Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msg

Overview

General Information

Sample name:possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msg
Analysis ID:1590527
MD5:44f22be45aa7a6597e01273c9a2d35ed
SHA1:4618e5427e37589714c9289dda123dad3588a815
SHA256:9bc8dbfa26e0bcc66aafa8091d8b4388f0f56a3c586abd5640099f9d80a4fd5b
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected phishing page
AI detected landing page (webpage, office document or email)
AI detected potential phishing Email
AI detected suspicious Javascript
HTML body contains low number of good links
HTML page contains hidden javascript code
No HTML title found
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Outlook Security Settings Updated - Registry
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6296 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6956 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A05F6BD5-041F-46BD-9253-1B44E9353620" "38B9395B-988F-4BFE-9C5C-269149A534C2" "6296" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • Acrobat.exe (PID: 6880 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\XA0VT943\Msig Insurance Europe.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
      • AcroCEF.exe (PID: 4480 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
        • AcroCEF.exe (PID: 5476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1576,i,7192828237008726935,7830260120330607894,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • chrome.exe (PID: 7896 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
        • chrome.exe (PID: 8084 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1840,i,625536796659273010,13689384045628339821,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6296, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
Sigma detected: Outlook Security Settings Updated - Registry
Source: Registry Key setAuthor: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\XA0VT943\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6296, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected phishing page
Source: https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74Joe Sandbox AI: Score: 8 Reasons: The brand 'DocuSign' is well-known and typically associated with the domain 'docusign.com'., The URL 'embeds.beehiiv.com' does not match the legitimate domain for DocuSign., The domain 'beehiiv.com' is unrelated to DocuSign and could indicate a third-party service., The presence of an input field asking for an email on an unrelated domain is suspicious., The URL structure does not include any direct reference to DocuSign, which is a red flag. DOM: 1.1.pages.csv
AI detected landing page (webpage, office document or email)
Source: https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74Joe Sandbox AI: Page contains button: 'Submit' Source: '1.2.pages.csv'
AI detected potential phishing Email
Source: EmailJoe Sandbox AI: Detected potential phishing email: Sender domain 'malhs.co.uk' doesn't match the claimed organization (MSIG Insurance Europe). Suspicious formatting of sender name with UTF-8 encoding to potentially mask true sender. Generic automated notification pretending to be from the same domain as recipient
AI detected suspicious Javascript
Source: 0.9.i.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as implementing a security challenge, the overall behavior is highly suspicious and indicative of a potential malicious attack.
Source: 0.14.id.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://ae879450.bosssellame.pages.dev/?email=mg%4... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script extracts an email parameter from the URL and then redirects the user to a random link, appending the email parameter to the URL. This behavior is highly suspicious and could be used for phishing or other malicious purposes.
Source: 0.15.id.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://sigbed.goodus.net/?snMZ=0usfrX&username=mg... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. While some of the behaviors may be related to legitimate functionality like analytics or tracking, the overall level of risk is elevated due to the presence of multiple suspicious activities.
Source: https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74HTTP Parser: Number of links: 0
Source: https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74HTTP Parser: Base64 decoded: 1736839861.000000
Source: https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74HTTP Parser: HTML title missing
Source: https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74HTTP Parser: HTML title missing
Source: EmailClassification: Credential Stealer
Source: https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-WJXL7FH
Source: https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-WJXL7FH
Source: https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74HTTP Parser: No <meta name="author".. found
Source: https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74HTTP Parser: No <meta name="author".. found
Source: https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74HTTP Parser: No <meta name="copyright".. found
Source: https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: chrome.exeMemory has grown: Private usage: 1MB later: 26MB
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownTCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global trafficDNS traffic detected: DNS query: beehiiv.com
Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
Source: global trafficDNS traffic detected: DNS query: client.px-cloud.net
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: ae879450.bosssellame.pages.dev
Source: global trafficDNS traffic detected: DNS query: sigbed.goodus.net
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownHTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: classification engineClassification label: mal60.phis.winMSG@37/54@13/252
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250114T0230330649-6296.etl
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A05F6BD5-041F-46BD-9253-1B44E9353620" "38B9395B-988F-4BFE-9C5C-269149A534C2" "6296" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\XA0VT943\Msig Insurance Europe.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1576,i,7192828237008726935,7830260120330607894,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A05F6BD5-041F-46BD-9253-1B44E9353620" "38B9395B-988F-4BFE-9C5C-269149A534C2" "6296" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 4A577D52C7C92E8F38B70CFD0A9C9847
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1840,i,625536796659273010,13689384045628339821,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\XA0VT943\Msig Insurance Europe.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1576,i,7192828237008726935,7830260120330607894,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1840,i,625536796659273010,13689384045628339821,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Drive-by Compromise		Windows Management Instrumentation31
Browser Extensions		1
Process Injection		3
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
Registry Run Keys / Startup Folder		1
Registry Run Keys / Startup Folder		1
Process Injection		LSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
DLL Side-Loading		1
DLL Side-Loading		1
DLL Side-Loading		Security Account Manager13
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Extra Window Memory Injection		1
Extra Window Memory Injection		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
chrome.cloudflare-dns.com
162.159.61.3
truefalse
    		high
    bg.microsoft.map.fastly.net
    		199.232.214.172
    		truefalse
      		high
      beehiiv.com
      		104.18.68.40
      		truetrue
        		unknown
        sigbed.goodus.net
        		24.199.124.2
        		truetrue
          		unknown
          www.google.com
          		216.58.206.36
          		truefalse
            		high
            ae879450.bosssellame.pages.dev
            		104.21.112.1
            		truetrue
              		unknown
              x1.i.lencr.org
              		unknown
              		unknownfalse
                		high
                client.px-cloud.net
                		unknown
                		unknownfalse
                  		high

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74true
                    		unknown
                    https://ae879450.bosssellame.pages.dev/?email=mg%40michaelgorski.netfalse
                      		unknown

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      142.250.186.170
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      2.16.168.101
                      		unknownEuropean Union
                      		20940AKAMAI-ASN1EUfalse
                      216.58.206.36
                      		www.google.comUnited States
                      		15169GOOGLEUSfalse
                      2.23.209.38
                      		unknownEuropean Union
                      		1273CWVodafoneGroupPLCEUfalse
                      24.199.124.2
                      		sigbed.goodus.netUnited States
                      		12271TWC-12271-NYCUStrue
                      64.233.166.84
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      162.159.61.3
                      		chrome.cloudflare-dns.comUnited States
                      		13335CLOUDFLARENETUSfalse
                      104.21.112.1
                      		ae879450.bosssellame.pages.devUnited States
                      		13335CLOUDFLARENETUStrue
                      23.209.209.135
                      		unknownUnited States
                      		23693TELKOMSEL-ASN-IDPTTelekomunikasiSelularIDfalse
                      199.232.214.172
                      		bg.microsoft.map.fastly.netUnited States
                      		54113FASTLYUSfalse
                      104.18.68.40
                      		beehiiv.comUnited States
                      		13335CLOUDFLARENETUStrue
                      142.250.184.202
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      52.113.194.132
                      		unknownUnited States
                      		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                      54.224.241.105
                      		unknownUnited States
                      		14618AMAZON-AESUSfalse
                      1.1.1.1
                      		unknownAustralia
                      		13335CLOUDFLARENETUSfalse
                      216.58.206.67
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      142.250.185.110
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      2.23.240.205
                      		unknownEuropean Union
                      		8781QA-ISPQAfalse
                      216.58.206.46
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      23.47.168.24
                      		unknownUnited States
                      		16625AKAMAI-ASUSfalse
                      239.255.255.250
                      		unknownReserved
                      		unknownunknownfalse
                      52.109.28.48
                      		unknownUnited States
                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                      142.250.185.195
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      142.250.186.40
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      142.250.186.100
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      104.18.69.40
                      		unknownUnited States
                      		13335CLOUDFLARENETUSfalse
                      142.250.184.232
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      172.217.16.195
                      		unknownUnited States
                      		15169GOOGLEUSfalse
                      52.109.76.243
                      		unknownUnited States
                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                      20.44.10.123
                      		unknownUnited States
                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

                      Private

                      IP
                      192.168.2.16

                      General Information

                      Joe Sandbox version:42.0.0 Malachite
                      Analysis ID:1590527
                      Start date and time:2025-01-14 08:30:04 +01:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:defaultwindowsinteractivecookbook.jbs
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:21
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • EGA enabled
                      Analysis Mode:stream
                      Analysis stop reason:Timeout
                      Sample name:possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msg
                      Detection:MAL
                      Classification:mal60.phis.winMSG@37/54@13/252
                      Cookbook Comments:
                      • Found application associated with file extension: .msg

