Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
[External] 120112 Manual Policies Overview Guide_ 8VM8-WZPT3L-LYH1.eml

Overview

General Information

Sample name:[External] 120112 Manual Policies Overview Guide_ 8VM8-WZPT3L-LYH1.eml
Analysis ID:1580035
MD5:712511535987a0e3eb53798d01577d53
SHA1:25d0882ea51a1725c5eaea970e8823abd04e9580
SHA256:7df07f24452651b6b5334d115c3da380c50ce020e3cef5be78e6746ddc7d3049
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected phishing page
AI detected potential phishing Email
AI detected suspicious Javascript
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML title does not match URL
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory
Stores large binary data to the registry

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 1364 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\[External] 120112 Manual Policies Overview Guide_ 8VM8-WZPT3L-LYH1.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6636 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "F5D61493-321F-44A6-A5FE-3CF94B2B7F1B" "D6741B14-256A-4566-8CCF-CCFF3A441077" "1364" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • Acrobat.exe (PID: 4264 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\2HLBY5LH\ppuhl Reference YQy Manual_120112.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
      • AcroCEF.exe (PID: 1360 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
        • AcroCEF.exe (PID: 7216 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1588,i,6636914668748474544,5474708927762410746,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • chrome.exe (PID: 7732 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.pt//url?ol=%25SERIALbHWvutBHJDJopw&rct=OKfqigeYGte6egsda&sa=t&esrc=GNOyseckdxhds&source=&cd=Ztebgsheior%3DBhsoepr&ved=Bgaopepqje%25SERIALbHWvu%3D&url=amp%2Felysiumproperties.net%2Fgtoephye%3Fe%3Doutlook.office.com MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 7956 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2312,i,4134693689153310629,18380803809806479140,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 1364, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • Phishing
  • • Compliance
  • • Networking
  • • System Summary
  • • Boot Survival
  • • Hooking and other Techniques for Hiding and Protection
  • • Malware Analysis System Evasion
  • • Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Phishing

barindex
Source: https://pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev/gteuiwopqvsfsfJoe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev' does not match the legitimate domain 'microsoft.com'., The domain 'r2.dev' is not associated with Microsoft and appears to be a generic or cloud service domain., The presence of a Microsoft-related input field on a non-Microsoft domain is suspicious and indicative of phishing. DOM: 2.15.pages.csv
Source: https://pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev/gteuiwopqvsfsfJoe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The provided URL 'pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev' does not match the legitimate domain 'microsoft.com'., The URL contains a random string and uses the 'r2.dev' domain, which is not associated with Microsoft., The presence of a random string and an unusual domain extension is a common tactic in phishing attempts., The input field requests a Microsoft email, which could be used to harvest credentials. DOM: 2.14.pages.csv
Source: EmailJoe Sandbox AI: Detected potential phishing email: The email claims to require review/signature of an employee document but comes from an unrelated commercial domain (therasage.com). The subject line contains a suspicious random-looking code (8VM8-WZPT3L-LYH1) typical of phishing attempts. The email includes unnecessary legal disclaimers in multiple languages to appear legitimate
Source: 0.4.id.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://www.google.com/recaptcha/api2/anchor?ar=1&... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While the script may have a legitimate purpose, such as reCAPTCHA integration, the aggressive and opaque nature of the implementation raises significant security concerns. Further investigation is recommended to determine the true intent and potential impact of this script.
Source: https://pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev/gteuiwopqvsfsfHTTP Parser: Number of links: 0
Source: https://pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev/gteuiwopqvsfsfHTTP Parser: Base64 decoded: https://zooz-jo.com/teygsye/
Source: https://pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev/gteuiwopqvsfsfHTTP Parser: Title: Ui does not match URL
Source: EmailClassification: Credential Stealer
Source: http://elysiumproperties.net/gtoephyeHTTP Parser: No favicon
Source: http://elysiumproperties.net/gtoephyeHTTP Parser: No favicon
Source: http://elysiumproperties.net/gtoephyeHTTP Parser: No favicon
Source: http://elysiumproperties.net/gtoephyeHTTP Parser: No favicon
Source: http://elysiumproperties.net/gtoephyeHTTP Parser: No favicon
Source: http://elysiumproperties.net/gtoephyeHTTP Parser: No favicon
Source: http://elysiumproperties.net/gtoephyeHTTP Parser: No favicon
Source: http://elysiumproperties.net/gtoephyeHTTP Parser: No favicon
Source: http://elysiumproperties.net/gtoephyeHTTP Parser: No favicon
Source: http://elysiumproperties.net/gtoephyeHTTP Parser: No favicon
Source: http://elysiumproperties.net/gtoephyeHTTP Parser: No favicon
Source: http://elysiumproperties.net/gtoephyeHTTP Parser: No favicon
Source: http://elysiumproperties.net/gtoephyeHTTP Parser: No favicon
Source: https://pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev/gteuiwopqvsfsfHTTP Parser: No favicon
Source: https://pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev/gteuiwopqvsfsfHTTP Parser: No favicon
Source: https://pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev/gteuiwopqvsfsfHTTP Parser: No <meta name="author".. found
Source: https://pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev/gteuiwopqvsfsfHTTP Parser: No <meta name="author".. found
Source: https://pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev/gteuiwopqvsfsfHTTP Parser: No <meta name="copyright".. found
Source: https://pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev/gteuiwopqvsfsfHTTP Parser: No <meta name="copyright".. found
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.18
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknownTCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknownTCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknownTCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknownTCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknownTCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknownTCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknownTCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknownTCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknownTCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknownTCP traffic detected without corresponding DNS query: 96.17.64.171
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /gtoephye HTTP/1.1Host: elysiumproperties.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: elysiumproperties.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://elysiumproperties.net/gtoephyeAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficDNS traffic detected: DNS query: www.google.pt
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: elysiumproperties.net
Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
Source: global trafficDNS traffic detected: DNS query: pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev
Source: global trafficDNS traffic detected: DNS query: i.gyazo.com
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveKeep-Alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Mon, 23 Dec 2024 17:51:12 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helv
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: classification engineClassification label: mal56.phis.winEML@37/53@23/230
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241223T1253580934-1364.etl
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\[External] 120112 Manual Policies Overview Guide_ 8VM8-WZPT3L-LYH1.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "F5D61493-321F-44A6-A5FE-3CF94B2B7F1B" "D6741B14-256A-4566-8CCF-CCFF3A441077" "1364" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\2HLBY5LH\ppuhl Reference YQy Manual_120112.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1588,i,6636914668748474544,5474708927762410746,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.pt//url?ol=%25SERIALbHWvutBHJDJopw&rct=OKfqigeYGte6egsda&sa=t&esrc=GNOyseckdxhds&source=&cd=Ztebgsheior%3DBhsoepr&ved=Bgaopepqje%25SERIALbHWvu%3D&url=amp%2Felysiumproperties.net%2Fgtoephye%3Fe%3Doutlook.office.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2312,i,4134693689153310629,18380803809806479140,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding E88777DC096AED23371C52C56CAA4819
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "F5D61493-321F-44A6-A5FE-3CF94B2B7F1B" "D6741B14-256A-4566-8CCF-CCFF3A441077" "1364" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\2HLBY5LH\ppuhl Reference YQy Manual_120112.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1588,i,6636914668748474544,5474708927762410746,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2312,i,4134693689153310629,18380803809806479140,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\InProcServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation21
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
Registry Run Keys / Startup Folder		1
Registry Run Keys / Startup Folder		1
Modify Registry		LSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable Media3
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
DLL Side-Loading		1
DLL Side-Loading		1
Process Injection		Security Account Manager13
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive3
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture4
Application Layer Protocol		Traffic DuplicationData Destruction

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://elysiumproperties.net/favicon.ico0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
elysiumproperties.net
103.174.153.151
truefalse
    		unknown
    pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev
    		162.159.140.237
    		truetrue
      		unknown
      i.gyazo.com
      		104.18.32.197
      		truefalse
        		high
        www.google.com
        		142.250.181.68
        		truefalse
          		high
          default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
          		217.20.58.99
          		truefalse
            		high
            www.google.pt
            		172.217.19.195
            		truefalse
              		high
              x1.i.lencr.org
              		unknown
              		unknownfalse
                		high

