDNS traffic detected: DNS query: www.google.com
    Source: global trafficDNS traffic detected: DNS query: a1034295.xsph.ru
    Source: global trafficDNS traffic detected: DNS query: i.postimg.cc
    Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
    Source: global trafficDNS traffic detected: DNS query: autecological.xyz
    Source: global trafficDNS traffic detected: DNS query: btcswitch.fun
    Source: global trafficDNS traffic detected: DNS query: api.coingecko.com
    Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Mon, 14 Oct 2024 19:41:30 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 281Connection: keep-aliveData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 53 65 72 76 65 72 20 61 74 20 61 31 30 33 34 32 39 35 2e 78 73 70 68 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /favicon.ico was not found on this server.</p><hr><address>Apache/2.4.6 Server at a1034295.xsph.ru Port 80</address></body></html>
    Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
    Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
    Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
    Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
    Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
    Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
    Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
    Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
    Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
    Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
    Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
    Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
    Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
    Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
    Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
    Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
    Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
    Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
    Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
    Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
    Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
    Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
    Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
    Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
    Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
    Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
    Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
    Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
    Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
    Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
    Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
    Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
    Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
    Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
    Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
    Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
    Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 20.190.159.23:443 -> 192.168.2.16:49709 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49710 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49714 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49848 version: TLS 1.2

    Spam, unwanted Advertisements and Ransom Demands

    barindex
    Yara detected GRQ Scam
    Source: Yara matchFile source: 1.2.pages.csv, type: HTML
    Source: classification engineClassification label: mal68.phis.troj.winEML@38/44@31/107
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241014T1541060197-5528.etl
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
    Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\20240930_185453_p1uYhraXAa8FqoQDzs1lqwv0Fp3NVQrL.eml"
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "F399B17B-99B9-45D8-B476-1F239CDFA943" "47D9B38B-CC9A-44E2-BF59-B6AC773CED63" "5528" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\EVFBGGWB\nSmRlxixjVHpBwqQX.pdf"
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1552,i,14400111012312811602,5881105292900386076,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.com.ai/amp/clck.ru/3DSSCz?hghghghHGVGvbbgffGFHGJdgddghfhghfgdgdgdgfhgg?sdfsewsrewrettfg
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2108,i,6877927691327056616,16865259315949162672,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
    Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding D66E27792EB7EB29F17C5526FA325F5E
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "F399B17B-99B9-45D8-B476-1F239CDFA943" "47D9B38B-CC9A-44E2-BF59-B6AC773CED63" "5528" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\EVFBGGWB\nSmRlxixjVHpBwqQX.pdf"
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.com.ai/amp/clck.ru/3DSSCz?hghghghHGVGvbbgffGFHGJdgddghfhghfgdgdgdgfhgg?sdfsewsrewrettfg
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1552,i,14400111012312811602,5881105292900386076,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2108,i,6877927691327056616,16865259315949162672,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
    DLL Side-Loading    		1
    Process Injection    		1
    Masquerading    		OS Credential Dumping1
    Process Discovery    		Remote ServicesData from Local System2
    Encrypted Channel    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/Job1
    Registry Run Keys / Startup Folder    		1
    DLL Side-Loading    		1
    Process Injection    		LSASS Memory1
    File and Directory Discovery    		Remote Desktop ProtocolData from Removable Media3
    Non-Application Layer Protocol    		Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
    Registry Run Keys / Startup Folder    		1
    DLL Side-Loading    		Security Account Manager13
    System Information Discovery    		SMB/Windows Admin SharesData from Network Shared Drive4
    Application Layer Protocol    		Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture3
    Ingress Tool Transfer    		Traffic DuplicationData Destruction

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    ⊘No Antivirus matches

    Dropped Files

    ⊘No Antivirus matches

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    ⊘No Antivirus matches

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    api.coingecko.com
    		172.67.12.83
    		truefalse
      		unknown
      btcswitch.fun
      		104.21.65.142
      		truefalse
        		unknown
        a.nel.cloudflare.com
        		35.190.80.1
        		truefalse
          		unknown
          autecological.xyz
          		188.114.97.3
          		truetrue
            		unknown
            clck.ru
            		213.180.204.221
            		truefalse
              		unknown
              i.postimg.cc
              		104.238.220.6
              		truefalse
                		unknown
                www.google.com
                		172.217.18.4
                		truefalse
                  		unknown
                  sba.yandex.net
                  		213.180.193.232
                  		truefalse
                    		unknown
                    www.google.ad
                    		172.217.18.3
                    		truefalse
                      		unknown
                      a1034295.xsph.ru
                      		141.8.192.26
                      		truetrue
                        		unknown
                        x1.i.lencr.org
                        		unknown
                        		unknownfalse
                          		unknown
                          sba.yandex.ru
                          		unknown
                          		unknownfalse
                            		unknown

                            Contacted URLs

                            NameMaliciousAntivirus DetectionReputation
                            http://clck.ru/3DSSCzfalse
                              		unknown
                              https://btcswitch.fun/payouts/false
                                		unknown
                                http://a1034295.xsph.ru/vew/ye/worke/true
                                  		unknown
                                  http://a1034295.xsph.ru/favicon.icofalse
                                    		unknown

                                    World Map of Contacted IPs

                                    • No. of IPs < 25%
                                    • 25% < No. of IPs < 50%
                                    • 50% < No. of IPs < 75%
                                    • 75% < No. of IPs

                                    Public IPs

                                    IPDomainCountryFlagASNASN NameMalicious
                                    172.217.16.138
                                    		unknownUnited States
                                    		15169GOOGLEUSfalse
                                    184.28.88.176
                                    		unknownUnited States
                                    		16625AKAMAI-ASUSfalse
                                    173.194.76.84
                                    		unknownUnited States
                                    		15169GOOGLEUSfalse
                                    52.109.89.119
                                    		unknownUnited States
                                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                    104.21.65.142
                                    		btcswitch.funUnited States
                                    		13335CLOUDFLARENETUSfalse
                                    213.180.204.221
                                    		clck.ruRussian Federation
                                    		13238YANDEXRUfalse
                                    2.19.126.160
                                    		unknownEuropean Union
                                    		16625AKAMAI-ASUSfalse
                                    141.8.192.26
                                    		a1034295.xsph.ruRussian Federation
                                    		35278SPRINTHOSTRUtrue
                                    35.190.80.1
                                    		a.nel.cloudflare.comUnited States
                                    		15169GOOGLEUSfalse
                                    172.67.12.83
                                    		api.coingecko.comUnited States
                                    		13335CLOUDFLARENETUSfalse
                                    107.22.247.231
                                    		unknownUnited States
                                    		14618AMAZON-AESUSfalse
                                    172.64.41.3
                                    		unknownUnited States
                                    		13335CLOUDFLARENETUSfalse
                                    104.238.220.6
                                    		i.postimg.ccUnited States
                                    		23470RELIABLESITEUSfalse
                                    52.113.194.132
                                    		unknownUnited States
                                    		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                    46.105.222.81
                                    		unknownFrance
                                    		16276OVHFRfalse
                                    142.250.186.35
                                    		unknownUnited States
                                    		15169GOOGLEUSfalse
                                    20.42.73.30
                                    		unknownUnited States
                                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                    1.1.1.1
                                    		unknownAustralia
                                    		13335CLOUDFLARENETUSfalse
                                    172.217.18.4
                                    		www.google.comUnited States
                                    		15169GOOGLEUSfalse
                                    172.217.18.3
                                    		www.google.adUnited States
                                    		15169GOOGLEUSfalse
                                    52.109.32.7
                                    		unknownUnited States
                                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                    142.250.185.138
                                    		unknownUnited States
                                    		15169GOOGLEUSfalse
                                    142.250.185.238
                                    		unknownUnited States
                                    		15169GOOGLEUSfalse
                                    93.184.221.240
                                    		unknownEuropean Union
                                    		15133EDGECASTUSfalse
                                    2.23.197.184
                                    		unknownEuropean Union
                                    		1273CWVodafoneGroupPLCEUfalse
                                    239.255.255.250
                                    		unknownReserved
                                    		unknownunknownfalse
                                    188.114.97.3
                                    		autecological.xyzEuropean Union
                                    		13335CLOUDFLARENETUStrue
                                    142.250.185.131
                                    		unknownUnited States
                                    		15169GOOGLEUSfalse
                                    23.217.172.185
                                    		unknownUnited States
                                    		16625AKAMAI-ASUSfalse
                                    52.109.28.46
                                    		unknownUnited States
                                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                    213.180.193.232
                                    		sba.yandex.netRussian Federation
                                    		13238YANDEXRUfalse