                      Warnings

                      • Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
                      • Excluded IPs from analysis (whitelisted): 52.113.194.132, 52.109.76.243, 2.16.168.101, 2.16.168.119, 20.190.160.14, 20.190.160.22, 20.190.160.17, 40.126.32.68, 40.126.32.134, 40.126.32.72, 40.126.32.136, 40.126.32.74
                      • Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, prdv4a.aadg.msidentity.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, eur.roaming1.live.com.akadns.net, neu-azsc-000.roaming.officeapps.live.com, login.msa.msidentity.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, s-0005.s-msedge.net, login.live.com, osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, a1864.dscd.akamai.net, www.tm.lg.prod.aadmsa.trafficmanager.net
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size getting too big, too many NtQueryAttributesFile calls found.
                      • Report size getting too big, too many NtQueryValueKey calls found.
                      • Report size getting too big, too many NtSetValueKey calls found.
                      • VT rate limit hit for: beehiiv.com

                      Created / dropped Files

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):287
                      Entropy (8bit):5.2271925795334555
                      Encrypted:false
                      SSDEEP:
                      MD5:554867DAB0EB17D97E84501451114DCB
                      SHA1:7C7EBA766608191257FB238345A80D913F80528B
                      SHA-256:728E0C351B39076C9355909684CD43008EA0A15D461779245545D476D6A86379
                      SHA-512:79DB1642D972538159EA3C0BDD43EF6366BFB11223BC657D8C917E09DAF6E5120329FF956D9CAA83AF06A35F2B8459340FE51E3BA8BAADE5B0BBA3286B4F8744
                      Malicious:false
                      Reputation:unknown
                      Preview:2025/01/14-02:30:48.513 b68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-02:30:48.516 b68 Recovering log #3.2025/01/14-02:30:48.517 b68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):331
                      Entropy (8bit):5.141211460013571
                      Encrypted:false
                      SSDEEP:
                      MD5:91AAD8E814E8FF553470AF97AC6FBC77
                      SHA1:4E04231E2D0651962566286716C158C628F10E19
                      SHA-256:147ECE238125FFF0D8DC5CA17AE8981886353EE2F159164D369D95360A1089A2
                      SHA-512:C3609887C723AA7576AE1125C68C7D1595CD94BC8FDBEE29AB166F9254330C105E2D6FB00D8F406A38074B367C5DDA1A43F93C4CA4714379EDF54AC915386E9B
                      Malicious:false
                      Reputation:unknown
                      Preview:2025/01/14-02:30:48.407 d24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-02:30:48.411 d24 Recovering log #3.2025/01/14-02:30:48.411 d24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\656ce715-396e-414a-85f1-0a0b1b81247f.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):403
                      Entropy (8bit):4.976199622864144
                      Encrypted:false
                      SSDEEP:
                      MD5:DA9E1E48B2B930A471D004527B8737F7
                      SHA1:2544261907F48AD570E1D062498DCE8BBED62E90
                      SHA-256:EC34FA11E9D30A981956B60E73535788F9C8F0FD5EF092BE8948F077647D75E7
                      SHA-512:AF7C5A0482A8788F25CC555A814378B8B37768B75D502F19D9588A5AAC0B1D8954B33C0A4B8B48DCE2B9E7D8A40C39270C207A4530B16A9EC1E2A1A75EE975E0
                      Malicious:false
                      Reputation:unknown
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381399860804623","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136060},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):0
                      Entropy (8bit):0.0
                      Encrypted:false
                      SSDEEP:
                      MD5:4C313FE514B5F4E7E89329630909F8DC
                      SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                      SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                      SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                      Malicious:false
                      Reputation:unknown
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5af5d3.TMP (copy)

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):0
                      Entropy (8bit):0.0
                      Encrypted:false
                      SSDEEP:
                      MD5:4C313FE514B5F4E7E89329630909F8DC
                      SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                      SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                      SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                      Malicious:false
                      Reputation:unknown
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d648935c-a20c-4b3e-82a9-711ae49ba5c1.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:JSON data
                      Category:modified
                      Size (bytes):403
                      Entropy (8bit):4.953858338552356
                      Encrypted:false
                      SSDEEP:
                      MD5:4C313FE514B5F4E7E89329630909F8DC
                      SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                      SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                      SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                      Malicious:false
                      Reputation:unknown
                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4099
                      Entropy (8bit):5.229799407420896
                      Encrypted:false
                      SSDEEP:
                      MD5:EE4FC8320E3DC77BF2D3B11BB0CFF6F7
                      SHA1:C71BEDBE11CFFCC6CC42B7DF3BA28EDFE2B1B228
                      SHA-256:2C9EF6A4C4F1431317BEDEEFCA763D1FB310B15804CBD123DB412DF54A02F2B0
                      SHA-512:E9BF283CA8D73CC081D119916285F258D2D21C12ECFB963938B6DE1241937445587135AAE15E1556D2C0F34B5A0D998E5F9BF4F804C342DEBEC51B1C3534E99C
                      Malicious:false
                      Reputation:unknown
                      Preview:*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

                      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:ASCII text
                      Category:dropped
                      Size (bytes):319
                      Entropy (8bit):5.164076164514441
                      Encrypted:false
                      SSDEEP:
                      MD5:C34190B92416596844B29F2E3028E445
                      SHA1:21C77ABE15ECCF0DD98C169F56B67F6EAAFED693
                      SHA-256:D260FEA405C7B69918218AD2394A7E9FB4F4B3229D9026F051DED33186B32B77
                      SHA-512:C2F23938B272847A807D18FB8715580BA30AB2E5ACEBBE09B9D93ABA2BBEC87D93614152F4BCDFFCD738C959E3F70B526FD4F5446E014CB7882AAE2D0D0DD501
                      Malicious:false
                      Reputation:unknown
                      Preview:2025/01/14-02:30:48.551 d24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-02:30:48.553 d24 Recovering log #3.2025/01/14-02:30:48.554 d24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250114073052Z-171.bmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                      Category:dropped
                      Size (bytes):71190
                      Entropy (8bit):0.45963394576981464
                      Encrypted:false
                      SSDEEP:
                      MD5:527DE7D6A9168BDC23205148899A33B1
                      SHA1:6FE451891192430D3FC17D7FCCEC1CB8CEFAA155
                      SHA-256:6AB53CE20228C2BDF2B6F1BF7ABF41255258217093A23B6A7B03761CEAF90BBA
                      SHA-512:E39D4C311F11E2413FBD23C3A0C775B4A65899BA842928F633711C1BA6BACBFE18F2FBE2BE35CC74E4D445C089095F05ACA33F4BACBCC8F3AA56F99A999BDDCD
                      Malicious:false
                      Reputation:unknown
                      Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                      Category:dropped
                      Size (bytes):57344
                      Entropy (8bit):3.291927920232006
                      Encrypted:false
                      SSDEEP:
                      MD5:A4D5FECEFE05F21D6F81ACF4D9A788CF
                      SHA1:1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
                      SHA-256:83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
                      SHA-512:FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
                      Malicious:false
                      Reputation:unknown
                      Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):16928
                      Entropy (8bit):1.216029127506309
                      Encrypted:false
                      SSDEEP:
                      MD5:B61D661E6F976005A24E1EAD38CBEE2F
                      SHA1:1B0FB8589410CD73977ABB4D734F3540BC8AE62C
                      SHA-256:0996631EA0AAA19EB359B1400C4FC000F096C0D9B9D603F03BF092D0AF0C66C1
                      SHA-512:11B78576596814C639CBAFEE77DFFFB88054F95FD2596816E99D413F2AD59207E52B773309A5461E36D8698EF20BBCFE371602F9117213E80001F9F84E4036FD
                      Malicious:false
                      Reputation:unknown
                      Preview:.... .c.......-........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:Certificate, Version=3
                      Category:dropped
                      Size (bytes):1391
                      Entropy (8bit):7.705940075877404
                      Encrypted:false
                      SSDEEP:
                      MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                      SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                      SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                      SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                      Malicious:false
                      Reputation:unknown
                      Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                      Category:dropped
                      Size (bytes):71954
                      Entropy (8bit):7.996617769952133
                      Encrypted:true
                      SSDEEP:
                      MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                      SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                      SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                      SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                      Malicious:false
                      Reputation:unknown
                      Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):192
                      Entropy (8bit):2.7464849065063075
                      Encrypted:false
                      SSDEEP:
                      MD5:30967EDA396E15A0A3746CBDED2E0A76
                      SHA1:74D55EBC3B167FBED6F06D71B3C077C2A3739A4E
                      SHA-256:342DE2A54E8EA27650B21CC4F48782AE0669BF483FDBFF6293D70C7BAC1ECF3A
                      SHA-512:1ABED4B6C02B69FC33334CACA0698C600BD96A1613131A0BAA52E23B33F88F684A3394FBCAE6B4342ADE498F4AF36DDB55D14474DE5CC231CE32A90D692F6FFC
                      Malicious:false
                      Reputation:unknown
                      Preview:p...... ...........BVf..(....................................................... ..........W....-...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:data
                      Category:modified
                      Size (bytes):328
                      Entropy (8bit):3.2421047741749685
                      Encrypted:false
                      SSDEEP:
                      MD5:C40596AF4A89D6EAA10B0F69DB1A93B8
                      SHA1:CB1AC91566AE720AD193D362C9C1A54B9E1E77F9
                      SHA-256:7C50DEAF1452EFEA29E6FA8A8682C01019490389D9E561EFB63516A67FCEC538
                      SHA-512:398ED16176015D81DF9963782A2C8C3E63062A529D715831C3B8AFF0D81C829965A10223867610FBB33F6DA3FECF3E14DF37CCB7FAE63A8ACC457B885A37874A
                      Malicious:false
                      Reputation:unknown
                      Preview:p...... ........e..TVf..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):4
                      Entropy (8bit):0.8112781244591328
                      Encrypted:false
                      SSDEEP:
                      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                      Malicious:false
                      Reputation:unknown
                      Preview:....