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                http://elysiumproperties.net/favicon.icofalse
                • Avira URL Cloud: safe
                		unknown
                https://pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.dev/gteuiwopqvsfsftrue
                  		unknown
                  http://elysiumproperties.net/gtoephyefalse
                    		unknown

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    162.159.140.237
                    		pub-cb48a1f3508c49e29943cfa5c56fda5c.r2.devUnited States
                    		13335CLOUDFLARENETUStrue
                    172.217.17.46
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    52.109.89.119
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    216.58.208.227
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    104.18.32.197
                    		i.gyazo.comUnited States
                    		13335CLOUDFLARENETUSfalse
                    142.250.181.138
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    2.22.50.131
                    		unknownEuropean Union
                    		20940AKAMAI-ASN1EUfalse
                    172.217.19.195
                    		www.google.ptUnited States
                    		15169GOOGLEUSfalse
                    23.218.208.137
                    		unknownUnited States
                    		6453AS6453USfalse
                    52.109.89.19
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    20.42.73.26
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    23.32.238.82
                    		unknownUnited States
                    		2828XO-AS15USfalse
                    142.250.181.68
                    		www.google.comUnited States
                    		15169GOOGLEUSfalse
                    172.217.21.35
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    172.217.21.36
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    172.66.0.235
                    		unknownUnited States
                    		13335CLOUDFLARENETUSfalse
                    172.217.17.42
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    172.64.41.3
                    		unknownUnited States
                    		13335CLOUDFLARENETUSfalse
                    52.113.194.132
                    		unknownUnited States
                    		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    172.217.19.238
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    1.1.1.1
                    		unknownAustralia
                    		13335CLOUDFLARENETUSfalse
                    172.217.17.35
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    239.255.255.250
                    		unknownReserved
                    		unknownunknownfalse
                    173.194.220.84
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    23.195.39.65
                    		unknownUnited States
                    		20940AKAMAI-ASN1EUfalse
                    96.17.64.171
                    		unknownUnited States
                    		16625AKAMAI-ASUSfalse
                    52.109.76.240
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    18.213.11.84
                    		unknownUnited States
                    		14618AMAZON-AESUSfalse
                    103.174.153.151
                    		elysiumproperties.netunknown
                    		7575AARNET-AS-APAustralianAcademicandResearchNetworkAARNefalse

                    Private

                    IP
                    192.168.2.16

                    General Information

                    Joe Sandbox version:41.0.0 Charoite
                    Analysis ID:1580035
                    Start date and time:2024-12-23 18:53:25 +01:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:defaultwindowsinteractivecookbook.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:24
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • EGA enabled
                    Analysis Mode:stream
                    Analysis stop reason:Timeout
                    Sample name:[External] 120112 Manual Policies Overview Guide_ 8VM8-WZPT3L-LYH1.eml
                    Detection:MAL
                    Classification:mal56.phis.winEML@37/53@23/230
                    Cookbook Comments:
                    • Found application associated with file extension: .eml
                    • Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
                    • Excluded IPs from analysis (whitelisted): 52.109.76.240
                    • Excluded domains from analysis (whitelisted): neu-azsc-config.officeapps.live.com, config.officeapps.live.com, prod.configsvc1.live.com.akadns.net, officeclient.microsoft.com, europe.configsvc1.live.com.akadns.net
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size getting too big, too many NtQueryAttributesFile calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • Report size getting too big, too many NtSetValueKey calls found.
                    • Timeout during stream target processing, analysis might miss dynamic analysis data
                    • VT rate limit hit for: [External] 120112 Manual Policies Overview Guide_ 8VM8-WZPT3L-LYH1.eml

                    Created / dropped Files

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):0
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:
                    MD5:89F5674B19BFA4E264AF613C9F887615
                    SHA1:EA1ECB76682F038A5C703C3164D5108D32FC43AE
                    SHA-256:D305524343A8653E2B099857D11B5678B08EF31FCD15D228C0C58BE29B1474D1
                    SHA-512:A3CBA852BC3A7ADD39673035FF804877EDF764B56ADBB88575CC6EE7A5D0AF13D7ECA89904E635841958E05826197DECBC9CE82110A173981FBAB321A618DFDF
                    Malicious:false
                    Reputation:unknown
                    Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379536464711576","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":652906},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ee258d55-34f1-44b0-959c-af25795c6e34.tmp

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):403
                    Entropy (8bit):4.988246156294102
                    Encrypted:false
                    SSDEEP:
                    MD5:89F5674B19BFA4E264AF613C9F887615
                    SHA1:EA1ECB76682F038A5C703C3164D5108D32FC43AE
                    SHA-256:D305524343A8653E2B099857D11B5678B08EF31FCD15D228C0C58BE29B1474D1
                    SHA-512:A3CBA852BC3A7ADD39673035FF804877EDF764B56ADBB88575CC6EE7A5D0AF13D7ECA89904E635841958E05826197DECBC9CE82110A173981FBAB321A618DFDF
                    Malicious:false
                    Reputation:unknown
                    Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379536464711576","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":652906},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241223175417Z-184.bmp

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                    Category:dropped
                    Size (bytes):71190
                    Entropy (8bit):1.7595846273428408
                    Encrypted:false
                    SSDEEP:
                    MD5:5CCAA60BBB6D1052FC3C7FFC4E929363
                    SHA1:8D869E00221236D4749C2F2B7E5AC1D89C720135
                    SHA-256:0C7D835FF280D5F60752C714DC3DA6A4374F04B3133858CFAD60C9E18744758E
                    SHA-512:85AE2C538744D09DDC7FB3A2C066BC68B91EC4C6EF641241D784AE15824462400E59B82A7B210B8FDB36741A25BB774C0CEA6E60A8CD6EA76BABA02C3BD271E9
                    Malicious:false
                    Reputation:unknown
                    Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                    Category:dropped
                    Size (bytes):57344
                    Entropy (8bit):3.291927920232006
                    Encrypted:false
                    SSDEEP:
                    MD5:A4D5FECEFE05F21D6F81ACF4D9A788CF
                    SHA1:1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
                    SHA-256:83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
                    SHA-512:FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
                    Malicious:false
                    Reputation:unknown
                    Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:SQLite Rollback Journal
                    Category:dropped
                    Size (bytes):16928
                    Entropy (8bit):1.2152154201864362
                    Encrypted:false
                    SSDEEP:
                    MD5:0CACCDC86380FEBA6CDE7C5E1A23EB4B
                    SHA1:9D66DD9D9AFD5E5D58E25B380FF0B823D9D936E7
                    SHA-256:5816AC9771917E0C9E9E6A21FB291D24F9FBA3572299D5F9535CF6AD2366B296
                    SHA-512:5C6CC0BA5FD0B8E49B3D7F9E0C016C418CD26381350CFAAEC894284EB5FD80BEC13C9E25C55E89BB413DEE2DCCD977FCCAB11FF0196906DAA70ACFF18CBFAF21
                    Malicious:false
                    Reputation:unknown
                    Preview:.... .c.....W5.>........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:Certificate, Version=3
                    Category:dropped
                    Size (bytes):1391
                    Entropy (8bit):7.705940075877404
                    Encrypted:false
                    SSDEEP:
                    MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                    SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                    SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                    SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                    Malicious:false
                    Reputation:unknown
                    Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                    Category:dropped
                    Size (bytes):71954
                    Entropy (8bit):7.996617769952133
                    Encrypted:true
                    SSDEEP:
                    MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                    SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                    SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                    SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                    Malicious:false
                    Reputation:unknown
                    Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):192
                    Entropy (8bit):2.7529698674325394
                    Encrypted:false
                    SSDEEP:
                    MD5:4ADC7EFE5D84ECE308E0793DE751C900
                    SHA1:E46FEDD9DE9D7709046CEB87052CCDB4A0E082BB
                    SHA-256:22D1FF189D157A6C941D577E3C283EADD37A7D93DB562C2149410548A5D3102D
                    SHA-512:D699ED8BF97E28F95A97E10FCCF0C1D91710327DA7EE75170005D291F3FFC1410AB224D660B283A0CBBCA44AE4902F5755B7463B484A9CA597F11B66466CBEF4
                    Malicious:false
                    Reputation:unknown
                    Preview:p...... ............cU..(....................................................... ..........W.....N..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:data
                    Category:modified
                    Size (bytes):328
                    Entropy (8bit):3.1391791584200512
                    Encrypted:false
                    SSDEEP:
                    MD5:C927FDC8B5A8EC1A8A121276E24FDD97
                    SHA1:D55E6C4E844C944B78F5F3DDCC285C9635ECA574
                    SHA-256:836AF7E0E730095383E21CDC22947E1391D830870D8DB7374081153C2A7BC6E6
                    SHA-512:5115AC5DECB5090FD983C68E0D2AA2E32A544FDC14BD40B3A5ADB397C003A24DED29D1434D8440BA65D2EDFE3B863BAA60027520BFAFC64016BD1E5BE558DD8F
                    Malicious:false
                    Reputation:unknown
                    Preview:p...... ...........cU..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:PostScript document text
                    Category:dropped
                    Size (bytes):0
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:
                    MD5:8BA9D8BEBA42C23A5DB405994B54903F
                    SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                    SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                    SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                    Malicious:false
                    Reputation:unknown
                    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1444