                                    Private

                                    IP
                                    192.168.2.16

                                    General Information

                                    Joe Sandbox version:41.0.0 Charoite
                                    Analysis ID:1533554
                                    Start date and time:2024-10-14 21:40:39 +02:00
                                    Joe Sandbox product:CloudBasic
                                    Overall analysis duration:
                                    Hypervisor based Inspection enabled:false
                                    Report type:full
                                    Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                    Number of analysed new started processes analysed:19
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:0
                                    Technologies:
                                    • EGA enabled
                                    Analysis Mode:stream
                                    Analysis stop reason:Timeout
                                    Sample name:20240930_185453_p1uYhraXAa8FqoQDzs1lqwv0Fp3NVQrL.eml
                                    Detection:MAL
                                    Classification:mal68.phis.troj.winEML@38/44@31/107
                                    Cookbook Comments:
                                    • Found application associated with file extension: .eml

                                    Warnings

                                    • Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
                                    • Excluded IPs from analysis (whitelisted): 52.109.28.46, 52.113.194.132, 52.109.32.7, 2.19.126.160, 2.19.126.151
                                    • Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, ukw-azsc-000.roaming.officeapps.live.com, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, osiprod-ukw-buff-azsc-000.ukwest.cloudapp.azure.com, s-0005-office.config.skype.com, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, login.live.com, s-0005.s-msedge.net, config.officeapps.live.com, officeclient.microsoft.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, uks-azsc-config.officeapps.live.com, a1864.dscd.akamai.net
                                    • Not all processes where analyzed, report is missing behavior information
                                    • Report size getting too big, too many NtQueryAttributesFile calls found.
                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                    • Report size getting too big, too many NtReadVirtualMemory calls found.
                                    • Report size getting too big, too many NtSetValueKey calls found.
                                    • VT rate limit hit for: 20240930_185453_p1uYhraXAa8FqoQDzs1lqwv0Fp3NVQrL.eml

                                    LLM Input / Output

                                    InputOutput
                                    URL: Email Model: claude-3-haiku-20240307
                                    ```json
{
  "contains_trigger_text": true,
  "trigger_text": "Please check your balance using the link in the attached document.",
  "prominent_button_name": "Report Suspicious",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false
}
                                    URL: Email Model: jbxai
                                    {
"brands":[],
"text":"This Message May Be Unsafe Please verify with the sender offline and avoid replying with sensitive information,
 clicking links,
 or downloading attachments. Welcome back,
 user-id812142931 Please check your balance using the link in the attached document.",
"contains_trigger_text":true,
"trigger_text":"This Message May Be Unsafe",
"prominent_button_name":"Report Suspicious",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}
                                    URL: Email Model: claude-3-haiku-20240307
                                    ```json
{
  "brands": []
}
                                    URL: http://a1034295.xsph.ru/vew/ye/worke/ Model: claude-3-haiku-20240307
                                    ```json
{
  "contains_trigger_text": true,
  "trigger_text": "Welcome back, user-id81214293",
  "prominent_button_name": "SEND",
  "text_input_field_labels": [
    "Are you a person? 4+6=?"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": true,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}
Google indexed: False
                                    URL: http://a1034295.xsph.ru/vew/ye/worke/ Model: claude-3-haiku-20240307
                                    ```json
{
  "brands": [
    "Bitcoin"
  ]
}
Google indexed: False
                                    URL: http://a1034295.xsph.ru/vew/ye/worke/ Model: jbxai
                                    {
"brands":["Bitcoin"],
"text":"Welcome back,
 user-id81214293 Are you a person? 4+6=?",
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"SEND",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}
                                    URL: http://a1034295.xsph.ru/vew/ye/worke/ Model: gpt-4o
                                    ```json{  "legit_domain": "bitcoin.org",  "classification": "wellknown",  "reasons": [    "The brand 'Bitcoin' is well-known and is typically associated with the domain 'bitcoin.org'.",    "The URL 'a1034295.xsph.ru' does not match the legitimate domain name associated with Bitcoin.",    "The domain 'xsph.ru' is unrelated to Bitcoin and uses a Russian domain extension, which is unusual for a global brand like Bitcoin.",    "The subdomain 'a1034295' appears random and does not provide any indication of legitimacy.",    "The input fields 'Are you a person?' and '4+6=?' are simplistic and often used in phishing sites to appear legitimate while collecting user data."  ],  "riskscore": 9}
Google indexed: False
                                    URL: a1034295.xsph.ru
            Brands: Bitcoin
            Input Fields: Are you a person? 4+6=?
                                    URL: http://a1034295.xsph.ru/vew/ye/worke/ Model: jbxai
                                    {
"phishing_score":9,
"brands":"Bitcoin",
"legit_domain":"bitcoin.org",
"classification":"wellknown",
"reasons":["The brand 'Bitcoin' is well-known and is primarily associated with the domain 'bitcoin.org'.",
"The URL 'a1034295.xsph.ru' does not match the legitimate domain associated with Bitcoin.",
"The domain 'xsph.ru' is unrelated to Bitcoin and uses a Russian domain extension,
 which is unusual for Bitcoin's official sites.",
"The presence of a subdomain 'a1034295' and the domain 'xsph.ru' suggests a potential phishing attempt,
 as it does not align with any known Bitcoin-related domains."],
"brand_matches":[false],
"url_match":false,
"brand_input":"Bitcoin",
"input_fields":"unknown"}
                                    URL: https://btcswitch.fun/payouts/ Model: claude-3-haiku-20240307
                                    ```json
{
  "contains_trigger_text": true,
  "trigger_text": "Welcome back, user-id81214293!",
  "prominent_button_name": "Continue",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}
                                    URL: https://btcswitch.fun/payouts/ Model: jbxai
                                    {
"brands":["BITCOIN MINING"],
"text":"Welcome back,
 user-id81214293!",
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"Continue",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}
                                    URL: https://btcswitch.fun/payouts/ Model: claude-3-haiku-20240307
                                    ```json
{
  "brands": [
    "Bitcoin Mining"
  ]
}