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):1969
                      Entropy (8bit):5.0600221295835635
                      Encrypted:false
                      SSDEEP:
                      MD5:F2D50CD24A91925DE45986AF767BD2B3
                      SHA1:4C80AF7B77C214C8E99FCEA98DFBA36836A5ED68
                      SHA-256:F1EE357225532594AFD610A28870D8679DF71AF3CE691504243358BB80DBE2A2
                      SHA-512:0C9CC89BE1CEAB999006AE966FE051A24B9049A9AC8A2DF80B5E3A97E91DB67B2C91A2DC6D95F83E736C39DC2D2E834BB808015EF896A6293CD4D44F06A98A59
                      Malicious:false
                      Reputation:unknown
                      Preview:{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1736839955000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f44756c6e08822e64c0e471a2499e34d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696585148000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e8f53b6740aba22a83a1a569cebedbcc","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696585148000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ab062dea95f25ef019cc2f5f5f0121d4","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696583346000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"65580efad4bc88b91040ff50d71bfae9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696583346000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"f8ce16c8d78d640728012d308f601433","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1230,"ts":1696583346000},{"id":"DC_Reader_RHP_Banner","info":{"dg":

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                      Category:dropped
                      Size (bytes):12288
                      Entropy (8bit):0.9886756149599703
                      Encrypted:false
                      SSDEEP:
                      MD5:6D9275B450A5EBAC38409381863D7157
                      SHA1:98B797243A2899C0341040EABA7FFF46D1935F8D
                      SHA-256:46457FF0D4886A8B416E0FA0DACD549BAA4BCED7C0062BADB75CDB6518BED67A
                      SHA-512:C1D744583E8EDE7E666E6AF9CE1E180A10423187DA4DA131C32B2B2AB64A857E11950B52C68F7015C669440F8ECB52ED432ECAC370FF27143C47747716FB7F39
                      Malicious:false
                      Reputation:unknown
                      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:SQLite Rollback Journal
                      Category:dropped
                      Size (bytes):8720
                      Entropy (8bit):1.3448588494264335
                      Encrypted:false
                      SSDEEP:
                      MD5:8A5CDFFE198288AAC7701FD51F7843C6
                      SHA1:DBF132FFB11AE2C9391F379DC1F7947823F851C8
                      SHA-256:A33B0DE3C69B5E48FD4FEE8DE726D54DC1DC73F1EFD78738382B93FC83B2BF09
                      SHA-512:FDC57F2989F243CD746A529692191F0DD853D0F0622EB48BB47809F935F7D5260ED6004E918B53F075C44BC95EFEED323CBDF0130E8E895D94A5A94D17363F01
                      Malicious:false
                      Reputation:unknown
                      Preview:.... .c........t......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):66726
                      Entropy (8bit):5.392739213842091
                      Encrypted:false
                      SSDEEP:
                      MD5:C5027DDF0A86F422B4585AC13F1FF744
                      SHA1:589D0E5297CB8EC9A0CEEAF8F0255410F30D21E8
                      SHA-256:BE70923E8F6C910F2053FB614FC84EBF3CC3D805F6B4DD9CF4DDEB811F5E0A1D
                      SHA-512:76E4E4E73922646C0959E21B7234FD292245B9DE21E87B40BF2F7B8A82860A20D02862D7B0ABAFCAC54B363984A1A9F357F4655F83438DDA1B2D8CE7A9D0D286
                      Malicious:false
                      Reputation:unknown
                      Preview:4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

                      C:\Users\user\AppData\Local\Temp\MSI9ea3f.LOG

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):246
                      Entropy (8bit):3.5146815864506182
                      Encrypted:false
                      SSDEEP:
                      MD5:9542C87F05616E8FC939797A746000FA
                      SHA1:D3331A59E8025FB950850BC002CEBE34DBFD79CB
                      SHA-256:C266EA33AB11381B6926C1B3BCE608E0C675E2C690EA3AAF5A7AC3E8809C8B91
                      SHA-512:570ABFF5060BF55C97E6D2057B400E87640F739FCE43A51C7CC20A8F01E40D4DA9462FA9F06A8EA5F32614AA65D36C1FB0AF11935651A412ABA4E6318CD82332
                      Malicious:false
                      Reputation:unknown
                      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.4./.0.1./.2.0.2.5. . .0.2.:.3.0.:.5.5. .=.=.=.....

                      C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250114T0230330649-6296.etl

                      Download File
                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      File Type:data
                      Category:modified
                      Size (bytes):94208
                      Entropy (8bit):4.462131884027503
                      Encrypted:false
                      SSDEEP:
                      MD5:D23B40926931EF482BBAB09A45EA59CF
                      SHA1:70256697FD249EF3226D90947A03B6CF7477E6D3
                      SHA-256:419F75899918126FC9F9D6228D662C9C4349968364BE2DCF1F4FCA7205A2F1C8
                      SHA-512:BAEA081D1112B1E366EFB2C79768A855E1B395EEADF4B469D2287CC58F740AE505A37801526BD141E5E8BEDFFDA3D8B7A702828E91218308ED48562EA15FB0A0
                      Malicious:false
                      Reputation:unknown
                      Preview:............................................................................`.............h2Vf..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................`..T.Y............h2Vf..........v.2._.O.U.T.L.O.O.K.:.1.8.9.8.:.c.6.2.5.4.d.a.a.0.a.a.1.4.6.a.b.9.6.8.c.3.2.b.f.b.3.9.1.2.4.a.9...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.5.0.1.1.4.T.0.2.3.0.3.3.0.6.4.9.-.6.2.9.6...e.t.l.......P.P...........h2Vf..........................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9c0by46_hfwmza_3s0.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:PDF document, version 1.6, 0 pages
                      Category:dropped
                      Size (bytes):358
                      Entropy (8bit):5.047106920883875
                      Encrypted:false
                      SSDEEP:
                      MD5:71FABB4DC25431780729A4EB04A250E3
                      SHA1:BFA3BC24AD0AA9B6AEEADBF92AF4D0ECA9059CD5
                      SHA-256:2BFC628BE0CA55E5179B67BCC35508D4C66A73E77F2EDAA40E9320F6A69E13B1
                      SHA-512:C7D93B7B4E1DECFF41C3B708F307BCCC4C48DD6EEE17B09631914F2FD4AB9E9E01601E0A67B093DF0C34ED2C862E75AC34F896F0854C8A517F982B7E5BBCDAA4
                      Malicious:false
                      Reputation:unknown
                      Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<86B1F27D1BF64645B1F184E2DADB2642><86B1F27D1BF64645B1F184E2DADB2642>]>>..startxref..127..%%EOF..