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:PostScript document text
                    Category:dropped
                    Size (bytes):1233
                    Entropy (8bit):5.233980037532449
                    Encrypted:false
                    SSDEEP:
                    MD5:8BA9D8BEBA42C23A5DB405994B54903F
                    SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                    SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                    SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                    Malicious:false
                    Reputation:unknown
                    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:PostScript document text
                    Category:dropped
                    Size (bytes):0
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:
                    MD5:8BA9D8BEBA42C23A5DB405994B54903F
                    SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                    SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                    SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                    Malicious:false
                    Reputation:unknown
                    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:PostScript document text
                    Category:dropped
                    Size (bytes):0
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:
                    MD5:B60EE534029885BD6DECA42D1263BDC0
                    SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                    SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                    SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                    Malicious:false
                    Reputation:unknown
                    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1444

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:PostScript document text
                    Category:dropped
                    Size (bytes):10880
                    Entropy (8bit):5.214360287289079
                    Encrypted:false
                    SSDEEP:
                    MD5:B60EE534029885BD6DECA42D1263BDC0
                    SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                    SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                    SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                    Malicious:false
                    Reputation:unknown
                    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):295
                    Entropy (8bit):5.385701335396328
                    Encrypted:false
                    SSDEEP:
                    MD5:EE8E8DEB79E07A77DA78A4822CC993EE
                    SHA1:5BEA37E8A94B1293F6B132538A4E9AA96EA213DD
                    SHA-256:F74A9BFF66D0448B68416236AD2A7C760B230055890937007CE2ACEB635CC22A
                    SHA-512:38B83023BBA150DEA122D72F51749D30AB535D3967F12A8BA4B0D93C6F3425ECF67A99307044BA57B2A84EB6EB35090CC1316CCD169877F64F48AA863726BA3D
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):294
                    Entropy (8bit):5.337333931250345
                    Encrypted:false
                    SSDEEP:
                    MD5:DD1C770FBE651947E0F8CF689D77E6B5
                    SHA1:CAF319D36A51B1323BC6639385FCB67713AD1DC7
                    SHA-256:25A4C34D5ECECCA0D2A9A5AE7D33430EF822787A69B1F7A537D01D7852D9DEA2
                    SHA-512:7F4719E30D7919E8F3ABAAD3E3259E0A5C13733AA0994A65F3ECC53E509A81CC505D19147BAFA25E3B605E7A85A2AAB8F26D48CC6E36B46714C433B247D400B3
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):294
                    Entropy (8bit):5.315733250118776
                    Encrypted:false
                    SSDEEP:
                    MD5:503F84523AD006671384D984754392FE
                    SHA1:D7D3C3640B4568CFD84BB5523A24E09B014147CE
                    SHA-256:6BFA577DE714D925A04994393AA9E489736D3C8AD4804550B4C13F79FE708DA3
                    SHA-512:05A521ACB4AE6552AD430E41A519051472646D2C33449798D527352C09E41F6CCEFA4D6EA24D2C7F6BF6B3D67C766B68EC2F2CC7AEC4B5289E546E704A1D3D78
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):285
                    Entropy (8bit):5.374865311824311
                    Encrypted:false
                    SSDEEP:
                    MD5:9F310999C901AB0E856C61CF0D781456
                    SHA1:BA20BFAAC206B8676BD242D8298619AE4499369B
                    SHA-256:9926EE15463443A4B5B1B5A6CCF2989BD1B46AE2C99CC12A23A10DC2C0F84174
                    SHA-512:D61AC7ECDF78E4F078E46BC6FD859AAD42F0500224F8941419AFA9330B35C5122BB250EE0385B02D7BDCA391926A439CA2A999708A7E53979A13125F0DC29B0B
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):1123
                    Entropy (8bit):5.692680567983813
                    Encrypted:false
                    SSDEEP:
                    MD5:16F85FDCA8B6B33A677C90ECDE52372C
                    SHA1:B3E7A29D1E43116BFF78B4E301C09DD96CF6C184
                    SHA-256:820036236EC8AB7C00EAB40FAC10CEF1448CCE33F53939AC30ED2153D25870B4
                    SHA-512:5868CDD401A9F0E2895ABDB1C0BBA18F9191EB258DEF4986196EAD0452D8D5B2043242F9CAB684EC141928816444BE1023FF6A53231925D9986A0CA55C31A8E9
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):289
                    Entropy (8bit):5.325372864502769
                    Encrypted:false
                    SSDEEP:
                    MD5:FF436CD560DF9E4FACA9BEF702C4F436
                    SHA1:A4B97E5E15A985B26CC9CA1E9EFA28491F4361E7
                    SHA-256:214122B6874C189BFE84540B0C354CD8E30995D5A54C186998E45265A74AFEDF
                    SHA-512:9DA1AA6C0356C38E122082E71706D1C2B2329E255A34E1B33F2472E67FE6DB0EC04634D2DA0149935E7BB02606BFA704F53C92E8EEEA13F61AA335D39BCF8DE3
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):292
                    Entropy (8bit):5.328364233307669
                    Encrypted:false
                    SSDEEP:
                    MD5:B574C34E1213BC9C50F661928AD3CC08
                    SHA1:EACE11B7FA9EA504304D54C593FC8829067E64B0
                    SHA-256:67B1086EF8989654B64DE4D851AB781A46DB58FA4ACDF7E4A16AF65C219528ED
                    SHA-512:95A2D17C2E8839B79763D2D9BBAACB7BBA7B8CF5BC4DFB73CEBA639B43C28A00CCC6B9F7896816D0AC148278ED16C4C7CA281A977F2A28E06EC8F83D5D7F7323
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):289
                    Entropy (8bit):5.3351810805159205
                    Encrypted:false
                    SSDEEP:
                    MD5:630BD7A155E09D84AB18C1D7ECD62ED7
                    SHA1:C29980D36AC38804F92EDF92EFB59889FD637991
                    SHA-256:6DDE74CBAD04ED88D08520CB8C7537E789B274D9CDC438E78A43A333734529EB
                    SHA-512:CF9CF6630977EBE97A961ADD3FF1EF0E6A4767DCE1F554AD478ABECA501226FD9734BEC92DFCA2EEB1DC2D8D1C2278B8274F6AB0D0A95B87A299B814E6A62F9C
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):295
                    Entropy (8bit):5.350479777682556
                    Encrypted:false
                    SSDEEP:
                    MD5:6B69E6247F75B2F332C6D871E8150D80
                    SHA1:622125B52055DAB38BD1C8FD8D9A30BD5AFF386F
                    SHA-256:6DA12224F0E03AC7015BB37B89561A3733E110D02B845E5826FBCA6345681A7D
                    SHA-512:9FD8D1E5848ACF317973884721ED673EF29DF21C9A924F6A20F10EB15806D18F7449D3F9C0A105D1B214DDCE469A50E50C2183B421E3E0A52EF55FFC198E6EC2
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):289
                    Entropy (8bit):5.3317695306312745
                    Encrypted:false
                    SSDEEP:
                    MD5:8A89AADD5192E143AC2FEE83D427D0DC
                    SHA1:E2F97B39A8616A6E822BE243F4C3EF188BAEA300
                    SHA-256:63E5100D13BC5DF5725868FABB5758A48BE365D47FDB9B37183E63FFA3A2B076
                    SHA-512:0CA3933002166B8F453D5D8734C28A5131D16F1C877BD3F6325B6C5CAF47C89FFEED9316D280B7043132149CB6EE54934DAC6DE7D24E952CAB3BE50ADD4E3FB3
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):284
                    Entropy (8bit):5.318061524643488
                    Encrypted:false
                    SSDEEP:
                    MD5:791228C1CB226F80AC30AA65C9817CB7
                    SHA1:EE252E838C2846B3D38293FE305BE903C0CCE7C0
                    SHA-256:C7E1CA24DD98612C84BA3E5D18ADE446351EAB185FDF9D68CCAC4BF97819D8CC
                    SHA-512:A18AEBE8A36B588D1613E2D5C19A7217B6DD6E3880CD7DBC500607A34CF4E0E514902796D68929A401E4B1EF50299F1B27961DFD23129B0953618F9605C5B775
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):291
                    Entropy (8bit):5.315098281015575
                    Encrypted:false
                    SSDEEP:
                    MD5:AE4F7BAF0D35CF642C38543E9AD49C9A
                    SHA1:E7A22D9F69ED99082F8246B5DF0B84A42DDEC772
                    SHA-256:A89BD9B787CD3C8E5468EAB0B45910610EE0A97170E2F7B44016ED08B1B2A530
                    SHA-512:6BDBA5C36828CE33C26638D6564BBFCE331F38A33B7A8B803F8A0834E399FCC95572F9050E901391136E98175E7EB36BC145C3D42D69EF74515A748125D30030
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):287
                    Entropy (8bit):5.318919339076073
                    Encrypted:false
                    SSDEEP:
                    MD5:54C674E6E69A634290C1E80CA20816C5
                    SHA1:F290F5177A415C4CFC12F5B1A5656DD670F7E831
                    SHA-256:28E7791D5D13A8F8A97D852FCFB0A435B47E3C044A5D4B541BBE1A351E584B1C
                    SHA-512:5347E61A6E95EECE059DE59023DB4F5AB4551ED23E6D6511383A837C2A4FF4EAB98AB444C20D02DC862EA22ED5DBAB27E1568CAC7CEEBDD4B8D9A2D7C47F69B6
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):1090
                    Entropy (8bit):5.669732763180986
                    Encrypted:false
                    SSDEEP:
                    MD5:4597F6A681CA7A3CC434BF351E176ECC
                    SHA1:3329BC63ACAC86ACE08EFEDDF0B690E9972B3CAC
                    SHA-256:6E51381B17858884E287D85FDAB95EB5B6C34AD4C1D43FA8D0860759D2EA2229
                    SHA-512:23604D3D97E3A1D48A26E7244991A104288EEBC8FBFFB995F227DCFEE16AA5A1AFCF7BDA8B55EAB8600DEDAE66CC2017842D03A27173987BFA9D0501BA8D08EA
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):286
                    Entropy (8bit):5.295071433956548
                    Encrypted:false
                    SSDEEP:
                    MD5:0E5E9603C14E7B35729A41555F923653
                    SHA1:7BB5922E4F1DE9A5665671E2A46519B51FC710EB
                    SHA-256:A49E7ABC9A5721ADF23B227EE05B9ED3D6DB9089CB3613C79169E547D3620FB4
                    SHA-512:65E44929A11B01528EB45169F29E72533F4FBBED175C063CAB6FE9AD3FF7D155865A7FF9B8B97F0EB16E2563FEF77F3FC49022762015815D59465D3C90710B6F
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):282
                    Entropy (8bit):5.301071408262971
                    Encrypted:false
                    SSDEEP:
                    MD5:E9BDACE37CBFC51D184B1DF4940A801F
                    SHA1:DE62E4925F5F4CBF39B48B7FB5A2EBEB8D858F31
                    SHA-256:FDE33D1890BBC8A2D1E37321452989438302B331D5E44CB9587903A2564D548D
                    SHA-512:CB20321F99EEE0873873FB802B8BC48994D30091DD3A2CBEFC1BCD64FA171B2F69F872FE8FD1EB88AC50D2DFF978309D737F22916F0E026FEA2E96B9DCEA4185
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"85b44152-b538-4513-8828-da69f8c7ab34","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1735150238325,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):4
                    Entropy (8bit):0.8112781244591328
                    Encrypted:false
                    SSDEEP:
                    MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                    SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                    SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                    SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                    Malicious:false
                    Reputation:unknown
                    Preview:....

