Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Invoice From LocaliQ TexasNew Mexico.msg

Overview

General Information

Sample name:Invoice From LocaliQ TexasNew Mexico.msg
Original sample name:Invoice From LouserQ TexasNew Mexico.msg
Analysis ID:1523593
MD5:c845385253f18d7a090c7295be756d8f
SHA1:2d4c34994b972a32e3024976c1dda3f8c14f4d69
SHA256:da7fdf184268007c625cb4cd27dd7245e3a7b92a769088a7a6aab9b143ef6062
Infos:

Detection

Score:3
Range:0 - 100
Whitelisted:false
Confidence:60%

Signatures

Creates a window with clipboard capturing capabilities
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Office Macro File Download
Sigma detected: Outlook Security Settings Updated - Registry
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6924 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Invoice From LouserQ TexasNew Mexico.msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 7096 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "6B6984B7-4CDD-485A-B13E-798B6801B5A8" "CFC1F71E-12C3-4C9F-993F-8C79C4959221" "6924" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • Acrobat.exe (PID: 4612 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\2P5O7RTN\0006660398.PDF" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
      • AcroCEF.exe (PID: 5868 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
        • AcroCEF.exe (PID: 3496 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1564,i,18194923039789547484,17829040019748558769,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
    • chrome.exe (PID: 7844 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.shoom.com/Invoice?q=bxry57viHQpwzylX MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 8028 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1944,i,8609625046868565975,2480471566665334248,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6924, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
Sigma detected: Office Macro File Download
Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6924, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm
Sigma detected: Outlook Security Settings Updated - Registry
Source: Registry Key setAuthor: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\2P5O7RTN\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6924, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder
Sigma detected: Office Macro File Creation
Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6924, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://www.shoom.com/Login?returnto=Invoice%3fq%3dbxry57viHQpwzylXHTTP Parser: <input type="password" .../> found
Source: https://www.shoom.com/HTTP Parser: <input type="password" .../> found
Source: https://www.shoom.com/Login?returnto=Invoice%3fq%3dbxry57viHQpwzylXHTTP Parser: No favicon
Source: https://www.shoom.com/HTTP Parser: No favicon
Source: https://www.shoom.com/Login?returnto=Invoice%3fq%3dbxry57viHQpwzylXHTTP Parser: No <meta name="author".. found
Source: https://www.shoom.com/HTTP Parser: No <meta name="author".. found
Source: https://www.shoom.com/Login?returnto=Invoice%3fq%3dbxry57viHQpwzylXHTTP Parser: No <meta name="copyright".. found
Source: https://www.shoom.com/HTTP Parser: No <meta name="copyright".. found
Source: unknownHTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49756 version: TLS 1.2
Source: chrome.exeMemory has grown: Private usage: 1MB later: 31MB
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
Source: global trafficDNS traffic detected: DNS query: www.shoom.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: apis.google.com
Source: global trafficDNS traffic detected: DNS query: play.google.com
Source: global trafficDNS traffic detected: DNS query: shoom.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49863
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 49863 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49857 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49855 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49856 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
Source: unknownNetwork traffic detected: HTTP traffic on port 49865 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownHTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49756 version: TLS 1.2
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow created: window name: CLIPBRDWNDCLASS
Source: classification engineClassification label: clean3.winMSG@41/73@13/128
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241001T1412000004-6924.etl
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Invoice From LouserQ TexasNew Mexico.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "6B6984B7-4CDD-485A-B13E-798B6801B5A8" "CFC1F71E-12C3-4C9F-993F-8C79C4959221" "6924" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\2P5O7RTN\0006660398.PDF"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1564,i,18194923039789547484,17829040019748558769,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "6B6984B7-4CDD-485A-B13E-798B6801B5A8" "CFC1F71E-12C3-4C9F-993F-8C79C4959221" "6924" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 56CB6AA0EFE3B350229576FAC2FCB9CB
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.shoom.com/Invoice?q=bxry57viHQpwzylX
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1944,i,8609625046868565975,2480471566665334248,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\2P5O7RTN\0006660398.PDF"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.shoom.com/Invoice?q=bxry57viHQpwzylX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1564,i,18194923039789547484,17829040019748558769,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1944,i,8609625046868565975,2480471566665334248,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote Services1
Clipboard Data		2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		1
Process Injection		LSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		Security Account Manager14
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Extra Window Memory Injection		1
Extra Window Memory Injection		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
plus.l.google.com
142.250.186.46
truefalse
    		unknown
    play.google.com
    		142.250.186.46
    		truefalse
      		unknown
      shoom.com
      		34.206.221.44
      		truefalse
        		unknown
        www.google.com
        		142.250.185.132
        		truefalse
          		unknown
          www.shoom.com
          		34.206.221.44
          		truefalse
            		unknown
            x1.i.lencr.org
            		unknown
            		unknownfalse
              		unknown
              apis.google.com
              		unknown
              		unknownfalse
                		unknown