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-14 02-30-50-234.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393)
                      Category:dropped
                      Size (bytes):16525
                      Entropy (8bit):5.353642815103214
                      Encrypted:false
                      SSDEEP:
                      MD5:91F06491552FC977E9E8AF47786EE7C1
                      SHA1:8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
                      SHA-256:06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
                      SHA-512:A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
                      Malicious:false
                      Reputation:unknown
                      Preview:SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with very long lines (393), with CRLF line terminators
                      Category:dropped
                      Size (bytes):15114
                      Entropy (8bit):5.373262786942185
                      Encrypted:false
                      SSDEEP:
                      MD5:35DDDAA688BC5E0C91306C8CC0B5006E
                      SHA1:541B5C7728D90F2BC648AFE31FE5D68F75BF3ADB
                      SHA-256:63044A6E8165693672E2BBE0ECED3B0689488D58FB323CCEA0C45F9A0F5181A0
                      SHA-512:3E4F1B4D782EFE0A4280D11925F5A925B27765752DA996A296F37A0B55FC298F6132AECACEA0DC8C9B4C07CA4A27B6322F5860BF01360B29B293DE6A9059FAD6
                      Malicious:false
                      Reputation:unknown
                      Preview:SessionID=764dcd4b-139d-4eb1-838b-d941f2a14dbb.1736839850247 Timestamp=2025-01-14T02:30:50:247-0500 ThreadID=5988 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=764dcd4b-139d-4eb1-838b-d941f2a14dbb.1736839850247 Timestamp=2025-01-14T02:30:50:249-0500 ThreadID=5988 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=764dcd4b-139d-4eb1-838b-d941f2a14dbb.1736839850247 Timestamp=2025-01-14T02:30:50:249-0500 ThreadID=5988 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=764dcd4b-139d-4eb1-838b-d941f2a14dbb.1736839850247 Timestamp=2025-01-14T02:30:50:249-0500 ThreadID=5988 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=764dcd4b-139d-4eb1-838b-d941f2a14dbb.1736839850247 Timestamp=2025-01-14T02:30:50:249-0500 ThreadID=5988 Component=ngl-lib_NglAppLib Description="SetConf

                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):29752
                      Entropy (8bit):5.4147699728150815
                      Encrypted:false
                      SSDEEP:
                      MD5:221E657E9E371A64705611838B8E1B16
                      SHA1:41591E4629FF8ED507500A463300A3B1AFD7EE89
                      SHA-256:16506AAEDFB92147AE9D03C6F78CEC2B0D5C1A997CA6D9A117D4C5FF545374F2
                      SHA-512:F5040FCCB330C5C2A0910006F192FE032D2D88EDA833B9BF436C5FD58A734E186A27557F378615A00F2A83D1988B51F9E81E011CA05808229950508F684DD5A7
                      Malicious:false
                      Reputation:unknown
                      Preview:06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

                      C:\Users\user\AppData\Local\Temp\acrocef_low\007ded42-6fb0-4359-a108-bd6a4a0e0b87.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                      Category:dropped
                      Size (bytes):758601
                      Entropy (8bit):7.98639316555857
                      Encrypted:false
                      SSDEEP:
                      MD5:3A49135134665364308390AC398006F1
                      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                      Malicious:false
                      Reputation:unknown
                      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                      C:\Users\user\AppData\Local\Temp\acrocef_low\15120a74-06f2-4688-97ac-d77abae23f68.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                      Category:dropped
                      Size (bytes):1419751
                      Entropy (8bit):7.976496077007677
                      Encrypted:false
                      SSDEEP:
                      MD5:E787F9888A1628BE8234F19E8EE26D68
                      SHA1:44D5180C06ADBBDAADDBCE350CE4DEC997CD83E5
                      SHA-256:3A09F3799148DA49F039A35AEDD22F368FB35B8D6022C4691C10606F704DAF80
                      SHA-512:EE9B602898706CC0F33AA570E29A79A58ED748E1B738D74DF0C8C8DF193E23421B47AC8C862623ED774289D94FA90662A4CC436B80479D6420433D81752E9CA9
                      Malicious:false
                      Reputation:unknown
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\5bc2ce50-47c5-436e-8f38-e591e3f4ef41.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                      Category:dropped
                      Size (bytes):1407294
                      Entropy (8bit):7.97605879016224
                      Encrypted:false
                      SSDEEP:
                      MD5:2748FBA76941F77C5C3D831E358162F1
                      SHA1:55B46C404506F24FF3DD04DFE8FE23DD2198B31A
                      SHA-256:34B4238DCB7D63037437D1BDEE226F43DA4C899E1814E4F725A2DE8A0BDDC36F
                      SHA-512:66CDF567E0183A0275F323D2B01C9098D1099C94595A1C88DA8CB8811D0FCF884D53C8C5E864322B8584336DA4279501F1CC12CC9D96FB0CE3444138A2A97BDC
                      Malicious:false
                      Reputation:unknown
                      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                      C:\Users\user\AppData\Local\Temp\acrocef_low\63801f42-4097-4d44-8eea-3a0e1279c426.tmp

                      Download File
                      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                      Category:dropped
                      Size (bytes):386528
                      Entropy (8bit):7.9736851559892425
                      Encrypted:false
                      SSDEEP:
                      MD5:5C48B0AD2FEF800949466AE872E1F1E2
                      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                      Malicious:false
                      Reputation:unknown
                      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                      C:\Users\user\AppData\Local\Temp\~DF3DD2623EA45D7795.TMP