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):2814
                    Entropy (8bit):5.151102482770077
                    Encrypted:false
                    SSDEEP:
                    MD5:5DAEA09A6CCD061E022FFDBF032A44F5
                    SHA1:2E33D7EFCF295F6B5C8D6E21C9838B8CBEED7A41
                    SHA-256:05D3349B99D65FC1433BA14A993D3E1FDE62ECBC0FA6901C197F51B535699751
                    SHA-512:781D1050774A44A5D20A5341D94BDA419755082460A29CF7C64E2086423257DD19DF68C5EDEF6B6F51E48F0D50745B5A8CAD756E2D23209ADFF0732ACF96ECF6
                    Malicious:false
                    Reputation:unknown
                    Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1672f8ca65aa80738ddc67296d245750","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1734976463000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1c9770b9a754453e315df6999d05fe6b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1734976463000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b4378ddfc672f7d43db2dcf86129c4bd","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1734976463000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7569106ecf47124324f84c2ed84b4e63","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1734976463000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"7bf306fa01f46c8ab8ae28088f1c878d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1734976463000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5815c1c2cc792d0ebf719cc674a25cf5","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                    Category:dropped
                    Size (bytes):12288
                    Entropy (8bit):0.9885921235948995
                    Encrypted:false
                    SSDEEP:
                    MD5:67306B24F2D7E45A48FF9CD0BA29AB9A
                    SHA1:D5399C0C177ECF3BC25163E706B893FFEF02A24D
                    SHA-256:0E0A7C8DCD2469CF384C966B62B9EFD7BD1DF77B68225F7FC712EA08E9E957F7
                    SHA-512:5F4B87A356ECFB0FE7CB8712B12DE5223BE97A8BDC27D7C6FD65857A5AB8EBD506AEF9749088887A9C7F65181EA6655E5030A9A3D0F4CF9B833245D63EC39E99
                    Malicious:false
                    Reputation:unknown
                    Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:SQLite Rollback Journal
                    Category:dropped
                    Size (bytes):8720
                    Entropy (8bit):1.34632308524739
                    Encrypted:false
                    SSDEEP:
                    MD5:2789797AE61F8B5EB85048A966EE8F85
                    SHA1:B375A0C61F6EBBAA00601AAB30BAAB5378646089
                    SHA-256:D0462CC314660F33860096BC106CE8354023363027516B9566520921EEB7B738
                    SHA-512:2BC8AB7A438804B9E53F33936C8ED3AB29F6328C40771308D460878B81D5A7FB6F8E54F56AD200742AA3517C32043A37F619C8CDDF9C22F9D06A6A8590A0735C
                    Malicious:false
                    Reputation:unknown
                    Preview:.... .c........q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):66726
                    Entropy (8bit):5.392739213842091
                    Encrypted:false
                    SSDEEP:
                    MD5:7407614B77A39809589DBB5EF014A072
                    SHA1:B5A0D6CFC141403763E9A979BF0E02AD3776234C
                    SHA-256:1D26F450937216C1295187BD6F227913CC0AEA889EBFA1B5A95AEE161850B60F
                    SHA-512:96043CF00C93B2C0A4B84E95BB8A4F5984AB8F05A9BD48B5383ACDAE773718F364E12B5702DA8005E311984B91A60006B2BB6050D91929C55EAD8F5F73F6D92E
                    Malicious:false
                    Reputation:unknown
                    Preview:4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