                                    Created / dropped Files

                                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\14888953-bdf4-4e36-a269-be567a779a19.tmp

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                    File Type:JSON data
                                    Category:modified
                                    Size (bytes):403
                                    Entropy (8bit):4.953858338552356
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:4C313FE514B5F4E7E89329630909F8DC
                                    SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                                    SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                                    SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):0
                                    Entropy (8bit):0.0
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:4C313FE514B5F4E7E89329630909F8DC
                                    SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                                    SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                                    SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241014194122Z-164.bmp

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
                                    Category:dropped
                                    Size (bytes):65110
                                    Entropy (8bit):0.10467658294631213
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:3BB10CA8060E8F95C566D2F491652ADA
                                    SHA1:BD33E19C4BE86064F7ED4D562EA78CBBFE9A3ED2
                                    SHA-256:764F32714F415462546D68F7ED434F525E548E065EE33FF9A9C75E1829ED5702
                                    SHA-512:F7D6BB5C129DF452FF8EF8B1D9ABF3FD875A4AF183394EB60CF27E41E82304E40B0FAE09B63FD003F8E4CFCD69474E5F43A3ED8F5602407AB21F4B7FC7B7CA11
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                                    Category:dropped
                                    Size (bytes):57344
                                    Entropy (8bit):3.291927920232006
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:A4D5FECEFE05F21D6F81ACF4D9A788CF
                                    SHA1:1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
                                    SHA-256:83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
                                    SHA-512:FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:SQLite Rollback Journal
                                    Category:dropped
                                    Size (bytes):16928
                                    Entropy (8bit):1.212610504583916
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:F404D2DCC729457FDBA129E10B958AD3
                                    SHA1:AC594257D2F20BF5E38D947AF0BA2C35A76E8A3B
                                    SHA-256:05134152DEBE398A7E2EE2740B90743B71E78EA99F71E766F99E109D9A1E92ED
                                    SHA-512:79925E741D89769939F5CEA647EF963D62C8AA03D2C1F2BE15B9C6D4A24BC541DD4505A23BC60FBC58B95F42D22AF3AB7B8D40A2EBA4C69832E3BC69169ECDEE
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:.... .c.....2.sr........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                    File Type:Certificate, Version=3
                                    Category:dropped
                                    Size (bytes):1391
                                    Entropy (8bit):7.705940075877404
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                                    SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                                    SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                                    SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                    File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                                    Category:dropped
                                    Size (bytes):71954
                                    Entropy (8bit):7.996617769952133
                                    Encrypted:true
                                    SSDEEP:
                                    MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                                    SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                                    SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                                    SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):192
                                    Entropy (8bit):2.756901573172974
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:90BC205EFCC77EF499E867CA8E5753EE
                                    SHA1:D7B62284A348CCF5722352F3229E635DD186DDEF
                                    SHA-256:B280E6D26C268B9C20088E401D569CC21D7651C8C8D11C1367478810EE355AA4
                                    SHA-512:FDFCF577B5C97E74CFAB63119A2615CF1D88E63C922CFFF18C63DB4D30DA38220B1E0A9EE3C794572DA1185A730D3FD6750BA18EBF0D9252E53417D669B155B3
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:p...... .........L.q...(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                    File Type:data
                                    Category:modified
                                    Size (bytes):328
                                    Entropy (8bit):3.141785112603811
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:4944593380FE0FC4AC61CC401BEEAF89
                                    SHA1:BA32242A875A32DBCFA91EEC26C45790B6AF1C46
                                    SHA-256:AD5E27A21CEA2E27E6331A34DE03CF4B79F46371C81A4AEA6C8601F027DD774B
                                    SHA-512:E44AAE634F243362CB4B8791677319255CD01D4EF9472F97741AAA0A4823BB82D10AE4B604ABBD7D5C930B2099F23B20DFBCE6A1F9A6C58065FA81C591F16A5F
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:p...... ........0..#q...(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1696

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:PostScript document text
                                    Category:dropped
                                    Size (bytes):185099
                                    Entropy (8bit):5.182478651346149
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:94185C5850C26B3C6FC24ABC385CDA58
                                    SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                                    SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                                    SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:PostScript document text
                                    Category:dropped
                                    Size (bytes):0
                                    Entropy (8bit):0.0
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:94185C5850C26B3C6FC24ABC385CDA58
                                    SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                                    SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                                    SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):295
                                    Entropy (8bit):5.381323563531154
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:4FD49764AD89560C3E5A07A0308079CD
                                    SHA1:46BA90046C22A9E1B838ECB2EA881309FED3B725
                                    SHA-256:5A696E0CC877C6F256F92D55865E4DB819EBA1679733FB67EF641E2134B67082
                                    SHA-512:E2C8FEBC767F1A11841B8AF97B74FEAD9C51909F10CE76EA3CEE15D6A3EEE5CD43EA58242F9663A101E965B4F4E081E7B9A7A071923E9753D10CE2498270F3E6
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):294
                                    Entropy (8bit):5.332207360077211
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:AFE46CD70CFEED2D5E3CC2B582D7D669
                                    SHA1:16E1B5811F35853302B447EDE780507687C0C4F7
                                    SHA-256:407874B8ED79C2F5F4DA2C96B21B7275DE894CC48B999C566FA991C4042BA197
                                    SHA-512:48AA6D40B1F4CE6ECA82D4F0AD4C1A45A70BFCB3135F8384746924E6BBA5167C5AD5804DA7206C07A915B15BA9FB8BC9DDD2481F54AA44A867C5D706F4C97022
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):294
                                    Entropy (8bit):5.310057453654281
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:0542980219D54500C34F7F6116F17AA0
                                    SHA1:C0C91F7DF38BCA4093A532205C4F845AFD162DA6
                                    SHA-256:3911EE9A9F762B3B5B65514BEBB28A80DAD388EB1CAB5BB7A60D74600B3443B5
                                    SHA-512:BCD53529B4893665BADD75D40B70004448A5F10D2BAB12FB9E7CBCE1E22EAA4F60AE5013C9D90092F1C6457346B194DDCA0A3DF0F90CCEDD2B92805B8AB74466
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):285
                                    Entropy (8bit):5.370333933928779
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:AF965E35E5E76942D8267D0C00562E28
                                    SHA1:9D1C5C5B1EC9332E7D1D8B158E4431564468D864
                                    SHA-256:0BA790533443D41EB7E83E0CB32BDDF71EB431E94E401BF432DDC7F9AF4A3C0A
                                    SHA-512:C3AB0DA0BEEBE3FA190EA7B9A9834BDD5AEB5F8DAD28AE0C92356565346BB5E73A51C7295E6EFA4E165FCE5288999FD88B89B7F87A9C93EDC89FC27056A539D0
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):1083
                                    Entropy (8bit):5.685667801720198
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:D3589BF4CEA7B97DF22A4AFC1F9A8DD9
                                    SHA1:EA196B8B4EB1B567EB7CC3CAEA65A4123605F5D8
                                    SHA-256:C707A7EAE5D20FF5ED8ABB9E531730269CDC679E5F0B1C06999E3341295A44F2
                                    SHA-512:008F6F06B8B9FB84A342A15727C8E3D41280E2E1457BF30A873773B1F4BFAF1965675C6060B3EB2389E431B730C6976F2E3DBA38183A8CD6B2D7FBE390059D10
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_277808ActionBlock_2","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"22b145c0-22bc-4bba-811f-7234f288595b","variationId":"277808"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgZmlsZXMgdG8gYW5kIGZyb20gUERGXG53aXRob3V0IGxpbWl0cy4ifSwidGNhdElkIjoiUkdTMDM1MS1FTlUtQ29udHJvbCJ9","dataType":"applicatio