                      Download File
                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):163840
                      Entropy (8bit):0.36987224073407865
                      Encrypted:false
                      SSDEEP:
                      MD5:85C973C7B34E073C040B7AEA7EF1CE37
                      SHA1:8EB3D88A5E3D1243C75BCD727059CDC7201156FD
                      SHA-256:3303FF9EC86E215B3ABEE591925C22F6E164A38774FEDA5C938E9E68A87F5BB0
                      SHA-512:F24B2A1AB2AC6438F1123294BB14C3FA84E6FDCF0189E863D324F15D6C68048FB032321B55DB0B1D89306D621F94C5B17603481D06C5788A48D7C0CB1544E373
                      Malicious:false
                      Reputation:unknown
                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 06:31:02 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2673
                      Entropy (8bit):3.981982780188927
                      Encrypted:false
                      SSDEEP:
                      MD5:70C3D9ED39B20D89F2B4595F398E6E49
                      SHA1:8283067F076D8B9CF3226E8153BCCCDCC09CCDE3
                      SHA-256:344AF3A4A96E3F1B76293C380E30C8E1BFF4A297F3890A1291BC2F523FEF5E27
                      SHA-512:B119AFFEAC0000A0FCE567031F88ED1F1277774008B2C6C4B67C3CB876931FE36856432307C9A69A0C3D7C3E65504D90AA1E8640E32F7AB61CC7E0A820E1C7E3
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,.....czCVf..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Z.;....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z.;....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Z.;....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Z.;..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Z.;...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 06:31:02 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2675
                      Entropy (8bit):3.993314921481439
                      Encrypted:false
                      SSDEEP:
                      MD5:8343972C3A9230D704B2B744CA299844
                      SHA1:9F17C204544A60FD4D7F8CCEECDC9C0B99DABEE2
                      SHA-256:AAADC7F2D5EBF79134A36B896519B89F167C9AE4F6F01A0C505D7A2D856364E1
                      SHA-512:C81EE02EEE6ECFD8996657F681C8031D024484AB6F9215D9888B0FDD672CFD36A06B55917A8C5CC7FCD5E4F3DE1F9983A1C0FF72707A01B93F061D2242BD0D72
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,....e.nCVf..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Z.;....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z.;....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Z.;....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Z.;..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Z.;...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2689
                      Entropy (8bit):4.010086964299569
                      Encrypted:false
                      SSDEEP:
                      MD5:C26BAA53C5418829957027E1A21A96CE
                      SHA1:7306E259AD994C03F7170322D9C42C4B3449C2CF
                      SHA-256:E8616942B1519C5B39C4F0456E96F2B670FBE2ABEB90C2C556631C492137361F
                      SHA-512:EEFD31960F31D905565A2B37421F25550B597A1D36788377D63386ED768972B59E6A34FD64636092BD530197F76F4C12D73057EB5DAA2B0D9D53552559EBA7DE
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Z.;....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z.;....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Z.;....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Z.;..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 06:31:02 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2677
                      Entropy (8bit):3.9963634148644935
                      Encrypted:false
                      SSDEEP:
                      MD5:E4F33B169C6E14A96C71BBDEE5686413
                      SHA1:B9FD40A0ED7C295573CEB07CCB66767741B733EE
                      SHA-256:B63B9FC214D9340C854BF1249C5123AFF89C7DB653E1513655F2B62AFC2B6431
                      SHA-512:001FAEEDDD34262B95F38FD713D51683A74C26B13A5E9290B4713D7CB23E1AFE9C6669F826C22FBC6E387ADD6EF8561139295203848A746989C9A040B0F5CEDA
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,......`CVf..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Z.;....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z.;....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Z.;....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Z.;..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Z.;...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 06:31:02 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2677
                      Entropy (8bit):3.984088609713395
                      Encrypted:false
                      SSDEEP:
                      MD5:CE866F0606D71E288E0F82AA40F56814
                      SHA1:4EBA94C2A63041001F0DE1F56E6EA0E9EB74AB20
                      SHA-256:0FE38B130F4848FCD94147A3901C68C8911EF759C3723DBDC51502647C733B41
                      SHA-512:A73DC4473B111EA2449459ACA49E326352E11A7219F6332A5BA05C2F7690EBE00C5BDBFD7507E954DB7B9AB614D22F9137B9F3BD60444930C25030814DCBBBC9
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,......tCVf..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Z.;....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z.;....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Z.;....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Z.;..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Z.;...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 06:31:02 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                      Category:dropped
                      Size (bytes):2679
                      Entropy (8bit):3.9950707357106725
                      Encrypted:false
                      SSDEEP:
                      MD5:B4B5E22A62FA182F80C56FE4D54A54CE
                      SHA1:64BFEC7153031775FE4C9D4161C9D5410815F15C
                      SHA-256:B6811ACDFBD738F3466ADAD422064CB273AC9D49258C6035D32DECDAB842A880
                      SHA-512:ACC8889D72B12503E52C436F9BFDD242F9379A1D6F3F255DA16839B4FE6AE8BCC0B06DED2B4BE776DBC6040584F3ACDCDD90444EB9F8BD13A16964B230D85D46
                      Malicious:false
                      Reputation:unknown
                      Preview:L..................F.@.. ...$+.,......SCVf..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Z.;....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Z.;....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Z.;....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Z.;..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Z.;...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                      C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                      Download File
                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      File Type:Microsoft Outlook email folder (>=2003)
                      Category:dropped
                      Size (bytes):271360
                      Entropy (8bit):1.521295078925998
                      Encrypted:false
                      SSDEEP:
                      MD5:E74F4664F974537243CB22B1C12B4E40
                      SHA1:4A0AC92D720BE8AD279F0A73D3F8C8B6AB74365B
                      SHA-256:35851BAE9EC7FE30632B4B5FE3E6B9A72D83B9CB3FD19F2EA5DD32A8F9F122E6
                      SHA-512:01E4268F71A36A02B80E179AE860524E85DFDB23A643F52DD28BD3AFA8187044ECEE9F6FAF53CF96754C86E190EB66A7099ECD56E4FFF25ECB403EF6DAA07A40
                      Malicious:true
                      Reputation:unknown
                      Preview:!BDN.h.SM......\.......................\................@...........@...@...................................@...........................................................................$.......D.......>..........................................................................................................................................................................................................................................................................................................................H.........).=......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                      C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                      Download File
                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      File Type:data
                      Category:dropped
                      Size (bytes):131072
                      Entropy (8bit):1.1199443677818595
                      Encrypted:false
                      SSDEEP:
                      MD5:51C60C09112FE60C71B821C13E8BA9DB
                      SHA1:6779675643CE911438E41137A612E682C69440B2
                      SHA-256:48C75A3DAE647B4B96CFACEAAE4B2F5A2C41C63069E03316B7B4C0D915A1D01F
                      SHA-512:010B9F935A6FCA3F2F88C8A273E6F937B94B49854EF67CA4163DB299EB1C747DEA5AA66F960439542FC2F672E73D9722B26EF6BD3044A1BEA07423062137F885
                      Malicious:true
                      Reputation:unknown
                      Preview:...0...Q.............<2Vf.......D............#.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................&..D......*.cB0...R.............<2Vf.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                      Chrome Cache Entry: 170

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:JSON data
                      Category:downloaded
                      Size (bytes):875
                      Entropy (8bit):5.041341926266165
                      Encrypted:false
                      SSDEEP:
                      MD5:25C2BAF2B0F9A2F234E0BC51932B2BA4
                      SHA1:62CF79A6AE2CAE4609E1A9868A7B36288C40D711
                      SHA-256:08E465434224BBEDEDB00133E19A8DD5835EFD104BB69EC579EC6EA7344B3642
                      SHA-512:81325F6934FB15E95ABCD7429BE2E4E4D189120EFC0D687C929F1EE30065DAE624532AB2DEDF50FA47B9EBB31CA65158387CAFFC1D908067D187D572DC2B264B
                      Malicious:false
                      Reputation:unknown
                      URL:https://embeds.beehiiv.com/api/embeds/1ac29d4e-2fb8-419c-8498-f07b405bca74
                      Preview:{"id":"1ac29d4e-2fb8-419c-8498-f07b405bca74","publication_id":"15bd855e-aff8-4a0e-a529-dae84fa3f508","name":"Docu","header":"DocuSign Documents","description":"Sign-in authentication with recipient email is required to review and electronically sign the pending document. There is no requirement for a paper copy to be produced if completed with DocuSign.","button_text":"Submit","config":{"body_font":"Inter","text_color":"#030712","button_font":"Inter","header_font":"Inter","button_color":"#3100f3","background_color":"#F9FAFB","button_text_color":"#f9f9fb"},"created_at":"2025-01-13T12:38:12.645Z","updated_at":"2025-01-14T05:43:50.010Z","success_message_text":"","success_redirect_url":"https://ae879450.bosssellame.pages.dev","deleted_at":null,"input_placeholder":"Enter your email","remove_email_from_redirect_url":false,"captcha_enabled":false,"beehiiv_branded":true}

                      Chrome Cache Entry: 171

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:JSON data
                      Category:dropped
                      Size (bytes):48
                      Entropy (8bit):4.172995052579129
                      Encrypted:false
                      SSDEEP:
                      MD5:61DD07FB5A9C83D8BA6C6E53452707E8
                      SHA1:5C2085BBF6B50EAF00423E0178459ADF0B7CD7FA
                      SHA-256:72D94A42F3D544F369B9A7DA8D2E5370B2C3C1634165DCC72A53FB443BE40933
                      SHA-512:E85111BE6D081D4C9DC3D3F002D8BE5D21B4E89C41FD21FD2C90FF497E5C449FF4B3A2031EBA0A4E84A48FFDB758D306955AB0E750D992CE1EAE7A903EB8288B
                      Malicious:false
                      Reputation:unknown
                      Preview:{"success":false,"message":"Endpoint not found"}

                      Chrome Cache Entry: 172

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (65462)
                      Category:dropped
                      Size (bytes):407212
                      Entropy (8bit):5.309927954712754
                      Encrypted:false
                      SSDEEP:
                      MD5:F206300056CFC9EB4D68EA680EB40E2E
                      SHA1:865E1CF766AB18CAFBBD6261AC40A98794AEDD22
                      SHA-256:DBD56CB4F17CEDEA5D4F6925BB16E6276885AEC2DAB2876F510F58AADE1DA50F
                      SHA-512:D2C806662770723455077B773F5CE546F2D6E9982D0EA1DA05C948A3A55167935E1019EA865DA902C0798299F9C04DFD62D34E2C6124CCF38F363E0A0DC4963C
                      Malicious:false
                      Reputation:unknown
                      Preview:/*! For license information please see 2.edcda44d.chunk.js.LICENSE.txt */.(this["webpackJsonpexternal-embed"]=this["webpackJsonpexternal-embed"]||[]).push([[2],[function(e,t,n){"use strict";e.exports=n(50)},function(e,t,n){e.exports=n(55)()},function(e,t,n){"use strict";e.exports=function(e){for(var t=arguments.length,n=Array(t>1?t-1:0),r=1;r<t;r++)n[r-1]=arguments[r];var o=e,i=!0,a=!1,l=void 0;try{for(var u,c=n[Symbol.iterator]();!(i=(u=c.next()).done);i=!0){var s=u.value;if("undefined"===typeof o||null===o)return;o="function"===typeof s?s(o):o[s]}}catch(f){a=!0,l=f}finally{try{!i&&c.return&&c.return()}finally{if(a)throw l}}return o}},function(e,t,n){"use strict";e.exports=n(82)},function(e,t,n){"use strict";function r(e,t){return t||(t=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(t)}}))}n.d(t,"a",(function(){return r}))},function(e,t,n){"use strict";(function(e){var r=n(13),o=n.n(r),i=n(20),a=n.n(i),l=n(0),u=n.n(l),c=n(21),s=n(14),f=n(15),p=(n(1),n(45

