Edit tour

Windows Analysis Report
phishingtest.eml

Overview

General Information

Sample name:	phishingtest.eml
Analysis ID:	1584027
MD5:	d92f54097fa8e7e8351f4b0c526766a9
SHA1:	d8f7ef7fd37f555ebc3650e7bcb261d61c12b736
SHA256:	9206e05b6526d783f4f0df70fa05723a90cf02d54b36f36f1472ee93afac941f
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

Creates a window with clipboard capturing capabilities

IP address seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Outlook Security Settings Updated - Registry

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6972 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phishingtest.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 7052 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "AE3842F3-4B46-407E-93B9-BC48317ECC3C" "6414065B-BA2B-4351-945D-A87980A02F5D" "6972" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

Acrobat.exe (PID: 6388 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7V90LNRU\Open 332.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3972 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6344 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1164,i,9528970337408047140,8902369827790921300,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8084 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.com/url?q=https://offsiteforms.store/1wq4W8&sa=D&source=editors&ust=1734917344975185&usg=AOvVaw351shL2sABmvKRpEejl5tD MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7408 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1896,i,13739452463520773973,10384309443688143443,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6972, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7V90LNRU\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6972, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: PDF document

Joe Sandbox AI: PDF document contains prominent button: 'click to continue'

AI detected potential phishing Email

Source: Email

Joe Sandbox AI: Detected potential phishing email: The subject line is suspiciously repetitive and spammy, containing multiple variations of the same message about account balance replenishment. The email body contains random, nonsensical text fragments mixed with legitimate-looking Google Docs references. The attachment '332.pdf' with a generic name combined with account-related claims is a common phishing tactic

Source: Email

Classification: Credential Stealer

Source: https://www.google.com/url?q=https://offsiteforms.store/1wq4W8&sa=D&source=editors&ust=1734917344975185&usg=AOvVaw351shL2sABmvKRpEejl5tD

HTTP Parser: No favicon

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.36
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.196
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.196

Source: global traffic	HTTP traffic detected: GET /url?q=https://offsiteforms.store/1wq4W8&sa=D&source=editors&ust=1734917344975185&usg=AOvVaw351shL2sABmvKRpEejl5tD HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQi5ys0BCMfRzQEIidPNAQjc080BCMvWzQEI9NbNAQiK180BCKfYzQEI+cDUFRi60s0BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQi5ys0BCMfRzQEIidPNAQjc080BCMvWzQEI9NbNAQiK180BCKfYzQEI+cDUFRi60s0BGMvYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/url?q=https://offsiteforms.store/1wq4W8&sa=D&source=editors&ust=1734917344975185&usg=AOvVaw351shL2sABmvKRpEejl5tDAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=Ambpgyum6R16n3Ex1ERRSrZGjUeEfba1ZVicRJDb4ipkDbVjdu8n4ttdqaKYn6DFzbiExu6Rh9B3L-Wy5qzcY0w_aiIQlWbO44BSb50l3_X5XYBaTbgMcucnWWdqPHc5Cd3mh_v5x0pb1vOZlief4uoY2vL02z5pRKizUkRn2s1bKYNm-rl7FyKXzVspeKjKG3zf4w
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=Ambpgyum6R16n3Ex1ERRSrZGjUeEfba1ZVicRJDb4ipkDbVjdu8n4ttdqaKYn6DFzbiExu6Rh9B3L-Wy5qzcY0w_aiIQlWbO44BSb50l3_X5XYBaTbgMcucnWWdqPHc5Cd3mh_v5x0pb1vOZlief4uoY2vL02z5pRKizUkRn2s1bKYNm-rl7FyKXzVspeKjKG3zf4w

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: offsiteforms.store

Source: 77EC63BDA74BD0D0E0426DC8F80085060.11.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.11.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: 7851c594-d350-4674-8507-440f4237afd1.tmp.12.dr, f5dee65a-a010-4a7e-b7b4-b827ed509b09.tmp.12.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: phishingtest.eml	String found in binary or memory: https://docs.google.com/drawings/d/1dkbLi49y3JQRyVOPkSMc7r-v-rgTS9vROyawO=
Source: chromecache_232.16.dr	String found in binary or memory: https://offsiteforms.store/1wq4W8
Source: phishingtest.eml	String found in binary or memory: https://ssl.gstatic.com/docs/docli=
Source: phishingtest.eml	String found in binary or memory: https://workspace.google.com/
Source: phishingtest.eml	String found in binary or memory: https://www.gstatic.com/=

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: classification engine

Classification label: mal48.winEML@37/61@11/5

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250103T2156090855-6972.etl

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phishingtest.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "AE3842F3-4B46-407E-93B9-BC48317ECC3C" "6414065B-BA2B-4351-945D-A87980A02F5D" "6972" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7V90LNRU\Open 332.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1164,i,9528970337408047140,8902369827790921300,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.com/url?q=https://offsiteforms.store/1wq4W8&sa=D&source=editors&ust=1734917344975185&usg=AOvVaw351shL2sABmvKRpEejl5tD
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1896,i,13739452463520773973,10384309443688143443,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "AE3842F3-4B46-407E-93B9-BC48317ECC3C" "6414065B-BA2B-4351-945D-A87980A02F5D" "6972" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7V90LNRU\Open 332.pdf"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.com/url?q=https://offsiteforms.store/1wq4W8&sa=D&source=editors&ust=1734917344975185&usg=AOvVaw351shL2sABmvKRpEejl5tD	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1164,i,9528970337408047140,8902369827790921300,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1896,i,13739452463520773973,10384309443688143443,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.15.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	21 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	1 Clipboard Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://offsiteforms.store/1wq4W8	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
offsiteforms.store	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/url?q=https://offsiteforms.store/1wq4W8&sa=D&source=editors&ust=1734917344975185&usg=AOvVaw351shL2sABmvKRpEejl5tD	false		high
https://www.google.com/favicon.ico	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://offsiteforms.store/1wq4W8	chromecache_232.16.dr	false	Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	7851c594-d350-4674-8507-440f4237afd1.tmp.12.dr, f5dee65a-a010-4a7e-b7b4-b827ed509b09.tmp.12.dr	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.11.dr	false		high
https://workspace.google.com/	phishingtest.eml	false		high
https://docs.google.com/drawings/d/1dkbLi49y3JQRyVOPkSMc7r-v-rgTS9vROyawO=	phishingtest.eml	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.196	unknown	United States	15169	GOOGLEUS	false
142.250.186.36	unknown	United States	15169	GOOGLEUS	false
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584027
Start date and time:	2025-01-04 03:55:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	phishingtest.eml
Detection:	MAL
Classification:	mal48.winEML@37/61@11/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 184.28.90.27, 52.109.68.130, 20.189.173.7, 184.28.88.176, 3.233.129.217, 3.219.243.226, 52.6.155.20, 52.22.41.97, 162.159.61.3, 172.64.41.3, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 142.250.184.195, 216.58.206.46, 74.125.133.84, 142.250.185.78, 172.217.18.110, 142.250.181.238, 4.175.87.197, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, odc.officeapps.live.com, slscr.update.microsoft.com, europe.odcsm1.live.com.akadns.net, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, clients2.google.com, redirector.gvt1.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, www.google.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, ecs.office.com, google.com, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, frc-azsc-000.odc.officeapps.live.com, ctldl.windowsupdate.com, p13n.adobe.io, s-0005-office.config.skype.com, onedscolprdwus06.westus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, armmf.adob
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:56:35	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

LLM Input / Output

Input	Output
URL: email Model: Joe Sandbox AI	{ "explanation": [ "The subject line is suspiciously repetitive and spammy, containing multiple variations of the same message about account balance replenishment", "The email body contains random, nonsensical text fragments mixed with legitimate-looking Google Docs references", "The attachment '332.pdf' with a generic name combined with account-related claims is a common phishing tactic" ], "phishing": true, "confidence": 9, "generated_by_ai": true }
{ "date": "Mon, 23 Dec 2024 00:29:05 +0000", "subject": " Your account balance has been replenished with your funds! \n\n Get ready to spend with your replenished account balance! \n\n Your funds are back and your account balance is looking good! \n\n Your account balance is now replenished with your funds! \n\n Your account balance is back to normal with your funds! \n\n Your account balance is now replenished - time to treat yourself! \n\n Your account balance is looking healthy with your funds replenished! \n\n Your account balance is back to normal - thanks for your patience! \n\n Your account balance is now replenished - happy spending! \n\n Your account balance is back to normal - enjoy your funds! \n\n Your account balance is now replenished - time to make some purchases! ", "communications": [ "Attached: Open 332.pdf\nSent using Google Docs https://docs.google.com/\n\nWeve received your payment application! Our team is committed to \nreviewing it promptly and efficiently. You can expect a decision within \nGranby. In the meantime, if you have any questions, please dont hesitate \nto reach out. We appreciate your patience! \n\n\n \nhttps://docs.google.com/drawings/d/1dkbLi49y3JQRyVOPkSMc7r-v-rgTS9vROyawOplkRes/preview\n\n\n\n suction that completely fails without the use of Cathcarts tube. The Such \nbeing his observations and views, he rejoiced in the popular Putavimus eum \nquasi leprosum. Isa. liii. . digestive juices of the animal have converted \nthe starches and sugars.\n" ], "from": "\"Pamphile Cinkan (via Google Slides)\" <drive-shares-noreply@google.com>", "to": "cvanreenen@hotmail.com", "attachements": [ "Open 332.pdf" ] }
URL: https://google.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://google.com
URL: PDF document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Click to continue", "prominent_button_name": "Click to continue", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.google.com/url?q=https://offsiteforms.store/1wq4W8&sa=D&source=editors&ust=1734917344975185&usg=AOvVaw351shL2sABmvKRpEejl5tD Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "The previous page is sending you to https://offsiteforms.store/1wq4W8.", "prominent_button_name": "return to the previous page", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Email Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "We've received your payment application! Our team is committed to reviewing it promptly and efficiently. You can expect a decision within Granby. In the meantime, if you have any questions, please don't hesitate to reach out. We appreciate your patience!", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: PDF document Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://www.google.com/url?q=https://offsiteforms.store/1wq4W8&sa=D&source=editors&ust=1734917344975185&usg=AOvVaw351shL2sABmvKRpEejl5tD Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Email Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Email Model: Joe Sandbox AI	{"classification":"Credential Stealer"}
Email: Detected potential phishing email: The subject line is suspiciously repetitive and spammy, containing multiple variations of the same message about account balance replenishment. The email body contains random, nonsensical text fragments mixed with legitimate-looking Google Docs references. The attachment '332.pdf' with a generic name combined with account-related claims is a common phishing tactic	{"classification":"Credential Stealer"}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	http://livedashboardkit.info	Get hash	malicious	Unknown	Browse
	iGhDjzEiDU.exe	Get hash	malicious	Remcos	Browse
	random.exe	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	Unknown	Browse
	1735939565593f5d6bf694464eb338b020a826ec212acacc46d4424bb914edbae3d507116e469.dat-decoded.exe	Get hash	malicious	LiteHTTP Bot	Browse
	https://track2.mccarthysearch.com/9155296/c?p=UJEwZLRSuPVlnD1ICTWZusB5H46ZFxhQFeZmgv_N89FzkqdhuHSGoPyB5qZfahmny00oVnRJ_XGR4M89Ovy-j3JZN_nz1Nb-BfHfDXVFwrd4A8njKtxWHgVV9KpuZ3ad6Xn31h13Ok4dSqgAUkhmVH1KUMKOlrKi5AYGmafMXkrBRxU_B4vy7NXVbEVJ970TwM25LbuS_B0xuuC5g8ehQDyYNyEV1WCghuhx_ZKmrGeOOXDf8HkQ-KOwv_tecp8TMdskXzay5lvoS31gB-nWxsjPaZ8f84KWvabQB4eF73ffpyNcTpJues_4IHHPjEKJ9ritMRTaHbFdQGNT_n13X_E7no0nMmaegQjwo4kKGu6oR02iG2c_6ucy3I6d8vsNl324Pjhx3M20dDmfZAju1roW9lGyO1LfgEnp1iSAFpx4kA7frEmKGzJYNX_cZrwVBoH8vvIYauXGnXBrZacRhuZGGbOjW2HHr9KF-0q7xjdgG2hxjWZ2H9zjubJGDnUjHRfiIr_-0bem1pLFqziEmy0450LGuXV23cQ6GD8yuK9tuRwMIF0sbkhVqONC0e6TsXlkUuTRAVWBbLlRPcygJ-CbukwvFtAxobVQ8-PpIuGj97DYFnmbfbJrrZDtH57TpdP4AxtW5k74BKSXvb1B6JX0p7Oyr1kXxLs_OrNPdAdrf8gXR35D9W7WeQ2zhPEqP0Mv5sJx4DlYh6Y4FqgPfCRFcDcL7Cy3HSlJ0XYfv-ae4o-hdX_0rJPqEG_-Bn2yj60YPDYpE8KDIgC_ZMwlNLdK4pAK6vSt4NWDncuV5y7QDqt97ribjd4U3AOvQTKW9r_eMky9-IC9hkSPrg2S0ZBgA9ITW3AQ3v-lq94cAwt1v1RLaFgsy67l_7lni1gYsZaQdOsFJsDpCFYaZsTMcVz2QAnQ_2UidhzlUekPl5xh9LNe9o77rO1FolZslooaXxCf2U2RZmvUA6NCNiGZ8KSsoUYTnqAHenvBJVJwMWd66yD2O60rC3Ic2qOQ1KOF9AB6-iFTvQFxtSTjS2hFwi7N97LeQtVYKhdzZuq2SasgJg0JPnZiFv_FSbgmiodqx9rz_lWIqWQNoQVht-oO2BfFxSF_aedAmm2MuQAL7z8UjBf_deiKwQyfKOyA6ZkAJ14F9xwhNm9F7B4PBgDtocqJQBjw5Cf1jCBSAs3nSYP2_nzofJuQSXd-YD9PIzkkmJw7Nqux7IgJ6p1z2Hsf6i3zShVdZY3g2mmA1xR1FV1LoSYwcRBqZt3pv0UDjuqCEoiqKDuyT0rkhqTRLo29uuM588Lna16PFSgSLoLUhnJ2rx8NLQQc5TqrsGjlN-ulCwTEyA0C9Epz9mxq14yDjw==	Get hash	malicious	Unknown	Browse
	https://covid19.protected-forms.com/XQTNkY0hwMkttOEdiZmZ0V2RRTHpDdDNqUTROanhES0NBYmdFOG1KTGRSTUtrK3VMMzlEN1JKVVFXNUxaNGJOQmd1YzQ3ajJMeVdZUDU3TytRbGtIaFhWRkxnT0lkeTZhdy9xWEhjeFBoRXRTb2hxdjlVbi9iSk1qZytLQ0JxRjd4UmpOS3VUQ2lpOEZneTRoVmpzY2dyekR1WlhYOWVteVcrUXg0a2Y2aEU2ZEZwMVNId3R0U01RK3N3PT0tLVR0bDl1WEFUelg3K2VzTystLUxaMkFrZnU0UmJXRkR3aE5NRE9BOEE9PQ==?cid=2351432832	Get hash	malicious	KnowBe4	Browse
	https://www.copiat.ro/6.exe	Get hash	malicious	Unknown	Browse
	http://www.cipassoitalia.it/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	http://lzkaw.theaudiobee.com/4JvVHv3166gBJC324kvamxlnkfn259BVCQSWLGBOGFXUP772APMZ15384h17	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	a36r7SLgH7.exe	Get hash	malicious	AsyncRAT	Browse	199.232.214.172
	3lhrJ4X.exe	Get hash	malicious	LiteHTTP Bot	Browse	199.232.214.172
	2Mi3lKoJfj.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	Reparto Trabajo TP4.xlsm	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	DcRat, JasonRAT	Browse	199.232.214.172
	iviewers.dll	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.214.172
	wrcaf.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.210.172
	iubn.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.210.172
	rwvg1.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	199.232.210.172
	ersyb.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	199.232.214.172