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):1050
                                    Entropy (8bit):5.661729248236195
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:D9C88CF3FF1AB81C6B5313C8F7E369D6
                                    SHA1:5D16B283085918126BD584C64B3F5BF32E186460
                                    SHA-256:C5C5E33350D64E4D59DFBEAC3824C587E8C0FD27EDA11A3AB276FF84C06ECAA1
                                    SHA-512:4A7B42C10F08DB6E79946D46F917BB6A78FFE8163BDE709BB3781EC8BD7A773C80385065B67C266BE0D10AF4A20D2C912287BF7F6ED37587E51AB528719210A8
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):292
                                    Entropy (8bit):5.321954165151842
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:DB7BC6D4D541E8E796279D526C41C29B
                                    SHA1:AB015C9D3C5725D578EF97B5777491A1E2BACDDD
                                    SHA-256:19278EC81860B5804FEDB8BBFEF604A0A887F7E19DE365D847B01E5B64E251C2
                                    SHA-512:9E5C9FB04B590A488EC79C0363FD74E11DDE0D17FF74A9247A2CCD3E591F7E1376EEBB42CF6E6B8EE19295177C84C3DC44B00B2DC7B6639249D6826E30412F0E
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):1062
                                    Entropy (8bit):5.693889252715728
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:628B98ACE9F752057895277D5D320DFC
                                    SHA1:EEB3419C9B65AE389C19FC37902FC5CB0E15C9AB
                                    SHA-256:60A8CD908B4205F1E7D77BA2B2BE6496F08290B49F0C801FC5D39F4968A5963A
                                    SHA-512:5DB492292CDDCEE59F566855AC8E1C731C585A654F08B347550C479895119AFF45D553B374F956A46C3EBFDE67D62789F48B1AC28DAFB16C13F74E1D96DCDB20
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_277808ActionBlock_0","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"58886bd3-acd7-4f84-ae2e-6684bc127c41","variationId":"277808"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6IlJHUzAzNTEtRU5VLUNvbnRyb2wifQ==","dataType":"application\/json","encodingSch

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):1164
                                    Entropy (8bit):5.703144711042193
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:F1B5C152DFB832CD352F04BC74A74336
                                    SHA1:F8536DAB5BD53FB02733E8F9F13FD5BD969E9429
                                    SHA-256:50EFD02F9C610F6C6D9358891E88CBC413B019E5B57064F83D219C8A8CA15C8C
                                    SHA-512:50A40FB77012DF0146B3F16536761D62BBAC0E30FB73B1D9DD680AAD16D225C4C6FAFAAE0DA40A2054FCE40E2AC4FDAFB2277322C8712EB1723B9870DEC24F94
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):289
                                    Entropy (8bit):5.326559612297822
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:2DD17D0B83502C825F35166B84637A14
                                    SHA1:782C373938F42122837EC22D8433BD26912A4CC3
                                    SHA-256:AE43015332BF1577DDA8E7D1D68E6BB5F3EDA1DB07C9E02792A86F9A18C663B5
                                    SHA-512:6BE33956BD4F494BA9F26D506AD56375B551ADD93B269E6DB6D1682DA8315EA7866E34F50B4FDD75A044FD3A9B090EC9FD52434C9128AFDF7B16EA842D767B1A
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):1395
                                    Entropy (8bit):5.7779930906002885
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:2E7475ADBB2E8ACC8573CC9C4EA78B0D
                                    SHA1:EE1BA49BB03D3D9A9B21EFD615A7B9DF724B8B72
                                    SHA-256:B6F58DA349E8B79516A21ED20F0A5EBF8CC341F58A7F8405C1E1C0682840EF00
                                    SHA-512:446A9852E31BF8D89B1F383D874B7B14CA5C7059CCE36815CF6DB975304C18714E624D8AA584803C74A12212909B92BD9323FDA15DB6375DE4123793D5FB11EB
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):291
                                    Entropy (8bit):5.309924169680979
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:266550C293ED20C59668AF10CD1BA178
                                    SHA1:5C8E2B39648ED344E837ECC7DD10BB2B7D6F197A
                                    SHA-256:36AA85E2F5D5757F4CC07DE837FB208C803B7A76A69C63D2CC3BD9137F693BF6
                                    SHA-512:4ED2F0F1556785CC76B588CA7D2521D6BBBB29EA5CFC183C2FA0F1070F7DEB788376E6D1FB5A850E51B85E21F9F5E99DFC5C4D63BCDD753F4E29AB5550AEFC44
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):287
                                    Entropy (8bit):5.313358734080426
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:2969262C930831CCA567717142585C8A
                                    SHA1:23F3C6546C8C25721CC940BE67F594158A615C38
                                    SHA-256:879578B08CDBA388D42BE2E60B552EA140CD9876BBCC59F68E106D3684EC68BE
                                    SHA-512:1CF162BEBAE68341F78AA21A542D79F15DABBB8CA24F2354D065190D920ED4E65842C6DC3CBD176B426689795A17D2DFEAEFF8D008E359AC7B726321F4BD51D9
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):1082
                                    Entropy (8bit):5.689396100266154
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:06697F8C4D2927B252AE97C8FC800104
                                    SHA1:0A79309B5030A4F534848A861E02EBB71C3A02DB
                                    SHA-256:747582952450BFED6417D46744849D2AB986684D32DB0D8CF2FC83ADA1AFF3E7
                                    SHA-512:B35637B05A8E924C046104A0B3951FA9B534D5068CC95349E943869F12D8729BB21C44DE86EF75B506DD729857FF1A757DE4CD3DCFD4CEC746E68CB1ADFF1CA4
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_277808ActionBlock_1","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"a8b11c37-7d39-4b12-9d33-a040ee4d296b","variationId":"277808"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlNlbmQgZG9jdW1lbnRzICYgZm9ybXNcbmZvciBmYXN0IGUtc2lnbmluZyBvbmxpbmUuIn0sInRjYXRJZCI6IlJHUzAzNTEtRU5VLUNvbnRyb2wifQ==","dataType":"application