                      Chrome Cache Entry: 173

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:Web Open Font Format (Version 2), TrueType, length 48444, version 1.0
                      Category:downloaded
                      Size (bytes):48444
                      Entropy (8bit):7.995593685409469
                      Encrypted:true
                      SSDEEP:
                      MD5:8E433C0592F77BEB6DC527D7B90BE120
                      SHA1:D7402416753AE1BB4CBD4B10D33A0C10517838BD
                      SHA-256:F052EE44C3728DFD23ABA8A4567150BC314D23903026FBB6AD089422C2DF56AF
                      SHA-512:5E90F48B923BB95AEB49691D03DADE8825C119B2FA28977EA170C41548900F4E0165E2869F97C7A9380D7FF8FF331A1DA855500E5F7B0DFD2B9ABD77A386BBF3
                      Malicious:false
                      Reputation:unknown
                      URL:https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
                      Preview:wOF2.......<.......l..............................`...\..p?HVAR.m?MVAR^.`?STAT.N'&..>/l........>....0....6.$.... ........[..A.2v.6......$..e...w"../.L.p:......Tpc..8@.[5......d#d.xw..o.O3-.....%..>...%..)~p.K.J.H..S...s..z..Wa.. 0\..J.....BL;V..-.L...j....^.9..HO l..,.*.6.v....?....x.....m..;....a![zif...Ur...Q..P.&.I1..:n.p...j~..h...9.!....@.<.bl|.Y?h..B.j/..rH.S%/~.^D...6..D.4G...y....Y.....=/o..W..5ryo.d?.gA]..?...1V..S......7ZJ...f....mBG[0eW....y..%B}..]? ...,sR<.y~.~.}.%.!..,X.....`...R..^....S.....u*.?k.v.k..U.u..M..`!...b!..X)P...y{.........n..T+6...R......L...x}...g...].g"WT.b..h ....X...=;{w...QO.s..w..@.(,..........{.........1..@...(...\.......9*..2.h9P.G........K.Dp...F..4W..ui.u...G...s..x7.?..tg..D..O.sA..t.t.4..~..e\...X.....T..kf.qfX..=^_....g"....De...x[J..A..).G.YUhR.....0.l..#&3.'.K..*...........$I.Pp.../.s.<@...r=..S......d..P.S.B.w.~X..ZK....h J.`A.bv,=.....>1.Ev.^..U.A. ....EU..].........dw..!$.A`..B.._.....Z~..!..J..l]r.m}m..

                      Chrome Cache Entry: 175

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:PHP script, ASCII text, with CRLF line terminators
                      Category:downloaded
                      Size (bytes):2683
                      Entropy (8bit):5.041618768419983
                      Encrypted:false
                      SSDEEP:
                      MD5:429FDE044420C0E44BDF9AE199F3AA86
                      SHA1:8A66DEA178707D2D1EEC3CD72EA57ADB07CB3E2B
                      SHA-256:B9423E66CBB9B281699BE16E2D93EC7D813127D66369F8A8D1B95D567E5C6E90
                      SHA-512:87306383742B1D8295B289B855F4F84D723AB86D71D9C2F2D9B1AB947B17CBF0F5D5B5AF766CD260955904047E3C4FD1385529F45A5E52C08CA75EBDD168715D
                      Malicious:false
                      Reputation:unknown
                      URL:https://ae879450.bosssellame.pages.dev/?email=mg%40michaelgorski.net
                      Preview:<?php..session_start();....// Debugging: Print session ID..echo "Session ID: " . session_id();....// Check for HTTPS and redirect if not secure..if (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] !== 'on') {.. echo "Not using HTTPS. Redirecting...";.. header('Location: https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);.. exit;..}....// Check if the user is logged in..if (!isset($_SESSION['user_id'])) {.. echo "User not logged in. Returning 401 Unauthorized.";.. header('HTTP/1.0 401 Unauthorized');.. exit;..}..// After successful login..$_SESSION['user_id'] = $userId; // Set the user ID....// Debugging: Verify user authentication..//echo "User ID: " . $_SESSION['user_id'];....// Rest of your code for authenticated users..echo "User ID: " . $_SESSION['user_id'];..?>....<!DOCTYPE html>..<!DOCTYPE html>..<html>..<head>.. <title>Loading...</title>.. <script>.. // Function to extract email from URL parameter.. function getEmailFromUrl() {..

                      Chrome Cache Entry: 176

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (2562)
                      Category:dropped
                      Size (bytes):215965
                      Entropy (8bit):5.553526111646605
                      Encrypted:false
                      SSDEEP:
                      MD5:7CF547C37E06827152BCE33004D835FB
                      SHA1:957B7EED4373957E630A665DE057B409B8E364E4
                      SHA-256:3540F036552FA08D117BA8E2CEBE5AA5E616F5E36206D18FA0B9A610996109A9
                      SHA-512:7DCACCF8037871D971CFE157AB4C69C74A2428365585B551AD16D73231A85E773AC2D7AFEE23972E9A9E2B2DB5DB6A30B99103D47DE3D64547F6FD5116CF1425
                      Malicious:false
                      Reputation:unknown
                      Preview:.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]||{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"7",. . "macros":[{"function":"__e"},{"function":"__f","vtp_component":"URL"},{"function":"__jsm","vtp_javascript":["template","(function(){var a=",["escape",["macro",1],8,16],";return a.replace(\/\\\/$\/,\"\")})();"]},{"function":"__jsm","vtp_javascript":["template","(function(){return(start=Math.floor(Date.now()\/1E3))||\"\"})();"]},{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"HOST","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"PATH","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__e"}],. "tags":[{"function":"__html","metadata":["map"],"once_per_event":true,"vtp_html":["t

                      Chrome Cache Entry: 177

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (2562)
                      Category:downloaded
                      Size (bytes):215965
                      Entropy (8bit):5.553530700063075
                      Encrypted:false
                      SSDEEP:
                      MD5:866EC42A0A9B396EA8C6A65DF41463D3
                      SHA1:8F189199128FF9964FB28BDF579E245BE0821294
                      SHA-256:01FBE3738CC15171176E20EAC3F45B00DE54EB32B5777E411FD9610E8FF33F58
                      SHA-512:F342791E0474B1E40011DF6C7E289553F4760A718C6F89E902EDBC429458CFFFDB7132D5D66C646079D07BCE134AC82E25FEE5C2C42AEF97E984ACAF50541713
                      Malicious:false
                      Reputation:unknown
                      URL:https://www.googletagmanager.com/gtm.js?id=GTM-WJXL7FH
                      Preview:.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]||{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"7",. . "macros":[{"function":"__e"},{"function":"__f","vtp_component":"URL"},{"function":"__jsm","vtp_javascript":["template","(function(){var a=",["escape",["macro",1],8,16],";return a.replace(\/\\\/$\/,\"\")})();"]},{"function":"__jsm","vtp_javascript":["template","(function(){return(start=Math.floor(Date.now()\/1E3))||\"\"})();"]},{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"HOST","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"PATH","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__e"}],. "tags":[{"function":"__html","metadata":["map"],"once_per_event":true,"vtp_html":["t

                      Chrome Cache Entry: 180

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (1572)
                      Category:downloaded
                      Size (bytes):6193
                      Entropy (8bit):5.401714743814202
                      Encrypted:false
                      SSDEEP:
                      MD5:F2D1D2937C3546E15C471236646AC74E
                      SHA1:DD8D90F6D4AC8D72C718C10424788612689D89DB
                      SHA-256:719D2FC548145FA8D8361205F6FCB49EEFC54C71FBB18E6320A60A263F40637A
                      SHA-512:7B400281407249F805AB4695E0B7D3CDF4F7F5F776F9F7E60872D5208B7324DADDDAD79D76AC9991C74563520FB6BFF3A6343C8C10591C9EB5682733592668A4
                      Malicious:false
                      Reputation:unknown
                      URL:https://fonts.googleapis.com/css2?family=Open+Sans&display=swap
                      Preview:/* cyrillic-ext */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4taVIGxA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVIGxA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4saVIGxA.woff2) for