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.161858425275866
Encrypted:	false
SSDEEP:	6:iOVGCAq2PRN2nKuAl9OmbnIFUtf/cVNJZmw5/cVNDkwORN2nKuAl9OmbjLJ:7V8vaHAahFUtf/kX/5/kF5JHAaSJ
MD5:	14282D890EEC94E61B81B145B3C27F10
SHA1:	70FF9E0D0DF95018371A2F0790AAE151C4B0FE5D
SHA-256:	F0E033F608F7A918A1041FAEA639F89F7B58212C0F608AE7D57D567A66C4F796
SHA-512:	C5DA6563CEBDFED42A45F5BB2F92D3BF6D81817EB753C3045BD713BF4DC6971480265C6023752A77DB1AF9CEA9020B725D6C69173B39AD4C112316A9A94301F8
Malicious:	false
Reputation:	low
Preview:	2025/01/03-21:56:22.819 e90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/03-21:56:22.825 e90 Recovering log #3.2025/01/03-21:56:22.825 e90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.161858425275866
Encrypted:	false
SSDEEP:	6:iOVGCAq2PRN2nKuAl9OmbnIFUtf/cVNJZmw5/cVNDkwORN2nKuAl9OmbjLJ:7V8vaHAahFUtf/kX/5/kF5JHAaSJ
MD5:	14282D890EEC94E61B81B145B3C27F10
SHA1:	70FF9E0D0DF95018371A2F0790AAE151C4B0FE5D
SHA-256:	F0E033F608F7A918A1041FAEA639F89F7B58212C0F608AE7D57D567A66C4F796
SHA-512:	C5DA6563CEBDFED42A45F5BB2F92D3BF6D81817EB753C3045BD713BF4DC6971480265C6023752A77DB1AF9CEA9020B725D6C69173B39AD4C112316A9A94301F8
Malicious:	false
Reputation:	low
Preview:	2025/01/03-21:56:22.819 e90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/03-21:56:22.825 e90 Recovering log #3.2025/01/03-21:56:22.825 e90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.165493359883235
Encrypted:	false
SSDEEP:	6:iOV/1q2PRN2nKuAl9Ombzo2jMGIFUtf7sZZmw57szkwORN2nKuAl9Ombzo2jMmLJ:7V/1vaHAa8uFUtf7A/57o5JHAa8RJ
MD5:	2529C6C3A54286220224B6B17B6A5E79
SHA1:	A280FBFA5318CAEC37425DE15A633DEB82E706E6
SHA-256:	216CB77210440B9ABF357FD93BFD4E28D11443EFC7A4DB2D31B8004B656B996F
SHA-512:	B0C9066D579C16734DFF3D716FF34AACCE8728F329395088A6E74E3989D63C89F6971F6252C39B709CE79787507514C3D14917777BFA2FFE2760C15B9EF667D5
Malicious:	false
Reputation:	low
Preview:	2025/01/03-21:56:22.730 cd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/03-21:56:22.734 cd4 Recovering log #3.2025/01/03-21:56:22.734 cd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.165493359883235
Encrypted:	false
SSDEEP:	6:iOV/1q2PRN2nKuAl9Ombzo2jMGIFUtf7sZZmw57szkwORN2nKuAl9Ombzo2jMmLJ:7V/1vaHAa8uFUtf7A/57o5JHAa8RJ
MD5:	2529C6C3A54286220224B6B17B6A5E79
SHA1:	A280FBFA5318CAEC37425DE15A633DEB82E706E6
SHA-256:	216CB77210440B9ABF357FD93BFD4E28D11443EFC7A4DB2D31B8004B656B996F
SHA-512:	B0C9066D579C16734DFF3D716FF34AACCE8728F329395088A6E74E3989D63C89F6971F6252C39B709CE79787507514C3D14917777BFA2FFE2760C15B9EF667D5
Malicious:	false
Preview:	2025/01/03-21:56:22.730 cd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/03-21:56:22.734 cd4 Recovering log #3.2025/01/03-21:56:22.734 cd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7851c594-d350-4674-8507-440f4237afd1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	403
Entropy (8bit):	4.983692302786361
Encrypted:	false
SSDEEP:	12:YHO8sqyZNsBdOg2Hfcaq3QYiubrP7E4T3y:YXsGdMHu3QYhbz7nby
MD5:	E3BF3E8AF3D207FE88CCD9832849125B
SHA1:	9DE77724812074BECD85FF710655E4771B83C48A
SHA-256:	D2BA5C187F5E9115F7975273B91907454CCACFB71CE168E6BED2E443D5257AA4
SHA-512:	74FD116620A1329731CE2ED00A95738579B31DF5A55579CFCB718CE4D38183E83F5CEBBD3A3A085D01821205842DCF7CF438238E6AA166BE25CCD7E77AC5F25D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13380519394916987","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127331},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.953858338552356
Encrypted:	false
SSDEEP:	12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
MD5:	4C313FE514B5F4E7E89329630909F8DC
SHA1:	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
SHA-256:	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
SHA-512:	1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF54a976.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.953858338552356
Encrypted:	false
SSDEEP:	12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
MD5:	4C313FE514B5F4E7E89329630909F8DC
SHA1:	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
SHA-256:	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
SHA-512:	1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f5dee65a-a010-4a7e-b7b4-b827ed509b09.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.953858338552356
Encrypted:	false
SSDEEP:	12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
MD5:	4C313FE514B5F4E7E89329630909F8DC
SHA1:	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
SHA-256:	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
SHA-512:	1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.23158057369832
Encrypted:	false
SSDEEP:	96:OLSw0bSwIAnrRqLX2rSq1OUxu/0OZ0xRBTxekN8xe4feQnj5t:OLT0bTIeYa51Ogu/0OZARBT8kN884fee
MD5:	C5B5330D843154525454C9850C96249D
SHA1:	70C99ACD52219F673172B290941187972C81FB80
SHA-256:	5C6C07659A92AD118FECDF88DE4DC5F757CA2826B760A0A69085D95A853EF411
SHA-512:	456B7719838171DEB9A01155D327B459D9D19C1BBC6FBA7049BEB4C4B8AB393A6336B924F67904E582149D8E11DFD173F68501B798C4AB467B6306A8AF7A565C
Malicious:	false
Preview:	*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.206081930670972
Encrypted:	false
SSDEEP:	6:iOVQMq2PRN2nKuAl9OmbzNMxIFUtfxZmw5HFkwORN2nKuAl9OmbzNMFLJ:7V1vaHAa8jFUtfx/5l5JHAa84J
MD5:	FBC63821BE6A4ABB457D2EAD38B98AA5
SHA1:	B3ACB34D158E527561CFCFEBC1B9585F99759D12
SHA-256:	C15C8364E06B5DEE23760AB6CDF1D8EE9ECCD3BD50F31B52225C4F6BF99ABAD8
SHA-512:	3E05EC75E9CB6CE42123E368D42D19F4249AEB06A9053601E50236722EB5918BF1C3F3E79CCA78620C10EB34E13AC8784126FEE545694DDB66FEEC0EE93DD1E0
Malicious:	false
Preview:	2025/01/03-21:56:22.864 cd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/03-21:56:22.865 cd4 Recovering log #3.2025/01/03-21:56:22.867 cd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.206081930670972
Encrypted:	false
SSDEEP:	6:iOVQMq2PRN2nKuAl9OmbzNMxIFUtfxZmw5HFkwORN2nKuAl9OmbzNMFLJ:7V1vaHAa8jFUtfx/5l5JHAa84J
MD5:	FBC63821BE6A4ABB457D2EAD38B98AA5
SHA1:	B3ACB34D158E527561CFCFEBC1B9585F99759D12
SHA-256:	C15C8364E06B5DEE23760AB6CDF1D8EE9ECCD3BD50F31B52225C4F6BF99ABAD8
SHA-512:	3E05EC75E9CB6CE42123E368D42D19F4249AEB06A9053601E50236722EB5918BF1C3F3E79CCA78620C10EB34E13AC8784126FEE545694DDB66FEEC0EE93DD1E0
Malicious:	false
Preview:	2025/01/03-21:56:22.864 cd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/03-21:56:22.865 cd4 Recovering log #3.2025/01/03-21:56:22.867 cd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250104025626Z-167.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 164 x -92 x 32, cbSize 60406, bits offset 54
Category:	dropped
Size (bytes):	60406
Entropy (8bit):	2.172104786153759
Encrypted:	false
SSDEEP:	384:VU+attM6BY9fhv0qDkYzhKXYvJyfhfLkOm5+J:i+aU19fx0qgIvkLkOm5+J
MD5:	20C1CAC772304D9352224D8290AE6AAF
SHA1:	F928D876A1F799199459A625E2DF1FFB1C953774
SHA-256:	95CDD8BE82F8C9C08D9FF82E5422886D2B47093135A804F06A1B96900B39D5F0
SHA-512:	0E71DC9B4F344DDC4AD75C5969F205F5B05BB4368574DE8F7D5220841E8D2C971B2D6DC7A580AD6C0B6E9E7638C79B96AF4705DA51155CA2BB9B12B4E45D44D0
Malicious:	false
Preview:	BM........6...(............. ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.291927920232006
Encrypted:	false
SSDEEP:	192:vedRBvVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:veBci5H5FY+EUUUTTcHqFzqFP
MD5:	A4D5FECEFE05F21D6F81ACF4D9A788CF
SHA1:	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
SHA-256:	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
SHA-512:	FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.2150028022175032
Encrypted:	false
SSDEEP:	48:7MncnqLmFTIF3XmHjBoGGR+jMz+LhwV+lh:71f9IVXEBodRBk+clh
MD5:	8EEAE6B78F3FBA27179463FE3ACF0830
SHA1:	8EEBA0B2701BD24110815114585FED9954C0C521
SHA-256:	31518C516A1F80B5F96B2D6F15827C223A842084893D4A7BCF0CE183F74A6DA8
SHA-512:	C3A8CAEE4D5343D0758BF67400C60012BE1B349DA242324EE45359482E99532E6EBEBCCD8268F832F77F43159D3057C5EC744949C4362063CCA7CE1BB8F96A23
Malicious:	false
Preview:	.... .c.....1..v........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7790941963225158
Encrypted:	false
SSDEEP:	3:kkFklFHDpl1fllXlE/HT8kuWs7ttNNX8RolJuRdxLlGB9lQRYwpDdt:kK+l2T8WsJTNMa8RdWBwRd
MD5:	2AD8704F7C84AF7C8681824FB48F6A6D
SHA1:	1D9406FBE930279F7793197A45544D6B8125D5ED
SHA-256:	22F2A3160333EDAD0C1D999FE05DB27B613B3AAA59FF2120A71C6BA2783A8AFC
SHA-512:	DE89EB3F9062C690658DCF9833B7653AE698216FFCA8863E13360FB88D16A8DE870F5979C285E26D0BC634733C8FEF4B86A97DCD82BF6F42FBB7C8D6CAE04713
Malicious:	false
Preview:	p...... ..........*DT^..(....................................................... ..........W.....3..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2310997727285145
Encrypted:	false
SSDEEP:	6:kKZ9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:QDImsLNkPlE99SNxAhUe/3
MD5:	B9679927E23B3A6E258024DF74D9932A
SHA1:	2D68770CD5A547AAEEF18FC1983008ED71557B83
SHA-256:	EE614C26BBE60AE5D2BF5BC201D81D404BAEF2318AFAC8B506A2B7A69162E0DD
SHA-512:	8552298B97ED043B8B39EF8A92503BDC972246D527106F19FD98E928F451459A8E0A28436A4AA2CC5744415F17418004C48F7F8706E5E2A707EA88DC243F34EB
Malicious:	false
Preview:	p...... ........G:hVT^..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.369794437703521
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuRmSK+5IRR4UhUR0YB1DeoAvJM3g98kUwPeUkwRe9:YvXKXAmS7WRuUhUt15GMbLUkee9
MD5:	3E9B9EDF290539EA6F77AB92BE3B6834
SHA1:	9315F7CE6F0EC52CC9D01BD131A89C353B26A166
SHA-256:	1BDEF8BB6F48887DA09A7429A2868EBA0B4D8AA171E5144087CDEBB75A651938
SHA-512:	0F6FA2425B532688C66FD1B23626E6E6F11BA17EC85C00F991776C880A4910725FC39BC6A3301384FC167BAF77D70337E859393C842D15FC567F5F83AF42D27D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.318571938648713
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuRmSK+5IRR4UhUR0YB1DeoAvJfBoTfXpnrPeUkwRe9:YvXKXAmS7WRuUhUt15GWTfXcUkee9
MD5:	332863E1945C2F5248772F8BA954BD38
SHA1:	E388CFF6ECE9F5E0EA603D6EAD4A5704F941E8B6
SHA-256:	5E19F47ADDB103B8FCF0F2B90511CA8003FD6A837A99523847B498379FABD033
SHA-512:	290A7B64CD78A44A832D0A1DAF111A257BFBFD41CABD392FDEB18C81A832FBF4D3931583B3B1B011AE3A961A28BE1FE22C7006C2BB5CAA98BF122CEF1D283640
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.297120255174717
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuRmSK+5IRR4UhUR0YB1DeoAvJfBD2G6UpnrPeUkwRe9:YvXKXAmS7WRuUhUt15GR22cUkee9
MD5:	CE2446CB1448C82970BFD508E9482430
SHA1:	30FF2CF02557DAEEA725A702E873AAEB7E438786
SHA-256:	65B2020357F86F191CC876000FE2D36AD522F43EE3FBEF688C7B4FFADEF1B334
SHA-512:	E4D3C3570B618CE9DBB484D8B6FD2027FF2D9DA326C4C2BF4CAECAB47214783C83650873AD6A05C84A1410A687761169850334E3355AFD958066F3B7A97DAB41
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.358400277370353
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuRmSK+5IRR4UhUR0YB1DeoAvJfPmwrPeUkwRe9:YvXKXAmS7WRuUhUt15GH56Ukee9
MD5:	46A63A05F554D067B3EAD31907E7B052
SHA1:	408CD2B4C2ADE231A4084BF0C14DE1CC3B63B627
SHA-256:	A3D9EFC5735BD1336A3B5D5BE0D8F6E1362063E08B5262C341CDCF1C16361AC0
SHA-512:	C0FA231452F0BF7B4D9F9051A9E172516F5122E1043A5049170A9919807987EF77FFD9F923F8FA8C36555C989C27794705ABC344B02BD184F98B608D1EC30D6F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691707003544865
Encrypted:	false
SSDEEP:	24:Yv6XAmS2UqpLgE9cQx8LennAvzBvkn0RCmK8czOCCSY:YvSUqhgy6SAFv5Ah8cv/Y
MD5:	5D0FAAC7F6E0824967A29D66B7364734
SHA1:	072C6E653CB55C59618ACE46F07C57DC1488CFCA
SHA-256:	CB2EBC56EEE64CD43A51A573577FE4B1B1ACB1CED38D135664DCAA08BA2B1A98
SHA-512:	FDFC99B33EC27722653589211FF54951118E2E8D36456A3CBEDADA743C76DA796BD4D734FDD102D7C352F5938FBF56CD5A3504D7B810C100AFCB9B3A8082FA80
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.307204497960682
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuRmSK+5IRR4UhUR0YB1DeoAvJf8dPeUkwRe9:YvXKXAmS7WRuUhUt15GU8Ukee9
MD5:	55E128D2F131ABDDAB1A409E86AF8A55
SHA1:	E0D6E73DCBFC828E3C4A18F372CAF923D07AF1A2
SHA-256:	1B21B156C504476AD789A48F54E6FD96AFC3A7A14F7CE9D748685A18A0FDA7E4
SHA-512:	A069F8AC43BF224418A4EF22A773AFE4B96368A692C6793125250987782FD353FFA8EAB1B1DDB14FFF1C13DB64C76EE61BABECC0C0FBB6663D1FC14788EF3A6F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.309473733907394
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuRmSK+5IRR4UhUR0YB1DeoAvJfQ1rPeUkwRe9:YvXKXAmS7WRuUhUt15GY16Ukee9
MD5:	3D462D9D6958954C3F0BCEEC821375D9
SHA1:	9CAFCAC471C98E48CD24D9AD39FA5F6FA7194F0E
SHA-256:	076084DB7A2C0DF4783D3F1BEFE41DC6ACA3FCD0311F5AE957316CDA4E2A68E3
SHA-512:	545E233A752779AF7A755F034A9C8CDEAAB4B4745D311049055CAD5F1CADD9A8F8446B0A296A360DC48E3DCDD2ED8EE6500B334F01A6074AFFABD437E55D0D60
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3175127517601455
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuRmSK+5IRR4UhUR0YB1DeoAvJfFldPeUkwRe9:YvXKXAmS7WRuUhUt15Gz8Ukee9
MD5:	D17E1B14384363D2D05BEB3989C90ED1
SHA1:	F1C6D747F6EAEF567BD7E2A9168FB01B344FE6F6
SHA-256:	8F2CE4BF49D5C16D36848442D28C2B680A47549CFC265AE65FD18871FDC40523
SHA-512:	5239BF23F316DE3920A0AE3DFEF5922DD7E1BCEB504EC6CB9EA48A11AF0134535F20662434A01560210900D0736BDD3EF78CB25417780BA4907C23F63FC8AF49
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.332864949730683
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuRmSK+5IRR4UhUR0YB1DeoAvJfzdPeUkwRe9:YvXKXAmS7WRuUhUt15Gb8Ukee9
MD5:	F9C5DB3875C338B26AFDF7B0663C2079
SHA1:	3F068765828D52CC97B57E2FAE77870FE1A876DE
SHA-256:	9A0862036DB2A3F84CE0BF02FCD9FC9F6A331CA92E418BD3F1FAF24CA5891544
SHA-512:	EC7CB0956E475618B3B3ED1D2D37BC4FE2A6D1AE87CF4768509CA99B3E94A897200B89444EEA2726106BB90086F0AE812983C72EA3028CCAE2133B10B0EFF9A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313495178834552
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuRmSK+5IRR4UhUR0YB1DeoAvJfYdPeUkwRe9:YvXKXAmS7WRuUhUt15Gg8Ukee9
MD5:	6189C56F231076BB1BF9660427577FAE
SHA1:	999C970851DBA35BDBF728C57FCBA3EE0B6F6864
SHA-256:	9A37E8DE3D21CA8272C34224AC329F2069D5BB528D053A8EA69A0ACF40519905
SHA-512:	307E90E6420BA5D64E1FD0A164A4269D7272EEB81B91EAC51B5109B3602D6C4B59D362FB94DA9C98E181C7AC3157CA7FBFA08FFEEDFE26252C83A8AB209CBAD7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.300082133761731
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuRmSK+5IRR4UhUR0YB1DeoAvJf+dPeUkwRe9:YvXKXAmS7WRuUhUt15G28Ukee9
MD5:	4A75EFF06C97F305140F0750F5E80DF4
SHA1:	FABA6BDA44D27ADFFCC0478A39BDA9CD406261D2
SHA-256:	6F8F502E055F7D6FBA702435B7D7ECBEC8FF55C4BCF2EC359B64A988E6291783
SHA-512:	2232D28C24C5F2A7A66646D56B83722A2746DC100245402CE3CF7F4851CA3D2A15DA52E9E23587605373ED068C29F27116D63391C60FE574B5570676A7D4E717
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.296949526138418
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuRmSK+5IRR4UhUR0YB1DeoAvJfbPtdPeUkwRe9:YvXKXAmS7WRuUhUt15GDV8Ukee9
MD5:	4D584101124F0C1151D04EB0E1FB26EA
SHA1:	F593AFA5766A38C035DAFCA3469602971A101303
SHA-256:	90699E9B586AA89EBAA3554C0F1595FEE61C2D8C0E72C1A9744677C5273D8BBE
SHA-512:	2A06F3EAF2B3DB938D2CDED65A380BA598F137919DBB30BCB4BD7570F06F88453CEC02C8E2F2430588C7B0833BA1791AD0567A191923E8B89BC722CEC9AED8F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.3002032592689785
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuRmSK+5IRR4UhUR0YB1DeoAvJf21rPeUkwRe9:YvXKXAmS7WRuUhUt15G+16Ukee9
MD5:	11BFCB734686B23BF017B4759349D7D4
SHA1:	7BA33FCFD50A5256602077537C662D75D28C4F57
SHA-256:	D3AAC2EB050DA669ED5B055E85D3C6C07CC67DCF979BFF7E3DF0A03AC04FC358
SHA-512:	E44C99A5F0AAEAF8515AD9507ADFA0F558DF73993BA4E458F9A53A141FA84DBD766C70528C03BF313E0672776A2478ED9116AB087D1A61BB5B162C110B23BFBD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666997892946162
Encrypted:	false
SSDEEP:	24:Yv6XAmS2U2amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSY:YvSU4BgkDMUJUAh8cvMY
MD5:	C551C81F88D81262CD4C926053EF9D07
SHA1:	158A878787B0E6FA59597297ED8698B0F546808D
SHA-256:	6B35BCB93458FE3F0F8E13C4A20F0F3CE325C8D9CA0F13052C2CB720C9A8DE7E
SHA-512:	7252DF63006603B346F613419A9424A76BEFF2478F82948E3F318C36B23932FF9D6AA628B672949994DD24BB47C62C742B7F58F137EDA61F181EF163411CFFB9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.277217773080958
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuRmSK+5IRR4UhUR0YB1DeoAvJfshHHrPeUkwRe9:YvXKXAmS7WRuUhUt15GUUUkee9
MD5:	A5E70F77B5DC9484335B10DFD02FD5FF
SHA1:	F0BD828857ACB8B4CF054C4932DFBB351F94003B
SHA-256:	200F500295AB49EC694D4C070497EAD6A76ADF074B25CCFEFE8798C9C11B9F25