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                https://www.shoom.com/false
                  		unknown
                  https://www.shoom.com/Login?returnto=Invoice%3fq%3dbxry57viHQpwzylXfalse
                    		unknown

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    142.250.186.46
                    		plus.l.google.comUnited States
                    		15169GOOGLEUSfalse
                    184.28.88.176
                    		unknownUnited States
                    		16625AKAMAI-ASUSfalse
                    20.189.173.3
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    54.227.187.23
                    		unknownUnited States
                    		14618AMAZON-AESUSfalse
                    142.250.181.234
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    216.58.206.35
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    162.159.61.3
                    		unknownUnited States
                    		13335CLOUDFLARENETUSfalse
                    52.109.32.97
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    23.41.168.139
                    		unknownUnited States
                    		6461ZAYO-6461USfalse
                    172.217.16.142
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    142.250.186.138
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    52.113.194.132
                    		unknownUnited States
                    		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    1.1.1.1
                    		unknownAustralia
                    		13335CLOUDFLARENETUSfalse
                    142.250.186.163
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    74.125.71.84
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    142.250.185.132
                    		www.google.comUnited States
                    		15169GOOGLEUSfalse
                    2.23.197.184
                    		unknownEuropean Union
                    		1273CWVodafoneGroupPLCEUfalse
                    93.184.221.240
                    		unknownEuropean Union
                    		15133EDGECASTUSfalse
                    2.19.126.151
                    		unknownEuropean Union
                    		16625AKAMAI-ASUSfalse
                    239.255.255.250
                    		unknownReserved
                    		unknownunknownfalse
                    142.250.185.195
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    34.193.227.236
                    		unknownUnited States
                    		14618AMAZON-AESUSfalse
                    34.206.221.44
                    		shoom.comUnited States
                    		14618AMAZON-AESUSfalse
                    52.109.76.243
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    52.109.76.144
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

                    Private

                    IP
                    192.168.2.16

                    General Information

                    Joe Sandbox version:41.0.0 Charoite
                    Analysis ID:1523593
                    Start date and time:2024-10-01 20:11:34 +02:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:defaultwindowsinteractivecookbook.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:21
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • EGA enabled
                    Analysis Mode:stream
                    Analysis stop reason:Timeout
                    Sample name:Invoice From LocaliQ TexasNew Mexico.msg
                    Original Sample Name:Invoice From LouserQ TexasNew Mexico.msg
                    Detection:CLEAN
                    Classification:clean3.winMSG@41/73@13/128
                    Cookbook Comments:
                    • Found application associated with file extension: .msg