                      Chrome Cache Entry: 181

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (19592)
                      Category:dropped
                      Size (bytes):19640
                      Entropy (8bit):5.315086402900025
                      Encrypted:false
                      SSDEEP:
                      MD5:EE5EB442007B1AD4908D8CE77B3C2BCE
                      SHA1:2EA314AE1A13AA52E98671B7626096CE20FE0146
                      SHA-256:79685D88E77FB6073EB2186384A792A094B89FE9BF66DF5B6B86AD6373FC3EEE
                      SHA-512:0C63CFEF1C8FE8300689AE6F5394A4370A57120D43FAA8CBC5BBDDB8BADA7B1E1E8B4405D13F16D96B4608A1018FD72128672D7A06D34F4D7F45C202A9C59FE9
                      Malicious:false
                      Reputation:unknown
                      Preview:(this["webpackJsonpexternal-embed"]=this["webpackJsonpexternal-embed"]||[]).push([[0],{105:function(e,t,n){"use strict";n.r(t);var a,o,r,i,c,l,u,s=n(0),d=n.n(s),p=n(39),m=n.n(p),h=n(6),b=n(7),f=n(9),g=n(8),v=n(110),S=n(107),y=n(111),x=n(16),E=n(4),w=n(5),_=w.a.div(a||(a=Object(E.a)(["\n position: relative;\n display: flex;\n align-items: center;\n justify-content: center;\n height: 100vh;\n width: 100vw;\n box-sizing: border-box;\n text-align: center;\n padding: 12px;\n background-color: ",";\n"])),(function(e){return e.backgroundColor?e.backgroundColor:"#f3f4f6"})),O=w.a.div(o||(o=Object(E.a)(["\n max-width: 28rem;\n margin-left: auto;\n margin-right: auto;\n"]))),C=w.a.div(r||(r=Object(E.a)(["\n margin-bottom: 1.5rem;\n"]))),k=w.a.h2(i||(i=Object(E.a)(["\n color: ",";\n font-family: ",";\n font-size: 28px;\n line-height: 1;\n margin-block: 0;\n margin-bottom: 0.4;\n"])),(function(e){return e.textColor?e.textColor:"#000"}),(function(e){return e.fontFamily?e.fontFam

                      Chrome Cache Entry: 182

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:PNG image data, 16 x 15, 8-bit/color RGBA, non-interlaced
                      Category:downloaded
                      Size (bytes):1190
                      Entropy (8bit):7.4470853307878535
                      Encrypted:false
                      SSDEEP:
                      MD5:4E97D5BF55BFF7ACB4D84150EBDA36F4
                      SHA1:13D3974361E0FEE926A1F802864A2963D81890EB
                      SHA-256:D0A7847D7E1C08556B23C28A518F817A50D0AD93476D5E8073DAD12476C03E29
                      SHA-512:F43CCA3A2CF7E621FF9CFE2F163FF94CA29C08C7B1D833625A8DFFC2F687CF2F9AC9E6925AF05D46C5EC037D2513DDCB90361849A50A7CC15E60F138AD2C3C1E
                      Malicious:false
                      Reputation:unknown
                      URL:https://embeds.beehiiv.com/img/favicon.png
                      Preview:.PNG........IHDR..............sO/....sRGB.........pHYs..,K..,K..=.....YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.L.'Y....IDAT(.5R=h.[.>...lv.l....1...."h!.,l.....x..C..MR..."D.`........6..<..1.w......{<3Y...w..|.w.{..A.$p..._.w..n8a..X.NT ..#1.........][...CD.......;..G.#.NT!.....v|.....h.C..x:.T...s:...........~......j7...r...A..Fzu.......6..H_..P.Ly.sOlP..:A..wf..Gf1+{.....oO...Ee..j;....a...%!R.V.E..*lD.^..\...{.A"....;.6..@.6..A_...4g]r. ....Q1..N1... '..)h....\.b*.#.`. ...+#.TD...K~_.%.n.Bh..+b.....lQ...\.......W..JW.............f./.n..y.).T.y..).h..#..V...cOp4.4.X.....M4&+..s.*....p......y...AV.....k...X.+...P.....c.R#ff.5..2..4.....Ve#.d.p...y,...v&..

                      Chrome Cache Entry: 183

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with very long lines (8687), with no line terminators
                      Category:dropped
                      Size (bytes):8687
                      Entropy (8bit):5.739104440898457
                      Encrypted:false
                      SSDEEP:
                      MD5:BFA0F92E19AD1C0CA3A98757A40FAFCC
                      SHA1:E6E408B6B1B71C7688DEAD57B1EE7562C8BFFC02
                      SHA-256:A310BDF0C5FB3D662CF64F5A9400BDC64204EAF57AD6E0FF8E59253BDFB514D1
                      SHA-512:D7C3AEFBE1EB1F283BC6D1494B1C79B1FEDA27E223E91EE6143152A1A3A7F4F5FCF6E7366445F6588395B45ACF6FF18210DB592AF9C51F021B8A61DDAB6728E5
                      Malicious:false
                      Reputation:unknown
                      Preview:window._cf_chl_opt={cFPWv:'b'};~function(W,h,i,j,o,s,z,A){W=b,function(c,d,V,e,f){for(V=b,e=c();!![];)try{if(f=-parseInt(V(242))/1+-parseInt(V(164))/2+parseInt(V(233))/3+-parseInt(V(195))/4+parseInt(V(224))/5+parseInt(V(270))/6*(-parseInt(V(163))/7)+-parseInt(V(186))/8*(-parseInt(V(230))/9),f===d)break;else e.push(e.shift())}catch(E){e.push(e.shift())}}(a,393638),h=this||self,i=h[W(216)],j=function(X,d,e,f){return X=W,d=String[X(262)],e={'h':function(E){return E==null?'':e.g(E,6,function(F,Y){return Y=b,Y(231)[Y(240)](F)})},'g':function(E,F,G,Z,H,I,J,K,L,M,N,O,P,Q,R,S,T,U){if(Z=X,E==null)return'';for(I={},J={},K='',L=2,M=3,N=2,O=[],P=0,Q=0,R=0;R<E[Z(228)];R+=1)if(S=E[Z(240)](R),Object[Z(200)][Z(181)][Z(274)](I,S)||(I[S]=M++,J[S]=!0),T=K+S,Object[Z(200)][Z(181)][Z(274)](I,T))K=T;else{if(Object[Z(200)][Z(181)][Z(274)](J,K)){if(256>K[Z(210)](0)){for(H=0;H<N;P<<=1,Q==F-1?(Q=0,O[Z(214)](G(P)),P=0):Q++,H++);for(U=K[Z(210)](0),H=0;8>H;P=P<<1|U&1,F-1==Q?(Q=0,O[Z(214)](G(P)),P=0):Q++,U>>=1,H++)

                      Chrome Cache Entry: 187

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text, with no line terminators
                      Category:downloaded
                      Size (bytes):32
                      Entropy (8bit):4.226409765557392
                      Encrypted:false
                      SSDEEP:
                      MD5:5C93A7F764F155630BD9601D168ED517
                      SHA1:FE87E4E1C5F23BCAC2136E82A3128B73EA0787B8
                      SHA-256:BF025AEAB7A252165820B7073FA6ABFD16A03E359A5F857CCBE2864887D8F703
                      SHA-512:4DCA8044D0EAC9A72E30E06E7BC6C5EBCF7402FB0FBBA41DE9FD76B54C9AA44DA757CE9FEC2F285CD5AE9C624DC6685C4449F6CAE12FF9FC6C4C0EF8BEC6EB76
                      Malicious:false
                      Reputation:unknown
                      URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAn4zwBqHfU0RBIFDYOoWz0=?alt=proto
                      Preview:ChYKFA2DqFs9GgQICRgBGgUImgEYAiAB

                      Chrome Cache Entry: 188

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:ASCII text
                      Category:downloaded
                      Size (bytes):4634
                      Entropy (8bit):5.480036073913163
                      Encrypted:false
                      SSDEEP:
                      MD5:763FAD1B6C7F1F100F3F7817A1A46BEE
                      SHA1:497713E40EA271ACBB9799D9D6ADC80DC4A4F7F2
                      SHA-256:2732ADDB6AA3B51DD9FB55A3C6D225921ED6963E928493A1F8EF64DDD312FD0E
                      SHA-512:46586336F5B664E3E0F3378D22B11879B1A0953B27026D0D8836DCB65703EBFA7811771084A520610E3FFC55206EEEEF43D90DDD0BA4C96566207D8C0C7F078B
                      Malicious:false
                      Reputation:unknown
                      URL:"https://fonts.googleapis.com/css?family=Inter:400,700"
                      Preview:/* cyrillic-ext */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2JL7SUc.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2ZL7SUc.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1pL7