SHA-512:	F8491DD087B4AD3289D9B1417D5547D30339ECED2203BC2AD167E8B9052A0EF5CA388C645D8D38E7AAF5EEF3DD7EE5CA214A84931CB5334EFF588553F783202F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.283056690595304
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuRmSK+5IRR4UhUR0YB1DeoAvJTqgFCrPeUkwRe9:YvXKXAmS7WRuUhUt15GTq16Ukee9
MD5:	F332C21166172DEC19DC942FC229797F
SHA1:	FBA2D9B5D2C5C0CD615F24C948EFCA0C2F6A8650
SHA-256:	50F59057D00A695B6E5DB083460418ECF63292C895516F3324AC80C7787E973D
SHA-512:	CCCD7E2739170D49D2916BEB9423A0B2CA60C95830CE20A8559BFF29BA03A68E261B0856F75715F88A4D6D09BACBF8AFFC9B2DECBF8C6584471ED575B3137552
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf324909-6995-471d-ac9e-870175e92591","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1736136732752,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1378143521068775
Encrypted:	false
SSDEEP:	48:YkR1hyimkAHxRfFRVQ7gGXNp7iFOC2mrM77h/j9DBu:uVHLK7gGv4rMPHI
MD5:	4259A419051196992C97C1E76528C2BD
SHA1:	76E39F23CFC1C885D1EDC5FDEC1F93EC62138334
SHA-256:	6827F217318A35E8AE9689C6B8C168422F62E2043AF9028C127F12A2E84E74F0
SHA-512:	3F2EF62D8F80AC088471191D89B47398405A322D31B67B66C604214A82355DCEEEBA14D5BB7A1191F22CE92987BEF9AEC545A21235B1178E3867AC5CCD00D404
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"055836b9ae7aa8734ec81afa2139a090","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1735959387000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c5ac441d77120e64209e9c4ce2c4429b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1735959387000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"00280439a3da0446d5f504a8c84e6804","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1735959387000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"12554ed72e9a6736623e49ac639ab274","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1735959387000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d1dff529f8a9e5cd8eea53ab2b0c8118","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1735959387000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b4f9ff428cfc231ef5f3af4a4300557f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9876608706063158
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs67Y9QmQ6QeKIcLESiAieCF:TVl2GL7ms67YXtrpcI8G
MD5:	2889CE2192D6EA5F063C780B30C4FF74
SHA1:	F7684714E10EF3FC5B3476CF03E1E84333D4C819
SHA-256:	7EAB3A665BB5353CB70672FD35C4C4F96891599112373EB15F85A499EB6B1AFB
SHA-512:	7E2B48276DDC89B4CC94712D112A733BD7FC3E05E0866115D8D276D97AA0D0E98B633C2791E424BDE86028DECC1A23DD8A7BEB721AFAE6ED85BB0655CF371873
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3450036168830002
Encrypted:	false
SSDEEP:	24:7+tVASY9QmQ6QeK7cLESiAi0mY9QuOqLBx/XYKQvGJF7ursi:7MVlYXtrecI8KYMqll2GL7msi
MD5:	DFA70849C92C829F9A05144D70C088BE
SHA1:	A1C6FD4997CA1E302DF263CFC9B565DD266BE637
SHA-256:	FAA23BE141012B6BDA53EC4A97DEACBA4D7E95B2F95D9276A82B0612504F6AAC
SHA-512:	7A5013913405F9A1F3D7489BD7025496753CEFE3BC988917CB9641D8130CCAC4CB05CC77026D39E1A884358D01C33D575A4BE0DCC0250ADA76A05186CEB72999
Malicious:	false
Preview:	.... .c.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgdacC3hPddojoSASaTAt05UKEFiTyYyu:6a6TZ44ADEdacSPddojoP5G0eK
MD5:	E78200649E4710C99D1D4B7E4A647E5B
SHA1:	8814BF4760302226D9E54BAB411016B60C317775
SHA-256:	711AD29E59E4C3334DBCCFB418810E5D077714E61ADFA9C73727D3D7F5AA20D6
SHA-512:	06082B1F680EFD94416F11331838955216BFF51B1E6097FE726939609C7610D0D294B089BD22374F5E4C3C2ACC90DA35A9C244EAF3B73B447B6BA4680651E4D5
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSI39d84.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K82WClsaw:Qw946cPbiOxDlbYnuRKXWp
MD5:	2AA7DA6568B37F925FB43E68345CF7E3
SHA1:	9E8176F306B44034C89AFEBB7F27D6FE19938BFE
SHA-256:	6D35E877F742DB7DA38F337DD7611DB2137D8EEEFF2DA4BB57E891A8681E2D7C
SHA-512:	14D890125142D5CE28C71AF75A60F914874082573CF64846DC986F9C8E0B6A8FF13CF6A3600D5A33083DB514F031F0D126B1C9862EC1801382453A300C69F42D
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.3./.0.1./.2.0.2.5. . .2.1.:.5.6.:.2.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250103T2156090855-6972.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	4.481917691207649
Encrypted:	false
SSDEEP:	768:RUdWO2ze1rociQ88Cvcr4n0l9anZEYy99OgXcw28jEmMeuWlWyWdWyk:1gcI4nC9anCzFXR87k
MD5:	3DC3F4CF32FB364960997F1F73AA4998
SHA1:	29711C5C8150ADF3D6CB39288499F798AE1D67CA
SHA-256:	62B872CF90D74B7E06E4406BD7951305A06A6A580F48D96BAE05C875268879C2
SHA-512:	4118324ACC5B2D9DC70FE87164C319B4604DFFC978C812D60859FDD0919B4D589DCA5EF5812295839ECAF6DEE2E576DD22E3AC2D16F4189A6C1E8728A8D21AD6
Malicious:	false
Preview:	............................................................................`...T...<....u.5T^..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1..............................................................I.Y...........u.5T^..........v.2._.O.U.T.L.O.O.K.:.1.b.3.c.:.c.f.5.e.e.c.c.b.3.6.8.e.4.c.7.d.a.c.6.f.e.7.6.3.4.3.0.b.8.b.c.b...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.5.0.1.0.3.T.2.1.5.6.0.9.0.8.5.5.-.6.9.7.2...e.t.l.......P.P.T...<....u.5T^..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-03 21-56-24-629.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.353642815103214
Encrypted:	false
SSDEEP:	384:tbxtsuP+XEWJJQbnR8L31M7HeltV+KYm3wsa2KjF4ODkr/O8r2IUHUHMWwEyZRN2:aPL
MD5:	91F06491552FC977E9E8AF47786EE7C1
SHA1:	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
SHA-256:	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
SHA-512:	A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
Malicious:	false
Preview:	SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.363532096885682
Encrypted:	false
SSDEEP:	384:LuwT4iAb7YpXIWuIcEr2bq2nb4If+Cuko7cg+yuHaS/U+4Vuk9m4cBch0Wz6gJhM:Uzh
MD5:	F92DE0AF7BF845B9F8DC81B4A24447D9
SHA1:	AF4F157A0295FE138C530B777A5AD73CC94C368C
SHA-256:	3EE2A469DAD7C52F97A956C65243F9D22D294790C7091F2B20AB3492A2CE6187
SHA-512:	1E87720A1773BD259B2B89E5E29DD4325F7DF7F6BD8E7B553A5C51FB099AC5B720606064D4B69027CD41A75E4668A9A8A2087432F7B3527333B1E3731A1174B9
Malicious:	false
Preview:	SessionID=6d0df0a1-1b43-43f4-9f80-363dc512cd1e.1735959384640 Timestamp=2025-01-03T21:56:24:640-0500 ThreadID=2932 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6d0df0a1-1b43-43f4-9f80-363dc512cd1e.1735959384640 Timestamp=2025-01-03T21:56:24:644-0500 ThreadID=2932 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6d0df0a1-1b43-43f4-9f80-363dc512cd1e.1735959384640 Timestamp=2025-01-03T21:56:24:644-0500 ThreadID=2932 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6d0df0a1-1b43-43f4-9f80-363dc512cd1e.1735959384640 Timestamp=2025-01-03T21:56:24:644-0500 ThreadID=2932 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6d0df0a1-1b43-43f4-9f80-363dc512cd1e.1735959384640 Timestamp=2025-01-03T21:56:24:644-0500 ThreadID=2932 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.423052530726721
Encrypted:	false
SSDEEP:	192:0cbgIhPcbocbAIlncb2cbwI/RcbNcbQIVvcbicbgIrpcbJ:fhWlA/TVgr2
MD5:	36AAEE5ED517EF1E3BD474554FA19F24
SHA1:	06D5C7EBCD8FA4A28C87B0639C1C3153B835F693
SHA-256:	13DE65446046C2EBA73E6C8E903AF609EE3C4460C8BF1842D460A55CC44A6946
SHA-512:	40D8609ADA25AD2F455A34E8A5983E8F68506B404512C1E11AE4A73DAF6F263ADFA46BFAD12E110F26E5DC73E5F69DEB3C131FFCCD70B0A4A4CB3A3230953281
Malicious:	false
Preview:	06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0acd91f9-fea4-4cd6-b977-1eb6a0936195.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\13d9b235-c133-4011-b520-a3e6e404f317.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/x0WL07oXGZuwYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:J0WLxXGZuwZGM3mlind9i4ufFXpAXkru
MD5:	E1FE9FA2454D30CD849F2060D8FED227
SHA1:	5B5A33E386D7A2254DB5934F688C1F1A72A9D6C9
SHA-256:	4B0AD0558FB8C3D63817011FCA33E51A9E9C46A91407B705C4E5150AE4E5A3E4
SHA-512:	C81A8B39C571531DC52A71E34188D3C95797B69E82A74896019723E0217A00D58367118886DDEEEC4AEAAF8A80931BA22459104847E2B0D8A77070BFEE3BE7F1
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\75fbfda2-ef66-45bf-89c8-f5e3aa891ca6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b008bcc9-1905-4deb-80c6-24ab4bec5b4b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWLaGZ4ZwYIGNPS:RB3mlind9i4ufFXpAXkrfUs0kWLaGZ48
MD5:	1D64D25345DD73F100517644279994E6
SHA1:	DE807F82098D469302955DCBE1A963CD6E887737
SHA-256:	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
SHA-512:	C0A37437F84B4895A7566E278046CFD50558AD84120CA0BD2EAD2259CA7A30BD67F0BDC4C043D73257773C607259A64B6F6AE4987C8B43BB47241F3C78EB9416
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 4 01:56:39 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9890803058274256
Encrypted:	false
SSDEEP:	48:8tdjTLLjwHiidAKZdA1FehwiZUklqehSy+3:8DnpFy
MD5:	A8867BAB0A9F67C781C0BA3D4B377C39
SHA1:	6123B07EEFE6842B5E2D53570648C37DB63ACD66
SHA-256:	C4D3C95D39719F2E9DEFCEFC36EC8D3AF7002BD6643FC0C01762CFD294C94F3B
SHA-512:	BB902FF6FDC6C13DA611BD67F187F48B0D59A2B2E610736A88A85B0217919F800C072E610170D9AB436F429FFBECEECF5BAB910C64BF93258B9FC976EF22027F
Malicious:	false
Preview:	L..................F.@.. ...$+.,....Y..FT^..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I$Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V$Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V$Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V$Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V$Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............LV......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 4 01:56:39 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.004848588666398
Encrypted:	false
SSDEEP:	48:8HdjTLLjwHiidAKZdA1seh/iZUkAQkqeh1y+2:8hnf9QQy
MD5:	3AD32D536A8327D58200A52FBC1B0D6B
SHA1:	D8FE9ACEB16EFEB628E1C8E470B15E4E537DD039
SHA-256:	CDE3888D6E329EC8DDDAE33F7E036A13824122DD8831B6C019250EA9C5563EE3
SHA-512:	3648DB120715FAF5DCD5E60877FD6BB38881D6601B7DCB6FBCF83B48B33CEAB0CF859538C729B6E84AE1639A9748B9D2432ECB1B69C991F18EAC7B31E8EAF38D
Malicious:	false
Preview:	L..................F.@.. ...$+.,....9.FT^..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I$Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V$Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V$Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V$Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V$Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............LV......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0140799945008
Encrypted:	false
SSDEEP:	48:86djTLLjAHiidAKZdA14meh7sFiZUkmgqeh7sry+BX:8qn7nxy
MD5:	830972855B349600A00D49231A33B6C9
SHA1:	6115A08E20CF976AE865FF82374A98AA64CE3273
SHA-256:	00DDA230BECCAAE34009FCC2825117C8CF22FDEB2122D1168371036CB93AEEED
SHA-512:	E01E4305933577E340B325A6E4821238AA218B46DBD4DEA8C8AFB24A006DFD165C8589513EA7D73383B411F56F1AC1518DDFEB09F0B57569AECF14EDAA371026
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I$Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V$Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V$Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V$Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............LV......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 4 01:56:39 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.002317009808064
Encrypted:	false
SSDEEP:	48:8jdjTLLjwHiidAKZdA1TehDiZUkwqehJy+R:8tnsjy
MD5:	BA5FAE4B5B95EE6318EEBDA1008222F6
SHA1:	44FDBD7FAE1341D80167C8BF94E9C9447372FE98
SHA-256:	84188670DFEA07C0043A0125024107B57DF8A1D01F157CE5FED1EC3A5CC7F9E5
SHA-512:	A1514F4AFBB1FC508384B87E2E9ABF3036DAF3695E4F2BE588FE9DA9E0A7C14056940A226E755CB3F8AEE3A2A34E08831B13D0CEF4C838EA63BAF6DFE7279403
Malicious:	false
Preview:	L..................F.@.. ...$+.,....-.FT^..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I$Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V$Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V$Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V$Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V$Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............LV......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 4 01:56:39 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9884597320267114
Encrypted:	false
SSDEEP:	48:8C5djTLLjwHiidAKZdA1dehBiZUk1W1qehHy+C:8Sn89ny
MD5:	37E8B60F51C447F3D4ECF279FC526541
SHA1:	53AE8AE4724CEC595896F5A9B9289559BC81C70E
SHA-256:	0CA0B8358FBF1B1B6FA6EBA5451C980D33585198A3CEF63F1A34F09F1F7E61E3
SHA-512:	160E7DB73B3BE034562BDF13C7C95AE30B381AF268C47BE266E9C711D85849DC5D99CB2699BCA044E891062BAC29984E25FDF0F3759FE295B17FFCD3E61CC052
Malicious:	false
Preview:	L..................F.@.. ...$+.,....0..FT^..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I$Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V$Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V$Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V$Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V$Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............LV......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 4 01:56:39 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.000959084150672
Encrypted:	false
SSDEEP:	48:8edjTLLjwHiidAKZdA1duTeehOuTbbiZUk5OjqehOuTbxy+yT+:8enOTfTbxWOvTbxy7T
MD5:	673E5F8BCEB32F047D9BFA7DBDC2B80E
SHA1:	071DA74411781C53B2D435BBADEEF573C9BD329F
SHA-256:	ED622250CD9A816DE362F8A3D7920B015F21E438192EFA09F0F86B8481560BE8
SHA-512:	2F387B75B6A237CD2C13BE183DDA5C3D8179C6767438BE3DBE42617A8511606FFAC102BD73F8BD07C5611D5A761A679D1A835F1118EE13346B6AB0B6016ABFF6
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......FT^..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I$Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V$Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V$Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V$Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V$Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............LV......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	3.9749971817604948
Encrypted:	false
SSDEEP:	1536:oYMSfT8B529ByB3W8nB4iXcTIsMW8nB4iXcTIsKIhcMTvJ/Lg/VKMEks7FB4eh7N:7Mi4UhF/LrFrUZtop96JiVp9
MD5:	0A647C2261EC37CBA26F923EF3D776A5
SHA1:	FE68B591C3464EA49425874F4BCF50431467441C
SHA-256:	4D1545565C5980F67DF1CAADE662965DF9ACDC905EE7A865E9A8BACE935679D8
SHA-512:	E120ED5362F7C4F327D5F9274983F7F366D6D013B08DE125AA2B684F7E1AD32823FDB9BB2F2061E100B3B456CC444A53318F855854C6B828F7C775481EFDFBA4
Malicious:	true
Preview:	!BDN8L.oSM......\.......................g................@...........@...@...................................@...........................................................................$.......D.......,..................................................................................................................................................................................................................................................................................................................................3.jX.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	5.747801260504493
Encrypted:	false
SSDEEP:	1536:c+bW53jEpEHP4qQ10PAwr1WDOW5SQ38nB4iXcTIsbW8nB4iXcTIszwIhcMTcJ/L2:Bp9kqylhq/LqBdp9HdB
MD5:	C367DCC3365720F60936C320BB130B03
SHA1:	7C62151E7066888D71D440428B5AEBC894025C62
SHA-256:	BEACD89BE60E7F2EA0FB3BDB245157C816C598F0BE13A864A845DECB92BA7645
SHA-512:	FD67D59143B40C11DE1FB13523721065F344180A32C229C0CB25DF4C765616F576FF59F78F789C3E5FB7631DA373E6B70273AB2BB038F1AAB23D35DEE807C901
Malicious:	true
Preview:	F{..0...\|.......<......4T^.......D............#...........o...................~..........................................................................................................................................................................................................?..........................................................................................................................................................................................................................................................................,P#V.D......S.0...}.......<......4T^.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 232