                    Warnings

                    • Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
                    • Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 52.109.76.243, 2.19.126.151, 2.19.126.160
                    • Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, eur.roaming1.live.com.akadns.net, neu-azsc-000.roaming.officeapps.live.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, s-0005.s-msedge.net, config.officeapps.live.com, osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com, officeclient.microsoft.com, ecs.office.trafficmanager.net, ukw-azsc-config.officeapps.live.com, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, a1864.dscd.akamai.net
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size getting too big, too many NtQueryAttributesFile calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • Report size getting too big, too many NtReadVirtualMemory calls found.
                    • Report size getting too big, too many NtSetValueKey calls found.
                    • VT rate limit hit for: Invoice From LouserQ TexasNew Mexico.msg

                    LLM Input / Output

                    InputOutput
                    URL: Email Model: jbxai
                    {
"brand":["Shoom"],
"contains_trigger_text":true,
"trigger_text":"Open the link to see your invoice",
"prominent_button_name":"unknown",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":true,
"has_visible_qrcode":false}
                    URL: https://www.shoom.com/Login?returnto=Invoice%3fq%3dbxry57viHQpwzylX Model: jbxai
                    {
"brand":["Shoom"],
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"Login",
"text_input_field_labels":["Username",
"Password"],
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}
                    URL: https://www.shoom.com/ Model: jbxai
                    {
"brand":["Shoom",
"El Tiempo",
"Town News",
"Ankeny Register & Press Citizen"],
"contains_trigger_text":true,
"trigger_text":"Shoom eSolutions is the largest cloud based advertising management platform.",
"prominent_button_name":"Login",
"text_input_field_labels":["Username",
"Password"],
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}

                    Created / dropped Files

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:ASCII text
                    Category:dropped
                    Size (bytes):287
                    Entropy (8bit):5.126253482817438
                    Encrypted:false
                    SSDEEP:
                    MD5:AC999F21E029938B896847B981761BCF
                    SHA1:40AC177CAF7D7DB0DDB922C44A4EE68C0ED8C261
                    SHA-256:03059BB90515F20D586C63D14C2E29BFABC222D6CA518D6DA58A2708B73F7428
                    SHA-512:135BD3D1AB5A34FC1EDB0CB57E4D1971BE5532CDD8EF3FB0F673711834F947F56146F06B4D3A8404D65B505F1619263E07E5B06589D70CFB5433416F049D8C55
                    Malicious:false
                    Reputation:unknown
                    Preview:2024/10/01-14:12:14.259 f44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/01-14:12:14.261 f44 Recovering log #3.2024/10/01-14:12:14.262 f44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:ASCII text
                    Category:dropped
                    Size (bytes):331
                    Entropy (8bit):5.127921820949527
                    Encrypted:false
                    SSDEEP:
                    MD5:D5AF161C27DF77D9340D6BF3B97D2D34
                    SHA1:55AA801366B1F9589D8926AB59CB73B22B063E13
                    SHA-256:6B7A575EFE1BC12B92A0D1A2AF22A06FCE7E55C8A2DF23E139857038572775B6
                    SHA-512:E1839AF913818FC10FD6A2FD590B59F135BC0C0C734AD61333C494285EAFE077721DFE5C43F8B3765BE22EE258EFC0AA2BC9E249767E0158578EAD04883FD3C5
                    Malicious:false
                    Reputation:unknown
                    Preview:2024/10/01-14:12:14.163 888 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/01-14:12:14.168 888 Recovering log #3.2024/10/01-14:12:14.168 888 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8825d7ff-1769-458c-87a7-3eaa7445a050.tmp

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:JSON data
                    Category:modified
                    Size (bytes):403
                    Entropy (8bit):4.953858338552356
                    Encrypted:false
                    SSDEEP:
                    MD5:4C313FE514B5F4E7E89329630909F8DC
                    SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                    SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                    SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                    Malicious:false
                    Reputation:unknown
                    Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9605d57f-6c71-472d-baff-e9fb6d62c4af.tmp