                    C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:modified
                    Size (bytes):231348
                    Entropy (8bit):4.3893058312109
                    Encrypted:false
                    SSDEEP:
                    MD5:F77FA9A1C476688486427BF88763790D
                    SHA1:7D2156F9E7C2FCDE1D08E405EA0087A26EA94FC7
                    SHA-256:6DC060BED429E86768F7A24486502874FF624CA4E16A2C93341D904EE1330A5A
                    SHA-512:652B6DFF36DF86E01587CF182791C54FD08B2670B2B9FA2A0C6FEAE52FF3817768D4261DB9FF16C239302F8C4F702E791C1B9AEE830C755CF8102660236D7E3A
                    Malicious:false
                    Reputation:unknown
                    Preview:TH02...... ...cU......SM01X...,....K..cU..........IPM.Activity...........h...............h............H..h.\............h........P...H..h\cal ...pDat...h...0...H.\....hv.W............h........_`8k...h..W.@...I.lw...h....H...8.=k...0....T...............d.........2h...............k..............!h.............. h6......`.\...#h....8.........$hP.......8....."h........0.....'h..............1hv.W.<.........0h....4....=k../h....h.....=kH..h.?..p....\...-h .........\...+h.W......\................. ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:ASCII text, with very long lines (65536), with no line terminators
                    Category:dropped
                    Size (bytes):322260
                    Entropy (8bit):4.000299760592446
                    Encrypted:false
                    SSDEEP:
                    MD5:CC90D669144261B198DEAD45AA266572
                    SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                    SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                    SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                    Malicious:false
                    Reputation:unknown
                    Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):10
                    Entropy (8bit):2.4464393446710155
                    Encrypted:false
                    SSDEEP:
                    MD5:6F750746CA0331965C63DB74ADB784F7
                    SHA1:7B29073137E716B28C5F9856F73C6BCFF5F1A0DC
                    SHA-256:DCF59E23128DA0E439245B411CFC28D919714CD8B4447519A6496E09083E552B
                    SHA-512:0B5B95DECE7C4261708F27AF3282D178C46721E54C8D5C35D2A1ED6A344A11B8C5E53AA1EAA5E10815561F435C4634FC3587C56E35E35BD58317D867108EB644
                    Malicious:false
                    Reputation:unknown
                    Preview:1734976446

                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\8A86F8DC-A4E6-47CE-A00B-B46631712CA9

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):183024
                    Entropy (8bit):5.293755316301917
                    Encrypted:false
                    SSDEEP:
                    MD5:EEE2342796E0D6965DE3F74098CAC9D0
                    SHA1:6397F4946DA0BFEF721727C335EB8F3E3AE3BEA1
                    SHA-256:6FDC36135549CE48D5DE3363DE3800804FA3FB6E1DF931CD4EF3CC188366F822
                    SHA-512:7EBE6D59804F3F25EDA129146BCD87ACBFCA872B2273275C68AFD671D178507EE6A1CBC3ED935B1DABAC39CA6EE8B53C2FA93C7D3C418107EBEF50AEBDF59690
                    Malicious:false
                    Reputation:unknown
                    Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-12-23T17:54:02">.. Build: 16.0.18406.40129-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results?fullframe=yes</o:url>.. <o:ticket o:policy="DELEGATION" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Bearer {}" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.Resourc

                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:SQLite Rollback Journal
                    Category:dropped
                    Size (bytes):4616
                    Entropy (8bit):0.1345655650480048
                    Encrypted:false
                    SSDEEP:
                    MD5:264AFB47C432E41C3F64587FC5A7BD6F
                    SHA1:139F2F150C6C2B239A950C5E8C2A8BB724778C7B
                    SHA-256:D59C8B72A2F7AEF24234246276D15092AD615BC9C3C9B8C42C80CB05B40A900B
                    SHA-512:E62E0A2ADA7BDC90FBB890D92993D24464B24D27367BEDE09FBF4AF96A3A146DB0B7D8C1C7EAB2DAC6D902FE18F53E315ADB6E2EE98A2CD7FCB588BB405DBD66
                    Malicious:false
                    Reputation:unknown
                    Preview:.... .c....... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):2278
                    Entropy (8bit):3.850435228471206
                    Encrypted:false
                    SSDEEP:
                    MD5:F112D2B8C8FCDB108445383B8073F265
                    SHA1:CD3F3D493A491FC801B1F00B3F71E94562CD3A41
                    SHA-256:9A9221A20EF7015194897E73B99B85A90EF8306A8ACD35FBF891AAAFB4CB477B
                    SHA-512:C113C549A694067FED9C752CE7B268C13E6969B13D5AC920D13D6693F8F1F01042743D0074782EEFA0B0C282F8400C7454BFA9F5A6BF8C83AE0322EFF2956488
                    Malicious:false
                    Reputation:unknown
                    Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.F.f.M.C.G.x.V.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.I.L.4.h.D.0.

                    C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):2684
                    Entropy (8bit):3.9043448160626286
                    Encrypted:false
                    SSDEEP:
                    MD5:A9B1847C2BD069161F123A929B5F29DA
                    SHA1:9A5BF16355610B5F916E79FACCC637F72768D721
                    SHA-256:211203B221FC7743C1F6B71220DF4FEAA85871D5F88D959A25A920607BB71C27
                    SHA-512:6C0E269EB5F5C26DBC9CC1D48E14ECC23F9701E01A5B972D2085B5C98B4C0C08D03E3F84B70E107274EC497999CCC8FB1EBB9954B28F18FAA2F755B1CE1E93B9
                    Malicious:false
                    Reputation:unknown
                    Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".p.A.3.x.H.z.V.0.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.I.L.4.h.D.0.

                    C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):4542
                    Entropy (8bit):3.9936586310304945
                    Encrypted:false
                    SSDEEP:
                    MD5:154F7075E3DB3A56FBAFE275AC0F4711
                    SHA1:C0975728994463B3E5C0E31E5E5A21E94CCB13EB
                    SHA-256:F47C2A49CB407E4C2D198A304786C5421709DB24FE8D8C81AA9633D33CE30EF6
                    SHA-512:AFB71F72EEB65A46E91CC22405DEFC6E1950030EC5B442308C38F315F0271F9A80FBE9234C39B0D79CA0B80F29041AE59282F42AF76156996D4625DEAD1C7BAB
                    Malicious:false
                    Reputation:unknown
                    Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.X.Z.c.7.m.N.V.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.I.L.4.h.D.0.

                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\68D09D53.dat

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:PNG image data, 128 x 128, 8-bit/color RGB, non-interlaced
                    Category:dropped
                    Size (bytes):6700
                    Entropy (8bit):7.949610424333066
                    Encrypted:false
                    SSDEEP:
                    MD5:8EA473742D4318F9BFF155660B533A4E
                    SHA1:66D9BEA31EEEB28384D31C42217D20D455C0C009
                    SHA-256:912DC2FE28C2F13BDB02BC3F20814310D7FA3BBFDA86F5E7F28AD4694F13983C
                    SHA-512:F42C09C4D76B260C1F38FF6C18B42AF297060710D9DEF7C3DA670FC694403E04CBBE24D445CD7C4492D37CC19DA1344E3433B373A28FCC273D5C4676C4E5B44E
                    Malicious:false
                    Reputation:unknown
                    Preview:.PNG........IHDR.............L\......IDATx..|..T..ZU.w.........QPy.." *...5...57j....W.|..xrL<.....x.#.#z|.. .... .F...f.GOw.]U.~U.{..A1....e..73.wu..k...j..A.......:".BFD@......!#" dD.........2".BFD@......!#" dD.........2".BFD@......!#" dD.........2".BFD@......!#" dD.........2".BFD@......!#" dD......!NtA.../......+........._.O..........w.G....Sx.i....&......../..j(....;>.D..e.O.OA..w.....R|.$,%....1...0......c\.G.m...Y.|...]..=..< ......d....4.yO.... ....9P.j.[.=.o-...Z.T.|..vm=...p.HJ..%..o....d....i.@R!.},..%h9.o9.ym.!....C...3?..m..>0.i.T. 1.....i.v...j_....P~<....._Y......u..>00..bL..%....C.=...@`'.X..x...4..........cm[...(d.d ...............%.U S....'.+..^".g1.H3tl.REMu.P...@h.....O....J^:............0,.3.>.}h;.2 ....d...x..........>*..F...d. ....._.7~<...@.C.......U@.;.qP.fO8."...hy.....8E.....w....*....u;R...l....... .=.l..8W..n....r.....M.5.H.....J....s..I..-.j+...d...?R*..E..x.ev;.G.0.-...).X.....[.u..-/1.}8....~..P__Y.*O..