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1540), with no line terminators
Category:	downloaded
Size (bytes):	1540
Entropy (8bit):	5.55453608014871
Encrypted:	false
SSDEEP:	24:n0ksbJhWZ4qmVtmhkVzGuxZbXFlzMTUL5CGRRV4B5FWssMGRRctYiRsOEfv11a:ncVohc/7Fx0GO9WsGtFfvi
MD5:	8D6B252821A9DF10DA59A5AD6858BF4D
SHA1:	72DE6F888E491686563CBB0ED45949D7613D3E7D
SHA-256:	D9E04F2A34BC8A612A36677260B691A080A3AA31D24879272EAD15C557CF083C
SHA-512:	91F546949A75F69C9B952175450CED214D869B6D2BB5A209763E6B93A6F6432AA17085623D57ABD0398A6C89C7920D95BFBD683F312048604F490A554387F3C3
Malicious:	false
URL:	https://www.google.com/url?q=https://offsiteforms.store/1wq4W8&sa=D&source=editors&ust=1734917344975185&usg=AOvVaw351shL2sABmvKRpEejl5tD
Preview:	<html lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Redirect Notice</title><style>body,div,a{font-family:Roboto,Arial,sans-serif}body{background-color:#fff;margin-top:3px}div{color:#000}a:link{color:#681da8}a:visited{color:#681da8}a:active{color:#ea4335}div.mymGo{border-top:1px solid var(--gS5jXb);border-bottom:1px solid var(--gS5jXb);background:#f8f9fa;margin-top:1em;width:100%}div.aXgaGb{padding:0.5em 0;margin-left:10px}div.fTk7vd{margin-left:35px;margin-top:35px}</style></head><body><div class="mymGo"><div class="aXgaGb"><font style="font-size:larger"><b>Redirect Notice</b></font></div></div><div class="fTk7vd"> The previous page is sending you to <a href="https://offsiteforms.store/1wq4W8">https://offsiteforms.store/1wq4W8</a>.<br><br> If you do not want to visit that page, you can <a href="#" id="tsuid_ZqN4Z8vrIIy7i-gPqsHVyQQ_1">return to the previous page</a>.<script nonce="pgJDWbQkRLGbhB2GhpxdPw">(function(){var id='tsuid_ZqN