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):286
                                    Entropy (8bit):5.290122345974088
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:F4D48C6000609D3433A04563D1DEFA77
                                    SHA1:B64A816E9422EA1CBCBB9F9224FDEB5033671724
                                    SHA-256:EA0202DB065DB71A81AB536781685F1FF3EE5BFC3FFDDB9A224194D481D18B39
                                    SHA-512:F461E125ADA2AB8651227CFC1831A61F88E507FC4950667CCF324D82525244C53BAA86AADF6D034382AEE73CC5FF4ECEBC8269A2C36CF1323BF853D5C2A8FE90
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):782
                                    Entropy (8bit):5.373881903644277
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:D6E0712CAC725B804A03602449B3B6AD
                                    SHA1:1C76042DAAE276331957DC3BEA1120D0C1D57522
                                    SHA-256:048E063D30AF6613AEB378C7F9A1F52DBC44BEAAC585D46C54AB587C7E0C3022
                                    SHA-512:5186F2685A9A1A58D31493C2D71F7100B3CDEBEFF8756858E8563EC806512BFFE15BB8884BCBB7CD46F700F2FEA35342FFB0CCA635C146DC836B702DE64D97BD
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"analyticsData":{"responseGUID":"76e497c8-8317-4c12-95b7-d9c921b87a26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729112529347,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1728934884382}}}}

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):4
                                    Entropy (8bit):0.8112781244591328
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                                    SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                                    SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                                    SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:....

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:JSON data
                                    Category:dropped
                                    Size (bytes):2818
                                    Entropy (8bit):5.142239070271249
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:6FCB11685AB960838B5E23830C496350
                                    SHA1:CC1064F3C0041736E6722EDB4BE07E29A3FF8D5B
                                    SHA-256:E29ECF9F648BC09910C9029801B84A24C81053CF44C396891B85AD7B7EBE6CE5
                                    SHA-512:EAB73579F1BA58C51E3509A82E814F0CFB32802FC24BCCE41F519DF8712ABBC17527BE8FB88003BDBA64DEF1313E4E178C9CABC23B52EDAA08706C9364F2E4D2
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"48aaf673f2f8453d1642e399f857d786","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1728934883000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7941d39606e4219cb3acaa63e069cc65","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1728934883000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d6cdf6ff76c7740bc1d0b9d87137d0f1","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1082,"ts":1728934883000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"035e2b234ae0cd61aa7303b8a1c64c9c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1083,"ts":1728934883000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"f1e03ff3c7f2a05d2eeab3c7db157685","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1062,"ts":1728934883000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"1c9db006a0614fee9c882c5c3a70f7a7","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"t

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                                    Category:dropped
                                    Size (bytes):12288
                                    Entropy (8bit):0.9877480848288551
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:2E16D48D2F9205BFDB0E4B3859D4781E
                                    SHA1:2DF4F731F1890C3155622B4F9BD7B18CA66723FF
                                    SHA-256:C7C1BD964749229F294C3059434AFBF5FEFAB0B57688079A2C2B44C97EB18C82
                                    SHA-512:E11D8498CAC114836B321754FBF33E9B0C8679C2A6FFCA40E852D60313869D8F9E6A9E6F5FCB3FB4F95FCF078E1A34DEE320D606CAF5A139CDDB739053E8E547
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:SQLite Rollback Journal
                                    Category:dropped
                                    Size (bytes):8720
                                    Entropy (8bit):1.3437011021324392
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:F7649833CE2008DA07C6B23608197524
                                    SHA1:C03E6218F249E385A1567D5AAFD57A95B38E8D27
                                    SHA-256:D3BFCB1E4123F4251C7C55165511C3E93A3EBD13F5581A1066CC7A26F84A2AEE
                                    SHA-512:1E5CAF76EAF8C8532DEE50A119C5C3E8E7C2648CA9E78493352666CD2B705C9DDED008E5CFD95A5EDF1B247579BDDF5279EF46F65014EFC63AFAF7CEF58B8367
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:.... .c......>(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                                    Download File
                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):231348
                                    Entropy (8bit):4.38777715653157
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:44EF1D71AA9BF2A94595394B30C0ED3C
                                    SHA1:425ADB96BA9D215D1FC8D7CB2132C861CA444F52
                                    SHA-256:C785F6A1F9CB1F5AE154579DD8C1FCF64A1EFF796B9EE297EC8F73DDE481BEB8
                                    SHA-512:7BD1B07A1239BBE38A9003158BE408515B094DD21A7C65065D98633D3C0D6937600C596A372596FB67FB0F5096524E54130172AC91FDD71911490C15D0BAAE45
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:TH02...... . ...p.......SM01X...,...P7..p...........IPM.Activity...........h...............h............H..h...............h..........;.H..h\cal ...pDat...h..=.0..........h=.....;........h........_`Pk...h....@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k4.;.....4.1...!h.............. h=.......(.....#h....8.........$h..;.....8....."h..;.......;...'h..............1h=...<.........0h....4....Uk../h....h.....UkH..h i;.p.........-h .......T.....+h............................ ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\2022B0C3-B73A-4F84-855F-283AF6CC12DE

                                    Download File
                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):178099
                                    Entropy (8bit):5.2905212320335515
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:38D39DA65159035819C612E6A1A20B4C
                                    SHA1:42979341CF07244AA48D8BEB50C597DC6B53791C
                                    SHA-256:85E24464025BA579262CA3C7E4018C80E462ED3F3E1172F4797F98A65BA495E0
                                    SHA-512:4C5775A37BC98DB85A0593F6B32C9E1C5A77E317E0B828B46E19FD030A5EF4816CCE8FCA1805DEC585766963D7EB5B5F0743E5378590BC12E94CA60997E57B81
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-14T19:41:08">.. Build: 16.0.18204.40137-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

                                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

                                    Download File
                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                    File Type:SQLite Rollback Journal
                                    Category:dropped
                                    Size (bytes):4616
                                    Entropy (8bit):0.13784977103055013
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:D2D894DDAB617DDF70E9399CF6D75EB8
                                    SHA1:227258F46525BA4CE5AB281AD6F111B9D42FCCAA
                                    SHA-256:FD508857E05BA4FB8D9D8670B8864AC7DCCA0F04A0CAB6A471B00C30CF11BC95
                                    SHA-512:0A884D6F28EBF73361F93FA5F43139DF15AF98BFDDAF66CF347A218B95C160B64BA5B03892476CCC89EC9CC94BEEBAA4882CC707EC8C1303EFE389FA3FD4C8A5
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:.... .c......L......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K.................................................................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\EVFBGGWB\nSmRlxixjVHpBwqQX (002).pdf:Zone.Identifier

                                    Download File
                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:modified
                                    Size (bytes):26
                                    Entropy (8bit):3.95006375643621
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                                    SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                                    SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                                    SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:[ZoneTransfer]..ZoneId=3..