                      Chrome Cache Entry: 189

                      Download File
                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                      File Type:HTML document, ASCII text, with very long lines (3686), with no line terminators
                      Category:downloaded
                      Size (bytes):3686
                      Entropy (8bit):5.378631719572775
                      Encrypted:false
                      SSDEEP:
                      MD5:D723A0415498B6B91211576DD5A62350
                      SHA1:398D2D20B010C2F3BEBEA7BA6338A59F3FA3DDE6
                      SHA-256:D1EA586C521948824740A8DC3F884B5F6741C74EE96F29BCBF9E972A48ED7C4F
                      SHA-512:E766F6E9B52C527DD09959441AFE85486520605DD9F0478A557FA93B096A518B319F0EE8A18FF927BCDF8E9B21BAF414092A78CE2595C1A5817CCD25FFCDDF1B
                      Malicious:false
                      Reputation:unknown
                      URL:https://embeds.beehiiv.com/1ac29d4e-2fb8-419c-8498-f07b405bca74
                      Preview:<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=no"><link rel="icon" href="/img/favicon.png"><link href="https://fonts.googleapis.com/css2?family=Open+Sans&amp;display=swap" rel="stylesheet"><meta name="robots" content="noindex"><script src="/variables.js" type="application/javascript"></script><script>"true"===window.env.REACT_APP_GTM_ENABLED&&function(e,t,a,n,r){e[n]=e[n]||[],e[n].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});var g=t.getElementsByTagName(a)[0],m=t.createElement(a);m.async=!0,m.src="https://www.googletagmanager.com/gtm.js?id=GTM-WJXL7FH",g.parentNode.insertBefore(m,g)}(window,document,"script","dataLayer")</script></head><body style="margin:0"><noscript>You need to enable JavaScript to run this app.</noscript><noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WJXL7FH" height="0" width="0" style="display:none;visibility:hidden"></ifra

                      Static File Info

                      General

                      File type:CDFV2 Microsoft Outlook Message
                      Entropy (8bit):6.414400232083493
                      TrID:
                      • Outlook Message (71009/1) 58.92%
                      • Outlook Form Template (41509/1) 34.44%
                      • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                      File name:possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msg
                      File size:125'440 bytes
                      MD5:44f22be45aa7a6597e01273c9a2d35ed
                      SHA1:4618e5427e37589714c9289dda123dad3588a815
                      SHA256:9bc8dbfa26e0bcc66aafa8091d8b4388f0f56a3c586abd5640099f9d80a4fd5b
                      SHA512:683ef7ee6271eebbf099881ee7837164b7170565b5d9bf27f166ad0d21b9d3d2a3860fd2eb2c924da373dda175612ce1045d6a6cfcb4fb94c5de3f672b17ff79
                      SSDEEP:3072:jcwROT1Hve/B82bCjAUgR93ov4cQt990hDcR0G8:gwROvWywCEUgH3gQt/0hDceG8
                      TLSH:F7C31A2475F94608F277EF3189F69087893A7CD2ED68964F2195330E0471D81EA63B7B
                      File Content Preview:........................>.......................................................k..............................................................................................................................................................................

                      Static Mail

                      General

                      Subject:[possible SPAM:##] Msig Insurance Europe Complete via-Sign Monday January 2025
                      From:=?UTF-8?Q?Msig Insurance Europe Online Notification?= <info@malhs.co.uk>
                      To:<christian.fink@msig-europe.com>
                      Cc:
                      BCC:
                      Date:Tue, 14 Jan 2025 07:51:32 +0100
                      Communications:
                      • Automated case information directly for christian.fink@msig-europe.com
                      Attachments:
                      • Msig Insurance Europe.pdf

                      Headers

                      Key Value
                      Receivedfrom [65.21.250.207] (65.21.250.207) by
                      DESR20008.de.msig-europe.local (2a00da9:13:1801::39) with Microsoft SMTP
                      15.2.1544.4 via Mailbox Transport; Tue, 14 Jan 2025 0751:50 +0100
                      DESR10008.de.msig-europe.local (2a00da9:13:1801::38) with Microsoft SMTP
                      15.2.1544.4; Tue, 14 Jan 2025 0751:50 +0100
                      Transport; Tue, 14 Jan 2025 0751:50 +0100
                      for <christian.fink@msig-europe.com>; Tue, 14 Jan 2025 0751:47 +0100 (CET)
                      Tue, 14 Jan 2025 0751:50 +0100 (CET)
                      Authentication-Resultsmailcc99.retarus.de; dkim=pass reason="good
                      ARC-Seali=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
                      ARC-Message-Signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
                      h=FromDate:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
                      ARC-Authentication-Resultsi=1; mx.microsoft.com 1; spf=fail (sender ip is
                      DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed;
                      by DM6PR10MB4282.namprd10.prod.outlook.com (260310b6:5:222::11) with
                      2025 0651:34 +0000
                      (260310b6:806:20::29) with Microsoft SMTP Server (version=TLS1_3,
                      14 Jan 2025 0651:34 +0000
                      X-MS-Exchange-Authentication-Resultsspf=fail (sender IP is 65.21.250.207)
                      Received-SPFFail (protection.outlook.com: domain of malhs.co.uk does not
                      via Frontend Transport; Tue, 14 Jan 2025 0651:33 +0000
                      Content-Typemultipart/mixed; boundary="===============3431075377736621667=="
                      MIME-Version1.0
                      From=?UTF-8?Q?Msig Insurance Europe Online Notification?= <info@malhs.co.uk>
                      To<christian.fink@msig-europe.com>
                      Subject[possible SPAM:##] =?UTF-8?Q?Msig Insurance Europe Complete via-Sign Monday January
                      DateTue, 14 Jan 2025 06:51:32 -0000
                      Message-ID<173683749208.12996.13617349650493360933@malhs.co.uk>
                      X-Accept-Languageen-us, en
                      X-EOPAttributedMessage0
                      X-MS-PublicTrafficTypeEmail
                      X-MS-TrafficTypeDiagnosticSN1PEPF00036F42:EE_|DM6PR10MB4282:EE_
                      X-MS-Office365-Filtering-Correlation-Id9781ec40-4abd-4e07-bf74-08dd3467e25d
                      X-MS-Exchange-SenderADCheck1
                      X-MS-Exchange-AntiSpam-Relay0
                      X-Microsoft-AntispamBCL:0;ARA:13230040|36860700013|82310400026|1800799024|376014|8096899003|7053199007;
                      X-Microsoft-Antispam-Message-Info=?utf-8?B?ZC95bjFoKzRvVjlETXNnbVFCL0JLQThSeDl6K1FkUi95ckVabHhHKzdsQ1kv?=
                      X-Forefront-Antispam-ReportCIP:65.21.250.207;CTRY:FI;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:[65.21.250.207];PTR:static.207.250.21.65.clients.your-server.de;CAT:NONE;SFS:(13230040)(36860700013)(82310400026)(1800799024)(376014)(8096899003)(7053199007);DIR:OUT;SFP:1102;
                      X-MS-Exchange-CrossTenant-OriginalArrivalTime14 Jan 2025 06:51:33.4611
                      X-MS-Exchange-CrossTenant-Network-Message-Id9781ec40-4abd-4e07-bf74-08dd3467e25d
                      X-MS-Exchange-CrossTenant-Id9db59932-68eb-45eb-854b-c226d702cfd0
                      X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIpTenantId=9db59932-68eb-45eb-854b-c226d702cfd0;Ip=[65.21.250.207];Helo=[[65.21.250.207]]
                      X-MS-Exchange-CrossTenant-AuthSourceSN1PEPF00036F42.namprd05.prod.outlook.com
                      X-MS-Exchange-CrossTenant-AuthAsAnonymous
                      X-MS-Exchange-CrossTenant-FromEntityHeaderHybridOnPrem
                      X-MS-Exchange-Transport-CrossTenantHeadersStampedDM6PR10MB4282
                      X-RMX-ID20250114-075147-CtRcnQLWLfTf-0@in12.fraix1
                      X-RMX-SOURCE40.107.93.134
                      X-RMX-TransportEncryptionestablished=true, protocol=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384 (256/256 bits)
                      X-RMX-SpamProbability=34%, Report='
                      Return-Pathinfo@malhs.co.uk
                      X-MS-Exchange-Organization-Network-Message-Id5da7c026-d83e-4bf8-8f48-08dd3467ec23
                      X-MS-Exchange-Organization-AuthSourceDESR20008.de.msig-europe.local
                      X-MS-Exchange-Organization-AuthAsInternal
                      X-MS-Exchange-Organization-AuthMechanism10
                      X-MS-Exchange-Organization-AVStamp-Enterprise1.0
                      X-MS-Exchange-Organization-AVStamp-MailboxSMEXJnq?;1983500;0;This mail has
                      X-MS-Exchange-Organization-SCL0
                      X-MS-Exchange-Transport-EndToEndLatency00:00:00.3320539
                      X-MS-Exchange-Processed-By-BccFoldering15.02.1544.004
                      dateTue, 14 Jan 2025 07:51:32 +0100

                      File Icon

                      Icon Hash:c4e1928eacb280a2