Chrome Cache Entry: 233

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
URL:	https://www.google.com/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 234

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Static File Info

General

File type:	RFC 822 mail, ASCII text, with very long lines (320), with CRLF line terminators
Entropy (8bit):	6.170271613093535
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	phishingtest.eml
File size:	67'523 bytes
MD5:	d92f54097fa8e7e8351f4b0c526766a9
SHA1:	d8f7ef7fd37f555ebc3650e7bcb261d61c12b736
SHA256:	9206e05b6526d783f4f0df70fa05723a90cf02d54b36f36f1472ee93afac941f
SHA512:	e12ba54e8bf805944df322243e68b06db9415181289f97a066c37a6d3a09db9df00de1a053a49a41c0c59f827139986e18319134781b16b12746e522278becae
SSDEEP:	1536:DMTe0Ckei9ZyatQeSQbS/liebuYdo0/98EXNFzudGZhaZK4:4CkMAQgAl/KaCEdIam
TLSH:	D863E07BE8460203E7B280559D49FC0AB2A23D6ED4A7A8C0FC5D75D70BDC8654963ECB
File Content Preview:	Received: from CO1PR03MB7986.namprd03.prod.outlook.com (2603:10b6:303:276::16).. by SN6PR03MB4223.namprd03.prod.outlook.com with HTTPS; Mon, 23 Dec 2024.. 00:29:09 +0000..Received: from AS8PR04CA0024.eurprd04.prod.outlook.com (2603:10a6:20b:310::29).. by

Static Mail

General

Subject:	Your account balance has been replenished with your funds! Get ready to spend with your replenished account balance! Your funds are back and your account balance is looking good! Your account balance is now replenished with your funds! Your account balance is back to normal with your funds! Your account balance is now replenished - time to treat yourself! Your account balance is looking healthy with your funds replenished! Your account balance is back to normal - thanks for your patience! Your account balance is now replenished - happy spending! Your account balance is back to normal - enjoy your funds! Your account balance is now replenished - time to make some purchases!
From:	"Pamphile Cinkan (via Google Slides)" <drive-shares-noreply@google.com>
To:	cvanreenen@hotmail.com
Cc:	yewhiano@hotmail.com, andymartinez121@hotmail.com, nezka.e@hotmail.com, ainhoa_toscal@hotmail.com
BCC:	yewhiano@hotmail.com, andymartinez121@hotmail.com, nezka.e@hotmail.com, ainhoa_toscal@hotmail.com
Date:	Mon, 23 Dec 2024 00:29:05 +0000
Communications:	Attached: Open 332.pdf Sent using Google Docs https://docs.google.com/ Weve received your payment application! Our team is committed to reviewing it promptly and efficiently. You can expect a decision within Granby. In the meantime, if you have any questions, please dont hesitate to reach out. We appreciate your patience! https://docs.google.com/drawings/d/1dkbLi49y3JQRyVOPkSMc7r-v-rgTS9vROyawOplkRes/preview suction that completely fails without the use of Cathcarts tube. The Such being his observations and views, he rejoiced in the popular Putavimus eum quasi leprosum. Isa. liii. . digestive juices of the animal have converted the starches and sugars.
Attachments:	Open 332.pdf