                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\EVFBGGWB\nSmRlxixjVHpBwqQX.pdf

                                    Download File
                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                    File Type:PDF document, version 1.4, 1 pages
                                    Category:dropped
                                    Size (bytes):29614
                                    Entropy (8bit):7.953885752391648
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:FCC6FF5C242A89908C88B72FBA4A2C03
                                    SHA1:A5EFC4EE47C6B2822E4DDE4D83D5FAD44E3E6CFB
                                    SHA-256:04440E16534C99903B907C8CA60CCEF083DDE8B44C92049D7E522ECF8646318B
                                    SHA-512:A72D5FE6AF37FC7FC81F3A8AEC245D028DDDC2B5B1BD6ED93449F395DF0C0647E1EB2180A5AE5C12EBDBA368D2C9AFA075464DF6139E801E7E748B3F0289D019
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:%PDF-1.4.%.....1 0 obj.<<./Type /Pages./Count 1./Kids [ 4 0 R ].>>.endobj.2 0 obj.<<./Producer (PyPDF2).>>.endobj.3 0 obj.<<./Type /Catalog./Pages 1 0 R.>>.endobj.4 0 obj.<<./Type /Page./Resources 5 0 R./MediaBox [ 0 0 595 842 ]./Annots [ 15 0 R ]./Group <<./S /Transparency./CS /DeviceRGB./I true.>>./Contents 16 0 R./Parent 1 0 R.>>.endobj.5 0 obj.<<./Font 6 0 R./ProcSet [ /PDF /Text ].>>.endobj.6 0 obj.<<./F1 7 0 R./F2 11 0 R.>>.endobj.7 0 obj.<<./Type /Font./Subtype /TrueType./BaseFont /BAAAAA+TimesNewRomanPSMT./FirstChar 0./LastChar 7./Widths [ 777 666 722 333 722 250 889 722 ]./FontDescriptor 8 0 R./ToUnicode 10 0 R.>>.endobj.8 0 obj.<<./Type /FontDescriptor./FontName /BAAAAA+TimesNewRomanPSMT./Flags 6./FontBBox [ -568 -306 2045 1040 ]./ItalicAngle 0./Ascent 891./Descent -216./CapHeight 1039./StemV 80./FontFile2 9 0 R.>>.endobj.9 0 obj.<<./Filter /FlateDecode./Length1 27312./Length 12187.>>.stream.x..|.\\......a 0d.....0...$A..C .@ ......0.0...Xmb.U..o.Z..^..u....5......V.W

                                    C:\Users\user\AppData\Local\Temp\MSI11fc0.LOG

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):246
                                    Entropy (8bit):3.5004142083842487
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:008FCF2A78D95515ADA4426108ED1B8C
                                    SHA1:63EBA56246AFA12697D0A9025A3319C1AAD48D62
                                    SHA-256:7DDC0D41EFA56206D64B75E2DE1080CDDB646C8E306B19E7C65EC042669F310C
                                    SHA-512:C302DCB3175C21107FC488C9DC3056825537112564BA3FEBF7E5A054D68AD5D72AA8E87BDF7A1001FA943E5CFF511BEF69C300A662B3F0AB342A5E08B4D6387D
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.4./.1.0./.2.0.2.4. . .1.5.:.4.1.:.2.5. .=.=.=.....

                                    C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-14 15-41-20-174.log

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:ASCII text, with very long lines (393)
                                    Category:dropped
                                    Size (bytes):16525
                                    Entropy (8bit):5.353642815103214
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:91F06491552FC977E9E8AF47786EE7C1
                                    SHA1:8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
                                    SHA-256:06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
                                    SHA-512:A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

                                    C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                                    Download File
                                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):29752
                                    Entropy (8bit):5.413132995069162
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:2D800C033DE7C72EFD70350482B52883
                                    SHA1:6305313DDB3BF37DDE4C683F260290E983C5D79C
                                    SHA-256:0D83FC792F476D20263B39110E2B026FFA857EBA142BA4C4223FD1998072B0B1
                                    SHA-512:39935D6D6F2B063C917E1A3FC51B3866FC8B8ACCC1B5E0E13B8C8322FF4552C2AF6DB19CCEF7508F377F215582337C772A76F196614BE7AF5093D9A460552BBD
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

                                    C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                                    Download File
                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):30
                                    Entropy (8bit):1.2389205950315936
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:271F9FC46AF153705EE6031C3FA1A846
                                    SHA1:DF72FD6F23BCE4B0AA4F053AF678740B39F1497F
                                    SHA-256:7BB20143247E4C0F69068021B9BFF1A20FBB1B7AFC00F4A16924740D89684929
                                    SHA-512:117298821D5A2730C133F9916CD260671F839AADEEC7DAE1EFBE7658A777A20F7555F36E55783B7523C953C280AA30DD3D6E9300D8AD046A292A600E548A01CE
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:..............................