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):403
                    Entropy (8bit):4.968764232237966
                    Encrypted:false
                    SSDEEP:
                    MD5:0ABB6A573A116E8EC8D5E006CD8143AE
                    SHA1:6235D635566ED334D0B4DD92694D2A41091BF67D
                    SHA-256:D63EEBFB167D22A48D6FB1FCA77EDE567EC33E2FC0B445F41503D1C1E14D421B
                    SHA-512:AA012D4114536080EEC8818AB8C785B3A3A6C0498EFF548AC289BC753994AAA949F0558231CCB2C339E927782891960C8F1655E75CF5F733747F9C7298B1A11D
                    Malicious:false
                    Reputation:unknown
                    Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372366349864629","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124934},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):0
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:
                    MD5:4C313FE514B5F4E7E89329630909F8DC
                    SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                    SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                    SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                    Malicious:false
                    Reputation:unknown
                    Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF453e70.TMP (copy)

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):0
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:
                    MD5:4C313FE514B5F4E7E89329630909F8DC
                    SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
                    SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
                    SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
                    Malicious:false
                    Reputation:unknown
                    Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):4099
                    Entropy (8bit):5.235269504258681
                    Encrypted:false
                    SSDEEP:
                    MD5:96592C4A89D5BC36E213F8C49AF52A01
                    SHA1:24AF476915C2AEE962A0C1D5AAC3C7784ECC2D72
                    SHA-256:D1D76A6AF89101BC071156ED47525C1589F64D7C372AF2373C7AADE8AC5BF6C9
                    SHA-512:B1B741884E4FD89F642B8BE2C6319B1015DB797DEECFBEA9FA3AF0D9E18D23168D1512A6622B92DAB583573352E4B463CBC3133DB6AAF80C2B6BA07FCEB14797
                    Malicious:false
                    Reputation:unknown
                    Preview:*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

                    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:ASCII text
                    Category:dropped
                    Size (bytes):319
                    Entropy (8bit):5.169284739314073
                    Encrypted:false
                    SSDEEP:
                    MD5:1B51BFD0D4D35FD9159C147094C9B84B
                    SHA1:7032907D1E02C7D5948AC26801BF2180042742BA
                    SHA-256:EEE705FF62558A59D1F068D71F71773EE23BEC3DA9A6D40E3EFF4228740C44E8
                    SHA-512:FF98E51BB9099C1B1F9A698DD1D2D05C7998FA3BA5B93D4BEAB5879B632C4C938A788EEEBEFEB150DDEBDA798CC650A6B9E6EFF40B1304F1C98298C57824D39F
                    Malicious:false
                    Reputation:unknown
                    Preview:2024/10/01-14:12:14.295 888 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/01-14:12:14.297 888 Recovering log #3.2024/10/01-14:12:14.298 888 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241001181228Z-489.bmp