Headers

Key	Value
Received	by mail-qv1-f71.google.com with SMTP id 6a1803df08f44-6dcd1e4a051so81737776d6.2 for <cvanreenen@hotmail.com>; Sun, 22 Dec 2024 16:29:05 -0800 (PST)
Authentication-Results	spf=pass (sender IP is 209.85.219.71) smtp.mailfrom=doclist.bounces.google.com; dkim=pass (signature was verified) header.d=google.com;dmarc=pass action=none header.from=google.com;compauth=pass reason=100
Received-SPF	Pass (protection.outlook.com: domain of doclist.bounces.google.com designates 209.85.219.71 as permitted sender) receiver=protection.outlook.com; client-ip=209.85.219.71; helo=mail-qv1-f71.google.com; pr=C
X-IncomingTopHeaderMarker	OriginalChecksum:F6C7869BF6D1CED58893F2DC51444635A8C36CDC95A88382BAC49F196715AE68;UpperCasedChecksum:3D9A4BAF7BF36486B3C8BB7A54CB2BF25C91700A7196FCD678C491D24789EDD0;SizeAsReceived:4012;Count:17
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1734913745; x=1735518545; darn=hotmail.com; h=cc:to:from:subject:date:message-id:references:reply-to:mime-version :from:to:cc:subject:date:message-id:reply-to; bh=aGAJ0gnW7kDhGSOWk482UbgMznfmO7QI40+SBxCO57s=; b=jOePDKj+sJKd+kOgKMVdyicyyjC10Ul0qjOHkcDFKuOjrTkRi1yPwcjSW5GvmsQ8ng 3s88rxJuV+WRX0PlbnRcsEgoT1wMyU1j9MZFS81B0Wf2f/9DKC+2coitIx+mxLyNo3XP SulbsRBt9456lwqx8oz+DbMZIcJS/Ok/cqueAiIdf4PSmiris9soMKwQQWnObO50GITt xvHvbik/tlh/u1XBn8owBtos0/q/FJYmN3ROkslzQgar5n8FVKib5WMQcbP4zarDqgFE dMwVXn3L6Zs86pTTzMeo/IndbGgb9PAKa1JRpB+3k+bKfBrNcmdIVqfA12rFZqJBis6p 1B0Q==
X-Google-DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1734913745; x=1735518545; h=cc:to:from:subject:date:message-id:references:reply-to:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=aGAJ0gnW7kDhGSOWk482UbgMznfmO7QI40+SBxCO57s=; b=NNEqakly5gWxE5kBhGPwb/wgoPa+KLMwDYy2OnQSlOtuupBVRQr3zus/zIk1BEGUGK uSXnamOwm5Een1dF3TqZNX7+r8Ghp40asz79wBOpV4cjb7uGJ7P/w4rj+p8xm+jtlvpC CsiCSydEahf1flAvPo3CdPRd44cN7ohjYa9TQqnMy7dtnHCaTf1GXODf6xXWGncTZ/+h wfv6s/4zhrTtcBisJgnJGz73LROnAXWu3bwoT2rFdHREezswHWTPYaVBlgr3f31oYifr dyYsWAIPkBZE+PGgTDEGCLGtxYXE2Qs5kolWdVQcYJtCHplyZ8l9QksbyyBZiTQcnk2w tKJg==
X-Gm-Message-State	AOJu0YxIrZ/hO2r3E9ztGkGd8PfwUOsOVHr+p+RJNGDq+u72itJmIrLa nlwm2vlIUJBdSDI6atdrvvkwwbENHk/p96mezClwnCwF8SpFQFtuGgOzTiT45I3Gy8YPO7icewd zum9SmCynSwdzYDa4coBOeu10
X-Google-Smtp-Source	AGHT+IGiCnMHMMvPlyjwqLpX74+Nu2ZY2PxyiWYyIbEm+tO2LMmHOenhoEnt5UvYvD6mrX6wiNQmm1YpDM4=
X-Received	by 2002:a05:6214:2522:b0:6d4:1813:1f20 with SMTP id 6a1803df08f44-6dd2330b0b2mr164015306d6.8.1734913745131; Sun, 22 Dec 2024 16:29:05 -0800 (PST)
Reply-To	Pamphile Cinkan <coppesmeronexcj@bbpaxuxyc.zeqifeku.quest>
X-No-Auto-Attachment	1
References	<78684d56-dfdc-463c-84cf-1466e33202be@docs-share.google.com>
Message-ID	<autogen-java-24312fb5-d7fa-4ef7-b3b7-6ef8cd01a721@google.com>
Date	Mon, 23 Dec 2024 00:29:05 +0000
Subject	Your account balance has been replenished with your funds! Get ready to spend with your replenished account balance! Your funds are back and your account balance is looking good! Your account balance is now replenished with your funds! Your account balance is back to normal with your funds! Your account balance is now replenished - time to treat yourself! Your account balance is looking healthy with your funds replenished! Your account balance is back to normal - thanks for your patience! Your account balance is now replenished - happy spending! Your account balance is back to normal - enjoy your funds! Your account balance is now replenished - time to make some purchases!
From	"Pamphile Cinkan (via Google Slides)" <drive-shares-noreply@google.com>
To	cvanreenen@hotmail.com
Cc	yewhiano@hotmail.com, andymartinez121@hotmail.com, nezka.e@hotmail.com, ainhoa_toscal@hotmail.com
Content-Type	multipart/mixed; boundary="0000000000007eb1130629e515fa"
X-IncomingHeaderCount	17
Return-Path	30a5oZxQKChQxB2Fy-C1uByC-78By95I08805y.w86wFu7Byy7y718D6u25.w86@doclist.bounces.google.com
X-MS-Exchange-Organization-ExpirationStartTime	23 Dec 2024 00:29:05.9949 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	ae62c185-f168-446f-3064-08dd22e8cf2b
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	AM1PEPF000252DF:EE_\|CO1PR03MB7986:EE_\|SN6PR03MB4223:EE_
X-MS-Exchange-Organization-AuthSource	AM1PEPF000252DF.eurprd07.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-UserLastLogonTime	12/23/2024 12:21:44 AM
X-MS-Office365-Filtering-Correlation-Id	ae62c185-f168-446f-3064-08dd22e8cf2b
X-MS-Exchange-EOPDirect	true
X-Sender-IP	209.85.219.71
X-SID-PRA	DRIVE-SHARES-NOREPLY@GOOGLE.COM
X-SID-Result	PASS
X-MS-Exchange-Organization-SCL	1
X-Microsoft-Antispam	BCL:3;ARA:1444111002\|1680799054\|6092099012\|1131999016\|9400799030\|10300799035\|9020799016\|9000799050\|47200799021\|461199028\|58200799018\|68400799013\|21080799006\|7002799012\|3412199025\|4302099013\|440099028\|8011999015\|6111999015\|4141999021\|21101999018\|1370799030\|1380799030\|1360799030\|56899033\|1602099012;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	23 Dec 2024 00:29:05.8543 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id	ae62c185-f168-446f-3064-08dd22e8cf2b
X-MS-Exchange-CrossTenant-Id	84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-AuthSource	AM1PEPF000252DF.eurprd07.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg	00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped	CO1PR03MB7986
X-MS-Exchange-Transport-EndToEndLatency	00:00:03.3663341
X-MS-Exchange-Processed-By-BccFoldering	15.20.8272.000
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;ex:0;auth:1;dest:I;ENG:(5062000308)(920221119095)(90000117)(920221120095)(90010023)(91010020)(91040095)(9050020)(9100341)(944500132)(4810010)(4910033)(9575002)(10195002)(9320005)(120001);
X-Message-Delivery	Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MTtHRD0xO1NDTD0z
X-Microsoft-Antispam-Message-Info	tbPwqCnpi87JhfCbx5Nb9lTGdygRt/ZGf2aVWY6JkylFZa2YqUtg8w1dns5OrF/njgKXnr80/whi74Q2eVr1u2JKYvM+7MFvau84n6ZFCJZ801O6xHdTN3P1Tf+XrT0FpHpED6W9WLWXBuUP+Bgh8nJsEF3EOaoapF8Z5gt3Czx+MvcNvzKUqP+S0fiXRWPQ2wEfmsowlqwvcovkWiEZ0tKC6axV78kSLfA6ReMZHpPojboTpTDkfVGWbSP+PouiK57pxlfB+4MH0JhSHPvDA0W6x1OgYw0GcSuphNMM3yv93S7fP29t0s9L1KbI/AX29Kg5ggb4LEu20U2b6R2IflKwl+shk454hh2seJ0jpGfCGbe6ZQn58JJoE/PYYETFWN6OAN4dX28zYytewRre1muRt0wrTnveSfhswYbkujPp8rdQlne7+VtUMy9Z06ptzjzhZOaZsX7rBx9wJcdq/YDM3PSX3k2cl1rkAtyu5LOZtivhV6bU0dSO9Ma1xojI+A19yubeTz7h/1zjk/IFG+pNktMnapcWIrOYbbO4cmZ9XVgFM+r5L7Iu8Xr3rJC6pQPXAzIMhTvAy7QfllXipdhBWFSHTu8LpyzZwU2z9JO1+NgrFyiO+uLo6jOcxfzC6Dfs/ZbOSWPHsv7GUufiTZR73d41ThifyIgEebwaeP4jPrzuqiWyBQP64WU5e4t5EZYZXnBETFwPvrQW7dh1IuPiYVTH6GBCoFrXREW7h7yYosN7o0GTvUgDJhycz14nCFFgnHWkni32rN6NPcczfd/GNggBN5gTdasn2KXkgBwmDZ90D6+/0fCtkHIIt1z7gO31YV79fIldvfEMO/hjkM1GuG/XXDwqSKGz+hovK12n4HCetqe0DdnuO6YIg1y89zv67i+UvdvPQkPzG2I0Cmyu3TRVbOibpIW9QUUlW3mlCzSgc/aVmkd/DSS66DGQWf6zIw51/3+7uc2DciLY/2Pu6V3kf6q8vXFj0BeTB0hbl1qCn4mg26e7gZ4yZjmLnM9g5d/y+oTkqy2nJPPP7wLoEqpPaxBDgKWHSgv3iBP0tq+0vbIlbKzclV5EOn+a1ArklsloWnvh4RmwMCclUYr+enpiRfaWaiXIa2lmc/a8Vz+Cf12G4M5i1gdN4GLOmqIelfUt5eQegMHc6ThTWXrAbUoZ1XPDUCrXgtANfEDYNTrBUkimgMHzfHGIUr3kyrqDABxB1+pi5KmeRk4h7SFRu+JCAzUEIREKaJtiZLKYDUB+AEwxcc6OhEFBy3oXpIoxZstg7WSfrF+5BNah4fCvcdzdQhZ8fw2L5iAqj2PGMNv54ty6YsvKA+KAt8B9O1stfbUWxomCSOZcPOs4xfrnzRE8Y7QvoO/8GhtZjyUIOWTpW998LMG+vMNpgay/WQQgqvtgD8nDHQsme+Y0JkqTd3rM4SZ4vWRDAnrV9mfSnVwixW4RBW4wbVmDNyQji2Ox/Yv0rHn1mQSk6ZiTBUckUDTfyqe2Plsy87Pgfr3gP/T4n3kM40IJAqIfRqEGgj5sCi30v5cBD+R8UCeKvfhoUQ3jme1VGdAFep5YTytjlJ6NOv1+0567ybTJHHGEotlOgKwa+L6su3krnY1R2gMZS6iKDvBlsNLCfEfunwDcgz7J9DZ0g/3KLC6T/7Q2YTy0HvKClxnjF+0WIeF8nq0VFtNvtfQAwXqueqNI4dPw83jDSHvsiR0YCPpJPH41p0rMJkHEPUapm0at5DNFzm1EdkxIUPlVGKrpbCbOmMHLGI5TKSoAtmb+lmniBnLfnohe7pf21Kw517kL3OsEuIgaId4s5ltuEEdYORhAvxfrWowRKfDkmeOA3ye25lFNdDKZbDmDENLL6b4CTUEqmL0LjJ3WEnYCm8q96Gt8hK8pi86wpWTtr9L4yAvFAtoveMxYjfWEPRXl55teKNmZxXgYRSPBX0RhCDKS13CatYbDMWuwa14bvv+gilArm1DsaRaoIjdOi8EgVZBVXhtzvxJ7cbnLIM9tgBceGYYTDsFuY+VGdGkqOf6JhJXG375eKizXEEcQdWS45bfTb/dWVXhJ75M7HMyBOTnJFPBe6xgOAkY+Ik3z7E4kxk4flmqmzF5Oc0kmonOjUvJSzcY7hg==
MIME-Version	1.0