                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\2HLBY5LH\ppuhl Reference YQy Manual_120112 (002).pdf:Zone.Identifier (copy)

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:PDF document, version 1.7, 0 pages
                    Category:dropped
                    Size (bytes):0
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:
                    MD5:9EC4B82D731174A727CE098DA0FBB174
                    SHA1:934B7FF7D69D795FBD65557FEA2937B8F91F3DDA
                    SHA-256:27783C32B1E64F267D18DE9E3B393B956FBE9FDB4FEA8C655DB57CCA7E42E3B5
                    SHA-512:BA6F3F8740335A6B46D7F9FEDEF7075BDCEBC08A5E98C0B7E7BF66AD515FDC543911E0BDFA897D658B173D105D560C9D1F621B484E82F84AEE691C840D85B191
                    Malicious:false
                    Reputation:unknown
                    Preview:%PDF-1.7.1 0 obj.<< /Type /Catalog./Outlines 2 0 R./Pages 3 0 R >>.endobj.2 0 obj.<< /Type /Outlines /Count 0 >>.endobj.3 0 obj.<< /Type /Pages./Kids [6 0 R.]./Count 1./Resources <<./ProcSet 4 0 R./Font << ./F1 8 0 R./F2 9 0 R.>>./XObject << ./I1 10 0 R./I2 12 0 R.>>./ExtGState << ./GS1 13 0 R./GS2 14 0 R./GS3 15 0 R./GS4 16 0 R.>>.>>./MediaBox [0.000 0.000 612.000 792.000]. >>.endobj.4 0 obj.[/PDF /Text /ImageC ].endobj.5 0 obj.<<./Producer (...d.o.m.p.d.f. .+. .C.P.D.F)./CreationDate (D:20241223103456-07'00')./ModDate (D:20241223103456-07'00').>>.endobj.6 0 obj.<< /Type /Page./MediaBox [0.000 0.000 612.000 792.000]./Parent 3 0 R./Contents 7 0 R.>>.endobj.7 0 obj.<< /Filter /FlateDecode./Length 1255 >>.stream.x..V...6...+...H.$EQToY4.n..m.K..([XI.Jr..g./...R.(.:.E...3"g.g.gfCI*.,..n..B....T....eBQ.C...0B)........d...t4...h.........4r/.b.*.y.w..~1.?6...".O.s...... ...H.......$1lK./?..........-..y.w.sk^k]....?}...~...,...T.....0(6z`....wS.....O.5.......g..2.....rShx.y...9..g.

                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\2HLBY5LH\ppuhl Reference YQy Manual_120112.pdf

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:PDF document, version 1.7, 0 pages
                    Category:dropped
                    Size (bytes):36604
                    Entropy (8bit):7.920441330926633
                    Encrypted:false
                    SSDEEP:
                    MD5:9EC4B82D731174A727CE098DA0FBB174
                    SHA1:934B7FF7D69D795FBD65557FEA2937B8F91F3DDA
                    SHA-256:27783C32B1E64F267D18DE9E3B393B956FBE9FDB4FEA8C655DB57CCA7E42E3B5
                    SHA-512:BA6F3F8740335A6B46D7F9FEDEF7075BDCEBC08A5E98C0B7E7BF66AD515FDC543911E0BDFA897D658B173D105D560C9D1F621B484E82F84AEE691C840D85B191
                    Malicious:false
                    Reputation:unknown
                    Preview:%PDF-1.7.1 0 obj.<< /Type /Catalog./Outlines 2 0 R./Pages 3 0 R >>.endobj.2 0 obj.<< /Type /Outlines /Count 0 >>.endobj.3 0 obj.<< /Type /Pages./Kids [6 0 R.]./Count 1./Resources <<./ProcSet 4 0 R./Font << ./F1 8 0 R./F2 9 0 R.>>./XObject << ./I1 10 0 R./I2 12 0 R.>>./ExtGState << ./GS1 13 0 R./GS2 14 0 R./GS3 15 0 R./GS4 16 0 R.>>.>>./MediaBox [0.000 0.000 612.000 792.000]. >>.endobj.4 0 obj.[/PDF /Text /ImageC ].endobj.5 0 obj.<<./Producer (...d.o.m.p.d.f. .+. .C.P.D.F)./CreationDate (D:20241223103456-07'00')./ModDate (D:20241223103456-07'00').>>.endobj.6 0 obj.<< /Type /Page./MediaBox [0.000 0.000 612.000 792.000]./Parent 3 0 R./Contents 7 0 R.>>.endobj.7 0 obj.<< /Filter /FlateDecode./Length 1255 >>.stream.x..V...6...+...H.$EQToY4.n..m.K..([XI.Jr..g./...R.(.:.E...3"g.g.gfCI*.,..n..B....T....eBQ.C...0B)........d...t4...h.........4r/.b.*.y.w..~1.?6...".O.s...... ...H.......$1lK./?..........-..y.w.sk^k]....?}...~...,...T.....0(6z`....wS.....O.5.......g..2.....rShx.y...9..g.

                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\2HLBY5LH\ppuhl Reference YQy Manual_120112.pdf:Zone.Identifier

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:ASCII text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):26
                    Entropy (8bit):3.95006375643621
                    Encrypted:false
                    SSDEEP:
                    MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                    SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                    SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                    SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                    Malicious:false
                    Reputation:unknown
                    Preview:[ZoneTransfer]..ZoneId=3..

                    C:\Users\user\AppData\Local\Temp\MSI955ea.LOG

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):246
                    Entropy (8bit):3.5029068020919194
                    Encrypted:false
                    SSDEEP:
                    MD5:9DE9CE8A280A05AE8CD8A5FE027C7A89
                    SHA1:2012F7E233030BF2D6BD6065CE7C3CCECBA8A23A
                    SHA-256:32B781EB11CEB983C9E6DDFEFAF58DDF9B61B9BDBE0151384CD844890A48990F
                    SHA-512:46C064830956E98E10D75671BC7167EC16AECD8912FA3266A37FC335658C6A040A7D2CA55B2EC9BCC2A799192ABE044991969A4015DC4741F2A5F1CDD81A918E
                    Malicious:false
                    Reputation:unknown
                    Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.3./.1.2./.2.0.2.4. . .1.2.:.5.4.:.2.5. .=.=.=.....

                    C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-23 12-54-14-572.log

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:ASCII text, with very long lines (393)
                    Category:dropped
                    Size (bytes):16525
                    Entropy (8bit):5.353642815103214
                    Encrypted:false
                    SSDEEP:
                    MD5:91F06491552FC977E9E8AF47786EE7C1
                    SHA1:8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
                    SHA-256:06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
                    SHA-512:A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
                    Malicious:false
                    Reputation:unknown
                    Preview:SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

                    C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:ASCII text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):29752
                    Entropy (8bit):5.419126401214951
                    Encrypted:false
                    SSDEEP:
                    MD5:7BCE2E84431D47571FBEFBE9F58982EC
                    SHA1:C28E4CE280028467DBE95F01BA598B186DF68F41
                    SHA-256:46B17E36F134F6DE0AEEA2AE0545D3F9E0D885FC003E291173049896CF02E281
                    SHA-512:A4FCEB46C6A7114475B4FDA85FB2A97758B3A6F1B30B85EB993ED0DA4BE69B455E2FB0A42C6E7B61682F51C46CD95846B2C80CCA533408DB143D6F4AD7F765FD
                    Malicious:false
                    Reputation:unknown
                    Preview:06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

                    C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):30
                    Entropy (8bit):1.2389205950315936
                    Encrypted:false
                    SSDEEP:
                    MD5:17E8F6BEB0E30149C12CA33ACD6E6A05
                    SHA1:1FAA1D1785996AE3C1EC43814C1A1AFC357ECD6D
                    SHA-256:F535D7D3A3F146443D0F254414CDAA3B767BCE17EF5178E9D3AD5AFBAB238F3D
                    SHA-512:B48EB8F80967E288B5F0A63AFDAD83A2F588CBB71627542397B9F5B93D3AFC48B2CB979C39A61D7AB59804500990CFE0017ADD4542254A46191C89456DDAB82D
                    Malicious:false
                    Reputation:unknown
                    Preview:....{.........................