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                                    Download File
                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 18:41:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                    Category:dropped
                                    Size (bytes):2673
                                    Entropy (8bit):3.98929900268003
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:7FF5F9B9AB48468BC006CF70D54598D9
                                    SHA1:8C7129B024B492EE6E9165C3B092CCEB9CE6F1C9
                                    SHA-256:9D531ACB27387C367149CABD2AE5B94075CE791AC935A6BA1732D4583F7DFD49
                                    SHA-512:8439A1D0F69A8A85BCD3F67A274ED402E85113E1878F78CFA5A118A7991FDBB9CB7F04B0D7441793B6A115A5FEFB1A23C4159BCD6FC3B4AE6B121AB9D829A22C
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:L..................F.@.. ...$+.,.....w..q...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY+.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY+.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY+............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNY-............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............[......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                                    Download File
                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 18:41:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                    Category:dropped
                                    Size (bytes):2675
                                    Entropy (8bit):4.007387423351458
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:AF9013BF01C25D5F6BD3CBFB5BF1A32D
                                    SHA1:EB8EC081DA13372201F5C9CEDF2C8551F58F0A69
                                    SHA-256:9376E8455A77479D85AA960AA3EA4B59FB732FC12CC8522294B4680344F4A5C4
                                    SHA-512:E90FB8126C35C3F3A05D8315993C6D3E7D95919739A85A4BF90CC31DB24072E1406D16FD239F3AC61780C62592C242256FA2B4F214028D5C05DF26FC10AA46C4
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:L..................F.@.. ...$+.,........q...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY+.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY+.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY+............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNY-............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............[......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                                    Download File
                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                    Category:dropped
                                    Size (bytes):2689
                                    Entropy (8bit):4.011899853498241
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:FB1D954F73F672FC93DCD9B867C939C0
                                    SHA1:47483E2C94C7BC50EB93FB0218E422DA1413DB69
                                    SHA-256:94740B006B7BFFC4B366C956DDF134540D8E4DC40ED61019493D8F30F18CEF01
                                    SHA-512:4A5BDA50836DFE64EC52E84C3150364860597C1766AE7422340FB982CAB1698D75807AFBD817FFEC92CC8986CE2AA9030163DB3E131F8F06A680BDCD6D8CB9B8
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY+.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY+.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY+............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............[......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                                    Download File
                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 18:41:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                    Category:dropped
                                    Size (bytes):2677
                                    Entropy (8bit):4.003152242840848
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:4888E236E5499EF3ED26AFA9300402E9
                                    SHA1:0E612E8EA3D267B0776059C2B91D701E6F478FA6
                                    SHA-256:034F11ED07B20622CE4666ED3A5F2B5858BDBE70997A31F4495735410F73793D
                                    SHA-512:CA498BAD3E19EE9C97FEDC4611787F4FA1C29EBBC2911F42FA6A6A040F9899B6F313A5861F56FB0F1A0C6571886BD6C63BE1E1022C5C85F4027931E1CEFB23F9
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:L..................F.@.. ...$+.,....]...q...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY+.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY+.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY+............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNY-............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............[......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                                    Download File
                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 18:41:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                    Category:dropped
                                    Size (bytes):2677
                                    Entropy (8bit):3.9936366464278694
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:B45DCAE89862D63766F816DC62C586D2
                                    SHA1:E59DC1908CC7616AD3182A0727281CDF34B329FC
                                    SHA-256:90928C200721A116F3ED47559BD03A8570FC0EE705186942EA7F6442613A7AD9
                                    SHA-512:F13756010CAF6476B3449A3C20623705CC65088CA871EF78BB586FFF8A5A284B52914691F0654E660D9B120608F109A679DEB53DCFC8EC657EF9CB28DF409A96
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:L..................F.@.. ...$+.,....z...q...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY+.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY+.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY+............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNY-............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............[......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                                    Download File
                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 18:41:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                    Category:dropped
                                    Size (bytes):2679
                                    Entropy (8bit):4.000752623937776
                                    Encrypted:false
                                    SSDEEP:
                                    MD5:0F27A75804FAECAB8277CD59A93E3093
                                    SHA1:C0F5DB42EEDA91C1FFD8388FFC1E221EB21A8ABA
                                    SHA-256:72F404912BC8BA6B215EA0628DE67699234502663C76E3C675AFAED33C5DF830
                                    SHA-512:BAD1D828A02678DDA761D5139E1ECE7B977004AADEDC5C6268C83B7CF53D1073C4077C5FA8FA728DF57DFA191608ABA27D368E3F7564EC6A137F6108152DB7A6
                                    Malicious:false
                                    Reputation:unknown
                                    Preview:L..................F.@.. ...$+.,........q...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.INY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VNY+.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VNY+.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VNY+............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VNY-............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............[......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                    Static File Info

                                    General

                                    File type:exported SGML document, ASCII text, with CRLF, LF line terminators
                                    Entropy (8bit):6.171111896792215
                                    TrID:
                                      File name:20240930_185453_p1uYhraXAa8FqoQDzs1lqwv0Fp3NVQrL.eml
                                      File size:52'470 bytes
                                      MD5:3ebbbccf126cae2c648bd2ae4343c1db
                                      SHA1:81dd2b0db304a985d6aec1620b36ee42c1304eef
                                      SHA256:5966fa9ddcaf71a46cad5fbd54ccbf88073b32c8b0c54486bb8875f5a65fc396
                                      SHA512:f0fc1381395c684339da1b5c2d286868cdf162a601457b1f673c23b17d7b0a8e543f489cb535c36b0f0e9438350ef5e6bb51e7d8876833f920df57aa267d88c4
                                      SSDEEP:768:9wBEuPJrDru18QQ/db1nJ/vR/bDP13qe5HjN692u92peJD3HewWsGfjZ5tk39fSr:cEuB5Rb1a8HZUcexVGrZ5tC9EhhkZAl
                                      TLSH:A033BE32F8D204D7D3610116AE53B76C397A6506FFC19C3490F866F62EB09A69760F8B
                                      File Content Preview:X-Proofpoint-Sentinel: stfj9llG1d/jUNvIZBL9Nz/rpsCDoCT+xOXLpe2Tddm0p4FTYWx0ZWRfX8X. RasQSgSRxAeVXcCGav7ZrDmarPTQk8T7kDCKwb202WBAd+Dkmsa6jJ35VaODsLeqIYwiVR1+DqOs. mNSahyRjyEDkOtjZmxo0AjWucoJOCOUBA9StVAMnWNGb84VWsLMjfUVWQB3FkWH8vSXhH5i3/iBw. QibHTWEWAFNSSJz

                                      Static Mail

                                      General

                                      Subject:Account report on your balance in our system
                                      From:BIT MINING <no-reply@homedit.ro>
                                      To:jlangford@ceenta.com
                                      Cc:
                                      BCC:
                                      Date:Mon, 30 Sep 2024 11:54:34 -0700
                                      Communications:
                                      • Welcome back, user-id81214293 Please check your balance using the link in the attached document. ZjQcmQRYFpfptBannerStart This Message May Be Unsafe Please verify with the sender offline and avoid replying with sensitive information, clicking links, or downloading attachments. Report Suspicious This Message May Be Unsafe Please verify with the sender offline and avoid replying with sensitive information, clicking links, or downloading attachments. This Message May Be Unsafe Please verify with the sender offline and avoid replying with sensitive information, clicking links, or downloading attachments. Report Suspicious Report Suspicious https://us-phishalarm-ewt.proofpoint.com/EWT/v1/C8I-Dec!hSGq68b4rzQmh1k6ysBUaKTASIzHF_6n8qwOgUo-j0fSosSxZyn72NbWZsSVAoB8m2z2jIZJ5hkykAoutBGB4HWgrmNMxjHtP-VF4A$ Report Suspicious ZjQcmQRYFpfptBannerEnd Welcome back, user-id81214293 Please check your balance using the link in the attached document. #pfptBannertqj93dx { all: revert !important; display: block !important; visibility: visible !important; opacity: 1 !important; background-color: #ffbd33 !important; max-width: none !important; max-height: none !important } .pfptPrimaryButtontqj93dx:hover, .pfptPrimaryButtontqj93dx:focus { background-color: #dcaf6b !important; } .pfptPrimaryButtontqj93dx:active { background-color: #bca180 !important; } Welcome back, user-id81214293 Please check your balance using the link in the attached document. Welcome back, user-id81214293 Please check your balance using the link in the attached document. Welcome back, user-id81214293 Welcome back, user-id81214293 user-id81214293 Please check your balance using the link in the attached document. Please check your balance using the link in the attached document.
                                      Attachments:
                                      • nSmRlxixjVHpBwqQX.pdf