File Icon


Icon Hash:	46070c0a8e0c67d6

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 03:56:12.430694103 CET	49673	443	192.168.2.16	204.79.197.203
Jan 4, 2025 03:56:12.732476950 CET	49673	443	192.168.2.16	204.79.197.203
Jan 4, 2025 03:56:13.338474989 CET	49673	443	192.168.2.16	204.79.197.203
Jan 4, 2025 03:56:14.539562941 CET	49673	443	192.168.2.16	204.79.197.203
Jan 4, 2025 03:56:15.194905996 CET	49689	80	192.168.2.16	192.229.211.108
Jan 4, 2025 03:56:15.395153999 CET	49703	443	192.168.2.16	40.126.31.69
Jan 4, 2025 03:56:15.395260096 CET	49703	443	192.168.2.16	40.126.31.69
Jan 4, 2025 03:56:15.400089979 CET	443	49703	40.126.31.69	192.168.2.16
Jan 4, 2025 03:56:15.400130033 CET	443	49703	40.126.31.69	192.168.2.16
Jan 4, 2025 03:56:15.400139093 CET	443	49703	40.126.31.69	192.168.2.16
Jan 4, 2025 03:56:15.400166035 CET	443	49703	40.126.31.69	192.168.2.16
Jan 4, 2025 03:56:15.400320053 CET	443	49703	40.126.31.69	192.168.2.16
Jan 4, 2025 03:56:15.748356104 CET	443	49703	40.126.31.69	192.168.2.16
Jan 4, 2025 03:56:15.748370886 CET	443	49703	40.126.31.69	192.168.2.16
Jan 4, 2025 03:56:15.748377085 CET	443	49703	40.126.31.69	192.168.2.16
Jan 4, 2025 03:56:15.748435974 CET	443	49703	40.126.31.69	192.168.2.16
Jan 4, 2025 03:56:15.748455048 CET	443	49703	40.126.31.69	192.168.2.16
Jan 4, 2025 03:56:15.748488903 CET	49703	443	192.168.2.16	40.126.31.69
Jan 4, 2025 03:56:15.748526096 CET	49703	443	192.168.2.16	40.126.31.69
Jan 4, 2025 03:56:15.748841047 CET	443	49703	40.126.31.69	192.168.2.16
Jan 4, 2025 03:56:15.748852968 CET	443	49703	40.126.31.69	192.168.2.16
Jan 4, 2025 03:56:15.748863935 CET	443	49703	40.126.31.69	192.168.2.16
Jan 4, 2025 03:56:15.748876095 CET	443	49703	40.126.31.69	192.168.2.16
Jan 4, 2025 03:56:15.748886108 CET	49703	443	192.168.2.16	40.126.31.69
Jan 4, 2025 03:56:15.748915911 CET	49703	443	192.168.2.16	40.126.31.69
Jan 4, 2025 03:56:16.945501089 CET	49673	443	192.168.2.16	204.79.197.203
Jan 4, 2025 03:56:20.589030027 CET	49678	443	192.168.2.16	20.189.173.10
Jan 4, 2025 03:56:20.891504049 CET	49678	443	192.168.2.16	20.189.173.10
Jan 4, 2025 03:56:21.506489038 CET	49678	443	192.168.2.16	20.189.173.10
Jan 4, 2025 03:56:21.759494066 CET	49673	443	192.168.2.16	204.79.197.203
Jan 4, 2025 03:56:22.715497017 CET	49678	443	192.168.2.16	20.189.173.10
Jan 4, 2025 03:56:25.058098078 CET	49680	80	192.168.2.16	192.229.211.108
Jan 4, 2025 03:56:25.121560097 CET	49678	443	192.168.2.16	20.189.173.10
Jan 4, 2025 03:56:25.362119913 CET	49680	80	192.168.2.16	192.229.211.108
Jan 4, 2025 03:56:25.962439060 CET	49680	80	192.168.2.16	192.229.211.108
Jan 4, 2025 03:56:27.166508913 CET	49680	80	192.168.2.16	192.229.211.108
Jan 4, 2025 03:56:29.572149992 CET	49680	80	192.168.2.16	192.229.211.108
Jan 4, 2025 03:56:29.936510086 CET	49678	443	192.168.2.16	20.189.173.10
Jan 4, 2025 03:56:31.371541023 CET	49673	443	192.168.2.16	204.79.197.203
Jan 4, 2025 03:56:34.373662949 CET	49680	80	192.168.2.16	192.229.211.108
Jan 4, 2025 03:56:37.708441019 CET	49726	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:37.708466053 CET	443	49726	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:37.708527088 CET	49726	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:37.708935022 CET	49726	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:37.708952904 CET	443	49726	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:38.357084990 CET	443	49726	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:38.357377052 CET	49726	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:38.357402086 CET	443	49726	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:38.358417034 CET	443	49726	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:38.358510971 CET	49726	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:38.359621048 CET	49726	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:38.359695911 CET	443	49726	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:38.359797001 CET	49726	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:38.359803915 CET	443	49726	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:38.403528929 CET	49726	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:38.650461912 CET	443	49726	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:38.650496960 CET	443	49726	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:38.650558949 CET	49726	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:38.650578022 CET	443	49726	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:38.650626898 CET	443	49726	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:38.650669098 CET	49726	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:38.651510954 CET	49726	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:38.651525021 CET	443	49726	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:38.706343889 CET	49731	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:38.706376076 CET	443	49731	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:38.706439972 CET	49731	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:38.706648111 CET	49731	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:38.706660032 CET	443	49731	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:39.353705883 CET	443	49731	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:39.356005907 CET	49731	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:39.356035948 CET	443	49731	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:39.356360912 CET	443	49731	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:39.356921911 CET	49731	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:39.356981993 CET	443	49731	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:39.357168913 CET	49731	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:39.399338007 CET	443	49731	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:39.546586990 CET	49678	443	192.168.2.16	20.189.173.10
Jan 4, 2025 03:56:39.627890110 CET	443	49731	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:39.627940893 CET	443	49731	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:39.627974033 CET	443	49731	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:39.628011942 CET	443	49731	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:39.628026009 CET	49731	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:39.628052950 CET	443	49731	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:39.628067970 CET	49731	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:39.628128052 CET	443	49731	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:39.629703045 CET	49731	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:39.629841089 CET	49731	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:39.629854918 CET	443	49731	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:39.640126944 CET	49732	443	192.168.2.16	142.250.184.196
Jan 4, 2025 03:56:39.640170097 CET	443	49732	142.250.184.196	192.168.2.16
Jan 4, 2025 03:56:39.640243053 CET	49732	443	192.168.2.16	142.250.184.196
Jan 4, 2025 03:56:39.640435934 CET	49732	443	192.168.2.16	142.250.184.196
Jan 4, 2025 03:56:39.640446901 CET	443	49732	142.250.184.196	192.168.2.16
Jan 4, 2025 03:56:40.276798010 CET	443	49732	142.250.184.196	192.168.2.16
Jan 4, 2025 03:56:40.277070999 CET	49732	443	192.168.2.16	142.250.184.196
Jan 4, 2025 03:56:40.277092934 CET	443	49732	142.250.184.196	192.168.2.16
Jan 4, 2025 03:56:40.278104067 CET	443	49732	142.250.184.196	192.168.2.16
Jan 4, 2025 03:56:40.278198957 CET	49732	443	192.168.2.16	142.250.184.196
Jan 4, 2025 03:56:40.278470039 CET	49732	443	192.168.2.16	142.250.184.196
Jan 4, 2025 03:56:40.278531075 CET	443	49732	142.250.184.196	192.168.2.16
Jan 4, 2025 03:56:40.278716087 CET	49732	443	192.168.2.16	142.250.184.196
Jan 4, 2025 03:56:40.278722048 CET	443	49732	142.250.184.196	192.168.2.16
Jan 4, 2025 03:56:40.326550961 CET	49732	443	192.168.2.16	142.250.184.196
Jan 4, 2025 03:56:40.549598932 CET	443	49732	142.250.184.196	192.168.2.16
Jan 4, 2025 03:56:40.549654007 CET	443	49732	142.250.184.196	192.168.2.16
Jan 4, 2025 03:56:40.549688101 CET	443	49732	142.250.184.196	192.168.2.16
Jan 4, 2025 03:56:40.549712896 CET	49732	443	192.168.2.16	142.250.184.196
Jan 4, 2025 03:56:40.549721003 CET	443	49732	142.250.184.196	192.168.2.16
Jan 4, 2025 03:56:40.549731970 CET	443	49732	142.250.184.196	192.168.2.16
Jan 4, 2025 03:56:40.549772978 CET	49732	443	192.168.2.16	142.250.184.196
Jan 4, 2025 03:56:40.549854994 CET	443	49732	142.250.184.196	192.168.2.16
Jan 4, 2025 03:56:40.549910069 CET	49732	443	192.168.2.16	142.250.184.196
Jan 4, 2025 03:56:40.550769091 CET	49732	443	192.168.2.16	142.250.184.196
Jan 4, 2025 03:56:40.550786972 CET	443	49732	142.250.184.196	192.168.2.16
Jan 4, 2025 03:56:42.516942024 CET	49733	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:42.516995907 CET	443	49733	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:42.517112017 CET	49733	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:42.517334938 CET	49733	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:42.517350912 CET	443	49733	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:43.163964033 CET	443	49733	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:43.164205074 CET	49733	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:43.164232969 CET	443	49733	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:43.164554119 CET	443	49733	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:43.164859056 CET	49733	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:43.164922953 CET	443	49733	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:43.211559057 CET	49733	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:43.977585077 CET	49680	80	192.168.2.16	192.229.211.108
Jan 4, 2025 03:56:53.071558952 CET	443	49733	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:53.071620941 CET	443	49733	142.250.186.36	192.168.2.16
Jan 4, 2025 03:56:53.071769953 CET	49733	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:53.842981100 CET	49733	443	192.168.2.16	142.250.186.36
Jan 4, 2025 03:56:53.843019009 CET	443	49733	142.250.186.36	192.168.2.16
Jan 4, 2025 03:57:34.451059103 CET	49694	443	192.168.2.16	142.250.185.227
Jan 4, 2025 03:57:34.451931953 CET	49693	443	192.168.2.16	142.250.185.67
Jan 4, 2025 03:57:34.456202030 CET	443	49694	142.250.185.227	192.168.2.16
Jan 4, 2025 03:57:34.456330061 CET	49694	443	192.168.2.16	142.250.185.227
Jan 4, 2025 03:57:34.456862926 CET	443	49693	142.250.185.67	192.168.2.16
Jan 4, 2025 03:57:34.456919909 CET	49693	443	192.168.2.16	142.250.185.67
Jan 4, 2025 03:57:34.524152040 CET	49692	443	192.168.2.16	142.250.184.193
Jan 4, 2025 03:57:34.529150963 CET	443	49692	142.250.184.193	192.168.2.16
Jan 4, 2025 03:57:34.529279947 CET	49692	443	192.168.2.16	142.250.184.193