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 16:54:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2673
                    Entropy (8bit):3.9906558146036
                    Encrypted:false
                    SSDEEP:
                    MD5:E8CD9D807EEB14EAA2856A37DFAB9FC2
                    SHA1:544D29FC66021DB5C853793D0B8364FBCB7F15BC
                    SHA-256:093813A37DFB3833D3A9A8C87A3DDEA17CDC435C7F1ADCE3B1001E0AF1CD44C3
                    SHA-512:72C474B9967F544FCDE5F95D3F557AB960430F24EC957FE5AB51D1E4DDA9FB1A57202BA824313212FA9D7C119903996124AF2F455722C81AB64E3107A81ACEC1
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,......cU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........h'.x.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 16:54:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2675
                    Entropy (8bit):4.00868796207109
                    Encrypted:false
                    SSDEEP:
                    MD5:CA52107BB05A53DF44EB8E859D159572
                    SHA1:ADE32D3673733062653BBBA35F7ABEAFACBFADDB
                    SHA-256:DE57F24004C849F97C01330A7647743D7866EE950215751D0DDA86CB904C7E01
                    SHA-512:469D668B7F43E5D089C5BFAEC2097285FF5F4142DAC28F8072AD550F08C28D2B1D29A6A86ECA952EB6BAD3435A536EA799843CA56124CF65AC4C051F31481EBB
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,....v..cU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........h'.x.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2689
                    Entropy (8bit):4.013309939175911
                    Encrypted:false
                    SSDEEP:
                    MD5:47B2C8FF7580B871DF5CB2800B047C8E
                    SHA1:77CF67BF524B3E0DA3EDB114DC2FEBF7B83658AD
                    SHA-256:B0BE7765253A8F70068BA2864041E1771BB5572FB903258868BDBFD1615F6D74
                    SHA-512:29824FB21E731FEED8496606F1681AD44210DE4A80F258F7DF8C939276AFC2DBDB4A632CA48D2C70C88D8111F2835698CEAF26F9A5CF9B9F3AF8EC6C28858054
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........h'.x.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 16:54:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2677
                    Entropy (8bit):4.002133731379451
                    Encrypted:false
                    SSDEEP:
                    MD5:C3507F99DE64CB20AB8C21CE7E5D4C18
                    SHA1:565D69DAAB082AE6B283D073F4545B3D67D0DD86
                    SHA-256:FC54ECA92D11982CA1391576CD8A1F1D62D7FFFB50668D12189DECE8141CC744
                    SHA-512:52B43B3A113BAF2EBFA8FEDCA1604A502A202FD9A7288D4A902A732FA8CF769D13EE2B1330D20F298F53A45FD3BB2524A7D0B0F1835C1FD5069A0444842CCCA7
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,....\E|.cU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........h'.x.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 16:54:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2677
                    Entropy (8bit):3.994403391854786
                    Encrypted:false
                    SSDEEP:
                    MD5:1365E67059FECB8AD2C4E89A1A3CD4DC
                    SHA1:09FA0B1955D8F34F9D6E42FC369E06782C790377
                    SHA-256:C3FB6E952C8876E334880655865DA2A0924AE585B3CFFA6786EE4D030BE64DF8
                    SHA-512:E457D37F1572FB573E9975A444988D0EDFFAF8E29D170A658D6961C01C6AA3E23D0F98C5F60EC0A005FB8558D7427F02384E0AA0E786696F0E16A8EFD69B8F0E
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,........cU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........h'.x.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 16:54:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2679
                    Entropy (8bit):3.999496150497277
                    Encrypted:false
                    SSDEEP:
                    MD5:3394DC3330365CECAA16AEFFB149CB32
                    SHA1:7C9E3358A9D1EF6C72D0A86E2CAAE1F125129CEC
                    SHA-256:6D05E17E383DAA93E793D46006E69340E5FECF3AB8EF87F6EBC2F653F8643377
                    SHA-512:271F93A10E65A1A6A8D4503E83A2C842F333DA1EEE405DB0D18528C8B308FA8352C7C2E047318C8F64AC7CEFE6AE22D782F0A887CB8946A48E8BF2E82E0BE93C
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,.....Ds.cU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........h'.x.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    Static File Info

                    General

                    File type:RFC 822 mail, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                    Entropy (8bit):6.13400152279626
                    TrID:
                    • Text - UTF-8 encoded (3003/1) 100.00%
                    File name:[External] 120112 Manual Policies Overview Guide_ 8VM8-WZPT3L-LYH1.eml
                    File size:72'475 bytes
                    MD5:712511535987a0e3eb53798d01577d53
                    SHA1:25d0882ea51a1725c5eaea970e8823abd04e9580
                    SHA256:7df07f24452651b6b5334d115c3da380c50ce020e3cef5be78e6746ddc7d3049
                    SHA512:adde198c861a9cd0e18ec2db86911a13f6631793fba0b01c4c1e066f6bee639aeab053cccb198263e24c5b63c51a2f5cdee1b9d43074a7ced30e4716856684ba
                    SSDEEP:1536:vFDUdw8v0d0m3rCo/0a3++Tk4fU/CKbJdvEVqO:zhb7Z3jzU6MRO
                    TLSH:6363F13BA447183ECB27A5FD6943680736C5386FA466E152760D10BB02CF427BAF9D9C
                    File Content Preview:...Received: from CH0PR10MB4907.namprd10.prod.outlook.com (2603:10b6:610:db::8).. by BY5PR10MB4370.namprd10.prod.outlook.com with HTTPS; Mon, 23 Dec 2024.. 17:35:35 +0000..Received: from BN9PR03CA0530.namprd03.prod.outlook.com (2603:10b6:408:131::25).. by