                                      Headers

                                      Key Value
                                      X-Proofpoint-Sentinelstfj9llG1d/jUNvIZBL9Nz/rpsCDoCT+xOXLpe2Tddm0p4FTYWx0ZWRfX8X RasQSgSRxAeVXcCGav7ZrDmarPTQk8T7kDCKwb202WBAd+Dkmsa6jJ35VaODsLeqIYwiVR1+DqOs mNSahyRjyEDkOtjZmxo0AjWucoJOCOUBA9StVAMnWNGb84VWsLMjfUVWQB3FkWH8vSXhH5i3/iBw QibHTWEWAFNSSJz2ZU5zTjQEbkB7MenP6ZqiaqDtYl8kj1kMgx6YgdvH87Ttuu/fiebSCCyNrYO/ Dmc/6r7XPT4YVxQtSiczcaAZABHS6Epee3Y0VpiuHp6MF1WR9imGo/1yK8Dgj7AWjuAmfycrH9XW WVb46osPVT7UXkPOxoPQI0bF+QGGU7E+2RX4JpSnR4BZVAE/RN1C4SAjPtrYs5zVqzuCIrHnx7+w vrk36PvW5wFyHwmmjZWaRRED5c57NhblV1TXI/uyPgnP2EK8cQJ7Yd/kE+NArA43RiAuomVmGjQF CX3Gx6hWlUH7ZSBpAzOH+eQTsT5c0vI2iuI+yqT15sjLZCshU0CzlIDQZNhK02dDZWg7g6sfCxd+ w8W53ZcLZj9ZNW/qPN1L3lxIn9KqUOz8L5yKGgbjz4Yqry+k6Zryb1cbKsSEXAjUuZjha6csRasD fT1BsuioOw3evl0vtblMShY9X46FkAOcTGVGAbHQfGl0aVFUJ4kWW81ACaLA6xZ9NVnU3OtZx42j dxMykWwdEyKzSUZh85ofCr26hDhMZjA4bl4V9pQnPGujGWGBypImm79EpIGSMEhkfTWVJZqg560w sYRNGVn4H4AKlIqqPDIoeUL8ke6h9QWEll7R68w==
                                      Authentication-Resultsppops.net; spf=softfail smtp.mailfrom=no-reply@homedit.ro; dmarc=fail header.from=homedit.ro
                                      Receivedfrom jdspsjbvi ([103.58.67.218]) by mx0a-003c1301.pphosted.com (PPS) with ESMTPS id 41xe9m1fx7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for <jlangford@ceenta.com>; Mon, 30 Sep 2024 14:54:55 -0400 (EDT)
                                      Message-ID<82d69f3cc9c7ede271db9239dc38121b277f48@homedit.ro>
                                      Reply-ToBIT MINING <zbigniew_darzynkiewicz@nymc.edu>
                                      FromBIT MINING <no-reply@homedit.ro>
                                      Tojlangford@ceenta.com
                                      SubjectAccount report on your balance in our system
                                      DateMon, 30 Sep 2024 11:54:34 -0700
                                      MIME-Version1.0
                                      Content-Typemultipart/mixed; boundary="02a4ed4ebbb59f9003a9e04bae4a60692e5431"
                                      X-Authority-Analysisv=2.4 cv=BPThr0QG c=1 sm=1 tr=0 ts=66faf400 cx=c_pps p=2+iFsDQ5O4BZQdwx1nC3aQ==:17 p=7x0FSgzq-qvmc7uKPHsA:9 a=2+iFsDQ5O4BZQdwx1nC3aQ==:117 a=Q4PyUpJlWYAJrfYJ:21 a=EaEq8P2WXUwA:10 a=x7bEGLp0ZPQA:10 a=g8TUdU_LZmEA:10 a=P7UnzXv9LXp0juIMaMMA:9 a=G3k8Vd0n61zM2_TJ:21 a=_W_S_7VecoQA:10 a=pvA44qeTxYYA:10 a=n3BslyFRqc0A:10 a=rls1ZAiwvL0A:10
                                      X-Proofpoint-GUIDp1uYhraXAa8FqoQDzs1lqwv0Fp3NVQrL
                                      X-CLX-ShadesJunk
                                      X-Proofpoint-ORIG-GUIDp1uYhraXAa8FqoQDzs1lqwv0Fp3NVQrL
                                      X-CLX-Response1TFkXBxMTExEKWUQXaBt6GBpvRAVbRUsRClhYF2AbTkRBT0xvGB9EEQp4Thd rGUllY05GGB1TRxEKeEsXYBtOREFPTG8YH0QRCnhMF2xfQV5dcGxFchkFEQp5TBdsX0FeXXBsRX IZBREKQ0gXBx8SEQpDWRcHGBgeEQpDSRcaBBoaGhEKWU0XYF9EQREKWUkXBx4aGnESBgcbHh53B gcZGhgGGgYHGxoaQh4GBx8aBgcbHxlxGhAZGXcGGgYHGBoaBhoGBx4fBhoGGnEaEBp3BhoRClle F2hjeREKSUYXSU9PRF5LdUJFWV5PThEKSUcXeE9NEQpDThdaG19zQlhLcmtLEmxbRXtuUFkbRlt dXBpsWhlkfHtYZhEKWFwXHwQaBBkdHAUbGgQbGhoEGxkeBBkZEBseGh8aEQpeWRdPZ2BDSBEKTV wXBxkZEhEKTFoXbhNuHVBZEQpFWRdoTW8RCkxfF3oFBQUFBQUFBQV+EQpNThduYhEKTEYXaGtrY 2trEQpCTxdsfURiY0xPWl5NRxEKQ1oXGxoZBB8SBBwdBBgbEhEKQkUXb0hOc2gbbUJTa20RCkJO F3pOEhN5RVlAExMSEQpCTBdrXFB4aE54RQFSHhEKQmwXYHlHGVgeX35DbmQRCkJAF2ZFYXISE1N aQHJuEQpCWBdtfkxOQEBvGUJmbhEKeUMXbExiXhNSfG8BcEMRCllLFxMSGREKWksXGxgZHxsRCn BnF2NyXV9gZXNuRmVwEBoRCnBoF2tJY2ETRkVffGt6EAcYEhsRCnBoF2AFS3wBbEhocHBQEAcbH hIRCnBjF2VLbmlwXGATBVJhEAcZGB0RCnBsF2hIfAVBZxxvcnhYEAcZGBMRCm1+FxoRClhNF0sR IA==
                                      X-Proofpoint-Banner-Triggerunsafe
                                      X-Proofpoint-Virus-Versionvendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1051,Hydra:6.0.680,FMLib:17.12.62.30 definitions=2024-09-30_18,2024-09-30_01,2024-09-30_01
                                      X-Proofpoint-Spam-Detailsrule=inbound_phish policy=inbound score=100 mlxlogscore=-180 clxscore=-999 phishscore=100 suspectscore=0 unsafescore=20 adultscore=0 unknownsenderscore=20 impostorscore=0 bulkscore=0 spamscore=0 snscore=8 lowpriorityscore=0 priorityscore=1501 mlxscore=0 malwarescore=0 classifier=phish authscore=99 adjust=0 reason=mlx scancount=1 engine=8.21.0-2408220000 definitions=main-2409300136 domainage_hfrom=983 domainage_replyto=12351

                                      File Icon

                                      Icon Hash:46070c0a8e0c67d6