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 03:56:35.092937946 CET	50654	53	192.168.2.16	1.1.1.1
Jan 4, 2025 03:56:37.699491024 CET	53	65016	1.1.1.1	192.168.2.16
Jan 4, 2025 03:56:37.714359045 CET	53	54854	1.1.1.1	192.168.2.16
Jan 4, 2025 03:56:38.695765972 CET	53	65078	1.1.1.1	192.168.2.16
Jan 4, 2025 03:56:43.102404118 CET	56552	53	192.168.2.16	1.1.1.1
Jan 4, 2025 03:56:43.102539062 CET	60473	53	192.168.2.16	1.1.1.1
Jan 4, 2025 03:56:43.110945940 CET	53	56552	1.1.1.1	192.168.2.16
Jan 4, 2025 03:56:43.111038923 CET	53	60473	1.1.1.1	192.168.2.16
Jan 4, 2025 03:56:43.111661911 CET	64414	53	192.168.2.16	1.1.1.1
Jan 4, 2025 03:56:43.120472908 CET	53	64414	1.1.1.1	192.168.2.16
Jan 4, 2025 03:56:43.249495029 CET	61882	53	192.168.2.16	1.1.1.1
Jan 4, 2025 03:56:43.249878883 CET	56638	53	192.168.2.16	1.1.1.1
Jan 4, 2025 03:56:43.258333921 CET	53	61882	1.1.1.1	192.168.2.16
Jan 4, 2025 03:56:43.258620024 CET	53	56638	1.1.1.1	192.168.2.16
Jan 4, 2025 03:56:44.334295988 CET	63382	53	192.168.2.16	1.1.1.1
Jan 4, 2025 03:56:44.334538937 CET	54382	53	192.168.2.16	1.1.1.1
Jan 4, 2025 03:56:44.344475031 CET	53	54382	1.1.1.1	192.168.2.16
Jan 4, 2025 03:56:44.348439932 CET	53	63382	1.1.1.1	192.168.2.16
Jan 4, 2025 03:56:49.359005928 CET	60205	53	192.168.2.16	1.1.1.1
Jan 4, 2025 03:56:49.359174967 CET	55780	53	192.168.2.16	1.1.1.1
Jan 4, 2025 03:56:49.367671013 CET	53	55780	1.1.1.1	192.168.2.16
Jan 4, 2025 03:56:49.374389887 CET	53	60205	1.1.1.1	192.168.2.16
Jan 4, 2025 03:56:49.375214100 CET	61765	53	192.168.2.16	1.1.1.1
Jan 4, 2025 03:56:49.384139061 CET	53	61765	1.1.1.1	192.168.2.16
Jan 4, 2025 03:56:55.719614029 CET	53	59469	1.1.1.1	192.168.2.16
Jan 4, 2025 03:57:16.766639948 CET	138	138	192.168.2.16	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 4, 2025 03:56:35.092937946 CET	192.168.2.16	1.1.1.1	0xbd4e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 4, 2025 03:56:43.102404118 CET	192.168.2.16	1.1.1.1	0x1efd	Standard query (0)	offsiteforms.store	A (IP address)	IN (0x0001)	false
Jan 4, 2025 03:56:43.102539062 CET	192.168.2.16	1.1.1.1	0x6c9c	Standard query (0)	offsiteforms.store	65	IN (0x0001)	false
Jan 4, 2025 03:56:43.111661911 CET	192.168.2.16	1.1.1.1	0xb993	Standard query (0)	offsiteforms.store	A (IP address)	IN (0x0001)	false
Jan 4, 2025 03:56:43.249495029 CET	192.168.2.16	1.1.1.1	0x15b9	Standard query (0)	offsiteforms.store	A (IP address)	IN (0x0001)	false
Jan 4, 2025 03:56:43.249878883 CET	192.168.2.16	1.1.1.1	0x9393	Standard query (0)	offsiteforms.store	65	IN (0x0001)	false
Jan 4, 2025 03:56:44.334295988 CET	192.168.2.16	1.1.1.1	0x8045	Standard query (0)	offsiteforms.store	A (IP address)	IN (0x0001)	false
Jan 4, 2025 03:56:44.334538937 CET	192.168.2.16	1.1.1.1	0x5eef	Standard query (0)	offsiteforms.store	65	IN (0x0001)	false
Jan 4, 2025 03:56:49.359005928 CET	192.168.2.16	1.1.1.1	0x9a1c	Standard query (0)	offsiteforms.store	A (IP address)	IN (0x0001)	false
Jan 4, 2025 03:56:49.359174967 CET	192.168.2.16	1.1.1.1	0xca13	Standard query (0)	offsiteforms.store	65	IN (0x0001)	false
Jan 4, 2025 03:56:49.375214100 CET	192.168.2.16	1.1.1.1	0x3736	Standard query (0)	offsiteforms.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 4, 2025 03:56:35.099944115 CET	1.1.1.1	192.168.2.16	0xbd4e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 03:56:35.767477036 CET	1.1.1.1	192.168.2.16	0x7b60	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 4, 2025 03:56:35.767477036 CET	1.1.1.1	192.168.2.16	0x7b60	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 4, 2025 03:56:43.110945940 CET	1.1.1.1	192.168.2.16	0x1efd	Name error (3)	offsiteforms.store	none	none	A (IP address)	IN (0x0001)	false
Jan 4, 2025 03:56:43.111038923 CET	1.1.1.1	192.168.2.16	0x6c9c	Name error (3)	offsiteforms.store	none	none	65	IN (0x0001)	false
Jan 4, 2025 03:56:43.120472908 CET	1.1.1.1	192.168.2.16	0xb993	Name error (3)	offsiteforms.store	none	none	A (IP address)	IN (0x0001)	false
Jan 4, 2025 03:56:43.258333921 CET	1.1.1.1	192.168.2.16	0x15b9	Name error (3)	offsiteforms.store	none	none	A (IP address)	IN (0x0001)	false
Jan 4, 2025 03:56:43.258620024 CET	1.1.1.1	192.168.2.16	0x9393	Name error (3)	offsiteforms.store	none	none	65	IN (0x0001)	false
Jan 4, 2025 03:56:44.344475031 CET	1.1.1.1	192.168.2.16	0x5eef	Name error (3)	offsiteforms.store	none	none	65	IN (0x0001)	false
Jan 4, 2025 03:56:44.348439932 CET	1.1.1.1	192.168.2.16	0x8045	Name error (3)	offsiteforms.store	none	none	A (IP address)	IN (0x0001)	false
Jan 4, 2025 03:56:49.367671013 CET	1.1.1.1	192.168.2.16	0xca13	Name error (3)	offsiteforms.store	none	none	65	IN (0x0001)	false
Jan 4, 2025 03:56:49.374389887 CET	1.1.1.1	192.168.2.16	0x9a1c	Name error (3)	offsiteforms.store	none	none	A (IP address)	IN (0x0001)	false
Jan 4, 2025 03:56:49.384139061 CET	1.1.1.1	192.168.2.16	0x3736	Name error (3)	offsiteforms.store	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

https:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49726	142.250.186.36	443	7408	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-04 02:56:38 UTC	923	OUT	GET /url?q=https://offsiteforms.store/1wq4W8&sa=D&source=editors&ust=1734917344975185&usg=AOvVaw351shL2sABmvKRpEejl5tD HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQi5ys0BCMfRzQEIidPNAQjc080BCMvWzQEI9NbNAQiK180BCKfYzQEI+cDUFRi60s0BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-04 02:56:38 UTC	1176	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 02:56:38 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Server: gws X-XSS-Protection: 0 Set-Cookie: NID=520=Ambpgyum6R16n3Ex1ERRSrZGjUeEfba1ZVicRJDb4ipkDbVjdu8n4ttdqaKYn6DFzbiExu6Rh9B3L-Wy5qzcY0w_aiIQlWbO44BSb50l3_X5XYBaTbgMcucnWWdqPHc5Cd3mh_v5x0pb1vOZlief4uoY2vL02z5pRKizUkRn2s1bKYNm-rl7FyKXzVspeKjKG3zf4w; expires=Sun, 06-Jul-2025 02:56:38 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-04 02:56:38 UTC	214	IN	Data Raw: 36 30 34 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 20 4e 6f 74 69 63 65 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 2c 64 69 76 2c 61 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 52 6f 62 6f 74 6f 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 2d 74 6f Data Ascii: 604<html lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Redirect Notice</title><style>body,div,a{font-family:Roboto,Arial,sans-serif}body{background-color:#fff;margin-to
2025-01-04 02:56:38 UTC	1333	IN	Data Raw: 70 3a 33 70 78 7d 64 69 76 7b 63 6f 6c 6f 72 3a 23 30 30 30 7d 61 3a 6c 69 6e 6b 7b 63 6f 6c 6f 72 3a 23 36 38 31 64 61 38 7d 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 36 38 31 64 61 38 7d 61 3a 61 63 74 69 76 65 7b 63 6f 6c 6f 72 3a 23 65 61 34 33 33 35 7d 64 69 76 2e 6d 79 6d 47 6f 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 67 53 35 6a 58 62 29 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 67 53 35 6a 58 62 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 38 66 39 66 61 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 65 6d 3b 77 69 64 74 68 3a 31 30 30 25 7d 64 69 76 2e 61 58 67 61 47 62 7b 70 61 64 64 69 6e 67 3a 30 2e 35 65 6d 20 30 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 Data Ascii: p:3px}div{color:#000}a:link{color:#681da8}a:visited{color:#681da8}a:active{color:#ea4335}div.mymGo{border-top:1px solid var(--gS5jXb);border-bottom:1px solid var(--gS5jXb);background:#f8f9fa;margin-top:1em;width:100%}div.aXgaGb{padding:0.5em 0;margin-left
2025-01-04 02:56:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49731	142.250.186.36	443	7408	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-04 02:56:39 UTC	1395	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQi5ys0BCMfRzQEIidPNAQjc080BCMvWzQEI9NbNAQiK180BCKfYzQEI+cDUFRi60s0BGMvYzQEY642lFw== Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/url?q=https://offsiteforms.store/1wq4W8&sa=D&source=editors&ust=1734917344975185&usg=AOvVaw351shL2sABmvKRpEejl5tD Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=Ambpgyum6R16n3Ex1ERRSrZGjUeEfba1ZVicRJDb4ipkDbVjdu8n4ttdqaKYn6DFzbiExu6Rh9B3L-Wy5qzcY0w_aiIQlWbO44BSb50l3_X5XYBaTbgMcucnWWdqPHc5Cd3mh_v5x0pb1vOZlief4uoY2vL02z5pRKizUkRn2s1bKYNm-rl7FyKXzVspeKjKG3zf4w
2025-01-04 02:56:39 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 04 Jan 2025 02:54:04 GMT Expires: Sun, 12 Jan 2025 02:54:04 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 155 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-04 02:56:39 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2025-01-04 02:56:39 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2025-01-04 02:56:39 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2025-01-04 02:56:39 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2025-01-04 02:56:39 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49732	142.250.184.196	443	7408	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-04 02:56:40 UTC	658	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=Ambpgyum6R16n3Ex1ERRSrZGjUeEfba1ZVicRJDb4ipkDbVjdu8n4ttdqaKYn6DFzbiExu6Rh9B3L-Wy5qzcY0w_aiIQlWbO44BSb50l3_X5XYBaTbgMcucnWWdqPHc5Cd3mh_v5x0pb1vOZlief4uoY2vL02z5pRKizUkRn2s1bKYNm-rl7FyKXzVspeKjKG3zf4w
2025-01-04 02:56:40 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 04 Jan 2025 02:54:04 GMT Expires: Sun, 12 Jan 2025 02:54:04 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 156 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-04 02:56:40 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2025-01-04 02:56:40 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2025-01-04 02:56:40 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2025-01-04 02:56:40 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2025-01-04 02:56:40 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Target ID:	0
Start time:	21:56:09
Start date:	03/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phishingtest.eml"
Imagebase:	0xcb0000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:56:10
Start date:	03/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "AE3842F3-4B46-407E-93B9-BC48317ECC3C" "6414065B-BA2B-4351-945D-A87980A02F5D" "6972" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff717900000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	21:56:20
Start date:	03/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7V90LNRU\Open 332.pdf"
Imagebase:	0x7ff671780000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	21:56:22
Start date:	03/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff767fb0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	21:56:22
Start date:	03/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1164,i,9528970337408047140,8902369827790921300,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff767fb0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	21:56:36
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.google.com/url?q=https://offsiteforms.store/1wq4W8&sa=D&source=editors&ust=1734917344975185&usg=AOvVaw351shL2sABmvKRpEejl5tD
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:56:36
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1896,i,13739452463520773973,10384309443688143443,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report phishingtest.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7851c594-d350-4674-8507-440f4237afd1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF54a976.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f5dee65a-a010-4a7e-b7b4-b827ed509b09.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250104025626Z-167.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Windows Analysis Report
phishingtest.eml