                    Static Mail

                    General

                    Subject:[External] 120112 Manual Policies Overview Guide: 8VM8-WZPT3L-LYH1
                    From:orders@therasage.com
                    To:ppuhl@biolegend.com
                    Cc:
                    BCC:
                    Date:Mon, 23 Dec 2024 10:34:56 -0700
                    Communications:
                    • Caution: this message originated from outside the organization. [logo] Employee Reference Guide The document titled Employee Reference Guide requires your review and signature. Attached is a PDF copy for you to confirm and acknowledge the outlined terms. Pflichtangaben/Mandatory Disclosure Statements:http://www.sap.com/about/legal/impressum.htmlDiese E-Mail kann Betriebs- oder Geschftsgeheimnisse oder sonstige vertrauliche Informationen enthalten. Sollten Sie diese E-Mail irrtmlich erhalten haben, ist Ihnen eine Kenntnisnahme des Inhalts, eine Vervielfltigung oder Weitergabe der E-Mail ausdrcklich untersagt. Bitte benachrichtigen Sie uns und vernichten Sie die empfangene E-Mail. Vielen Dank.This e-mail may contain trade secrets or privileged, undisclosed, or otherwise confidential information. If you have received this e-mail in error, you are hereby notified that any review, copying, or distribution of it is strictly prohibited. Please inform us immediately and destroy the original transmittal. Thank you for your cooperation.
                    Attachments:
                      Key Value
                      Receivedfrom WIN-OGPPCN056L8 ([134.202.56.136]) by :SMTPAUTH: with ESMTPSA id PmKWt8TPJLy0FPmKct890O; Mon, 23 Dec 2024 10:35:05 -0700
                      Authentication-Resultsspf=pass (sender IP is 188.121.53.64) smtp.mailfrom=therasage.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=therasage.com;compauth=pass reason=100
                      Received-SPFPass (protection.outlook.com: domain of therasage.com designates 188.121.53.64 as permitted sender) receiver=protection.outlook.com; client-ip=188.121.53.64; helo=sxb1plsmtpa01-06.prod.sxb1.secureserver.net; pr=C
                      X-CMAE-Analysisv=2.4 cv=D829KuRj c=1 sm=1 tr=0 ts=67699f4a a=kF6SBgABdJ76O8miSJipvw==:117 a=kF6SBgABdJ76O8miSJipvw==:17 a=g3gHYpnLlgcA:10 a=g8TUdU_LZmEA:10 a=0aE9QUaO_QmmuWBIoxcA:9 a=CjuIK1q_8ugA:10 a=UnnwD1GPAAAA:8 a=qhNviuim65Inh3WTYtkA:9 a=_W_S_7VecoQA:10 a=lqcHg5cX4UMA:10 a=QEXdDO2ut3YA:10 a=qaLDUfkZ4akA:10 a=3v_5HTRYhTSdM1G4DzYA:9 a=n3BslyFRqc0A:10 a=rls1ZAiwvL0A:10 a=ypsZHo1NW83-kNo6Qn4A:9 a=HXjIzolwW10A:10
                      X-SECURESERVER-ACCTscodo@jeyw.skiilashi.com
                      DateMon, 23 Dec 2024 10:34:56 -0700
                      Toppuhl@biolegend.com
                      Fromorders@therasage.com
                      Subject[External] 120112 Manual Policies Overview Guide: 8VM8-WZPT3L-LYH1
                      Message-ID<12011244198974JLA.7589hpiI357.p38NbDB978zlvJ613@Biolegend.com>
                      Content-Typemultipart/alternative; boundary="_2ed5820a-8cde-4d15-986a-008b2c57122f_"
                      Content-Transfer-Encoding8bit
                      X-CMAE-EnvelopeMS4xfNMIdYLhqMnBFazbqEqYehk7GTBSKr57mi8vFOehUNPgyrArOGqkdkkNMeTpt+1nJXdk9NGCHyjUyOLFy8Lm4neYx/tnr1TwciCh30kLKn6IktgY6KyR 02+R3Sr9x7mSTYr6Xk9lfjLuiMXLQR0OwWXOjqlVvaByh8MZjD1iJqkXrWu41iWoATFlTBtUTxc0DQ==
                      Return-Pathorders@therasage.com
                      X-MS-Exchange-Organization-ExpirationStartTime23 Dec 2024 17:35:14.0267 (UTC)
                      X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
                      X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
                      X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
                      X-MS-Exchange-Organization-Network-Message-Id 2fceae4b-b631-4df3-4b85-08dd23782893
                      X-EOPAttributedMessage0
                      X-EOPTenantAttributedMessagefa246a9e-8fe0-4eed-9eec-93652a25c4ee:0
                      X-MS-Exchange-Organization-MessageDirectionalityIncoming
                      X-MS-PublicTrafficTypeEmail
                      X-MS-TrafficTypeDiagnostic BL02EPF0001A102:EE_|CH0PR10MB4907:EE_|BY5PR10MB4370:EE_
                      X-MS-Exchange-Organization-AuthSource BL02EPF0001A102.namprd05.prod.outlook.com
                      X-MS-Exchange-Organization-AuthAsAnonymous
                      X-MS-Office365-Filtering-Correlation-Id2fceae4b-b631-4df3-4b85-08dd23782893
                      X-MS-Exchange-AtpMessagePropertiesSA|SL
                      X-MS-Exchange-Organization-SCL1
                      X-Microsoft-Antispam BCL:0;ARA:13230040|5073199012|4073199012|8096899003|4076899003|43540500003;
                      X-Forefront-Antispam-Report CIP:188.121.53.64;CTRY:FR;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:sxb1plsmtpa01-06.prod.sxb1.secureserver.net;PTR:sxb1plsmtpa01-06.prod.sxb1.secureserver.net;CAT:NONE;SFS:(13230040)(5073199012)(4073199012)(8096899003)(4076899003)(43540500003);DIR:INB;
                      X-MS-Exchange-CrossTenant-OriginalArrivalTime23 Dec 2024 17:35:13.6361 (UTC)
                      X-MS-Exchange-CrossTenant-Network-Message-Id2fceae4b-b631-4df3-4b85-08dd23782893
                      X-MS-Exchange-CrossTenant-Idfa246a9e-8fe0-4eed-9eec-93652a25c4ee
                      X-MS-Exchange-CrossTenant-AuthSource BL02EPF0001A102.namprd05.prod.outlook.com
                      X-MS-Exchange-CrossTenant-AuthAsAnonymous
                      X-MS-Exchange-CrossTenant-FromEntityHeaderInternet
                      X-MS-Exchange-Transport-CrossTenantHeadersStampedCH0PR10MB4907
                      X-MS-Exchange-Transport-EndToEndLatency00:00:22.2789288
                      X-MS-Exchange-Processed-By-BccFoldering15.20.8272.000
                      X-Microsoft-Antispam-Mailbox-Delivery ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
                      X-Microsoft-Antispam-Message-Info XLsZvLT9PO21lBt73Hg/Zg/gjCowjv4K3R4pvNbb+q3WO+xm+q3yiBb/OATZ9K1EqZkeWdlAn2hQJPTrhWjj1qtinQoadtpVmCXg7J1ppMVmMTBaeAu1GCuoSjbzXf7ZhfBHO7CJbNgVxB+dawaprwqRhnr+gJ1xBwsAKYra/Sb7zS3YKtv6fyxsU5DvX+j0DhLssbv6EIDoUVzDDseRZRf3YAHJfO6VakRzs4cmvTpUT+JNo1tUpRPO2D3DMvs9ZPcxIJD+thuT+I4B8gcF72mrAc5fQc8PRXDxvzsF9FCtJWPfbCL8qdEbdw2pi6aW/xGJxFQUoQ27/2WkWcMPSFcAxa0V73W6o8njYQOpt6GSk+l7HYXcavwFbM0uoCDdTdjGBDigVQrstvTR8iz1qg0tDD1G5vwyDxwN5+2WevUDfUvLJdD+aW3alj6xgcpQjgWIVvxf4D6xjRQKxcp9AhMrG/b55I9U+yUHUD6g2hdW4ESFtZbzqWnEasKSkDZA2wmrPjzGnfn91W6K4bFNTqDhQa5g3WuchXE24bOVN56U1jR9lSc40vR1NxZ7X2afViafYoOqkrveRaN24kbi8k/NKXGsraxZ4tWip3TklyHM9JiLu/Sc1M4YdDCcF68ZDHUfXohYeHTg4mHhSq+CrQ47mXPBk1VA2csZSdLdGMJesk0SUqciyYHAKSOrUoKwdjmuqsNR7AAOfiU/DPfoZKgfRQ5Y9bu9S1/r+2swMhMJq00WYqZMTxUbEgw+nDTQA2SBbF9CCBp1k51H5WUrxBMmkHTFrBkAj5aMG/8UeAtORymORpAE9txyAZPr+kkUC/SMDf1vwjHh/l3DpwoW/0gVX5XTzI8f6d6xro2z8XyZWtIj1bF4kVzIuddYFj9+c3QO0lxAG+gpnEC5GpO1ykRCNN9iRV379iFHZsyWxuV4rYr6MkPc/QELwrIIY/snilVksI2IPnOyAXaJ+ktruxc/C3ZgfTYQyBJDDysiLMhgJwH2KZVtSjBh+2bWaOXcOe9jJlN8Njq4Z9z9U7iCkikin3SV5yQWKQ+rWSOfzrveDNntXFW544q7QZCGzCcwvT5ZQGMxGmzU7Tmzmr2/eJc9tAFkcsu534E9itIOLdBZ5RxVfIOhRPVYujmfsEDSAwMlD+z7IZqkY6W4fO6+QVOsoHmqPDb9NrirVw8X2FUY2NmXOWBaLzTFd8yfHYBthxwZjsU2jmr0NqAWlA0FhIrjaytB+GnCpRSACg147PubSMfYPtm0bemubB02NDba7V5kfH3L8HL+HfaBi3mvH/CdvyNrpEO4vtJfpWLZQv6m9SmywbvOqr0L9j1Jma5kGupkmchxCpF7SJfNP9QAvifG7md31+2lIlIrd6qtiUKhc0rj2G2MlY80fzSW8BYPqla+P0jAhEwECBoN6Qb+hjML6Hjx/+4VXrnnHJev6apPr0ZtUmNASAkYN6kAXBOG1BW/0yIg7Ic2WFlkDw+ZmMvZA/oySYS0Cvt98YzG1m5qZfCrwdQ521rIO7D6J3g6R568A3H43Z9ix0CFnce7Zc0l7dlVPOQiqr6YgfEYS0nfm31Zo0i10nFJFUc3AbMlAcWaAtaZS34IFWD+HYf+aLhA9B3JQ2P0uyjNEB2pi+JJqS6QIFrYRIry5qkmBOdyU7ipzoQYL3NCfNGvAuw+P6G1XTPJNHCz9C0zhhRu2aV6GCJzabKVEbEPHPZldGY0OHi+ue9+92qTUvQaopVBAxElm9dpMMwfuhb6sviNb6L9jMWGKQkfuwD4wZe0LmJ4BWOrL3lwTt/lpfqnUBkAjSbefxJzuM7YB0LczuKaFPcllM7Y5KZ/VQ126b9Ogl8Q6EdKCm75sAfoWBJyF8bm6Qi4aEnYtkc+sNgdojAiRwh4gonehPRkQ6s6HQ9SVma4pCr9BBLV9VF2+arwLYY5ULM7+E1p0CUm846X/RdZu9xB6oVl7XNC/ZknfHejkolrNNpk1YpzmQnEjZGftG2bA71jaTPwVej+IAyMB0TxIIEC1T0oX1Rtup97cACOH71ZsQAekli+7ydkn6Ex2YGobD5XCmC5QWhLh6h64q8J88C/NrvytcS7FiAhK8oUizs3N7lLyIurqMOgI3Q7ntkPaQ==
                      MIME-Version1.0

                      File Icon

                      Icon Hash:46070c0a8e0c67d6