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                    Category:dropped
                    Size (bytes):71190
                    Entropy (8bit):2.39353618942636
                    Encrypted:false
                    SSDEEP:
                    MD5:1CAF2D6D6D37E246CBF37FC6CC5E792A
                    SHA1:80BE758EFB559F4FCD24E61FEBA99A530E575AC2
                    SHA-256:3A955833181427B6604CCBFB4119B723155BFD9D31BC3574A6EC88F3635ED8E3
                    SHA-512:F8500DFE2AA7C61B02042A7E6BE362A1812EA81D4AF94278C4A609C07650B29076342AC8591F7F93530BF4B3761C520303AFF0AF83AE680BE0964917F741C116
                    Malicious:false
                    Reputation:unknown
                    Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                    Category:dropped
                    Size (bytes):57344
                    Entropy (8bit):3.291927920232006
                    Encrypted:false
                    SSDEEP:
                    MD5:A4D5FECEFE05F21D6F81ACF4D9A788CF
                    SHA1:1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
                    SHA-256:83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
                    SHA-512:FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
                    Malicious:false
                    Reputation:unknown
                    Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:SQLite Rollback Journal
                    Category:dropped
                    Size (bytes):16928
                    Entropy (8bit):1.2160291275063095
                    Encrypted:false
                    SSDEEP:
                    MD5:BA76CDE5A8552027A14A415E0F454565
                    SHA1:3EA9FB33FB5DE578C9FC61FA5306A713BEE5C85F
                    SHA-256:999FE6957744B60D104B82C708C740C8F3B1C229A8200B825DBBB0C30F20855C
                    SHA-512:5B52BAB978082AB8C08F3C70BC4A9D55B672F24A05FEDA903B398E29D77A109F48382E558D7CAF8D31D1A7BE49740216597BA2233D04DFC5ADDC16995F52AEE5
                    Malicious:false
                    Reputation:unknown
                    Preview:.... .c.....%z.Z........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:Certificate, Version=3
                    Category:dropped
                    Size (bytes):1391
                    Entropy (8bit):7.705940075877404
                    Encrypted:false
                    SSDEEP:
                    MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                    SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                    SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                    SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                    Malicious:false
                    Reputation:unknown
                    Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                    Category:dropped
                    Size (bytes):71954
                    Entropy (8bit):7.996617769952133
                    Encrypted:true
                    SSDEEP:
                    MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                    SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                    SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                    SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                    Malicious:false
                    Reputation:unknown
                    Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):192
                    Entropy (8bit):2.73533016978716
                    Encrypted:false
                    SSDEEP:
                    MD5:F4A7DBFBBEBFE405FEFE0A3EB0EDCE70
                    SHA1:F2A6574767F7F9D12FF25796AF1AB191D0B07D2D
                    SHA-256:6476B8D1B3DD24E5DA22CE702F48F17F2452E90DA0B2683DD931D7DCA02D5CD7
                    SHA-512:45669065929B9D895499BFF5CEDC113DB3E2CC33BCDA14C467BFE1E5E25D6E559F3A48E8F0D4637E1409E3CFDB55A86A6B4A587DA494811D54D0BCEB3964E452
                    Malicious:false
                    Reputation:unknown
                    Preview:p...... .........8.z-...(....................................................... ..........W....M...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:data
                    Category:modified
                    Size (bytes):328
                    Entropy (8bit):3.150184159866505
                    Encrypted:false
                    SSDEEP:
                    MD5:0B04422290899118E14C5D18B8F1FF87
                    SHA1:AB7CACB97CD8868804F8024EC83995F0ACDF1A8B
                    SHA-256:F4F09137520AE17CAFB8EBEC4503185C0CF212282E13105C55963661909775B8
                    SHA-512:E8CD6F8FF24653DBEAF732AB6D0C50C56D8BFFFA989F9CC88491984CEFEA2CF98DF7D4F7720A28DCF400C4E799A39CE8B33C6F668A742C37B1CB4226A6E27612
                    Malicious:false
                    Reputation:unknown
                    Preview:p...... ........[6q.-...(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):295
                    Entropy (8bit):5.392402733408855
                    Encrypted:false
                    SSDEEP:
                    MD5:090A2120D68636A92A0E1D52DDF45D48
                    SHA1:8B3A6DF935D22F2EEDF27FEFAA58705DFF59B61C
                    SHA-256:94112E129882FE174CC06447845FE97259D9749FE5634A3EEDF32FADEBD678EA
                    SHA-512:0EED583676C1A8D03B463777DA966D7ACC09C1895B8336E962B71EE3C329F3E75113B61897247BBCBA9B94D4729CCE80D049B0168362B3FBA3F80155B71E3AA4
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):294
                    Entropy (8bit):5.342248364713122
                    Encrypted:false
                    SSDEEP:
                    MD5:9079181D95D4E9F2B5F198317272150E
                    SHA1:0FFCFBA8847EB72383FCA128AE306437D563E46A
                    SHA-256:FC29B301ACEDE5BB6D57158CD54237F11D14E852AB03FC4822EAE7A6AC8367FA
                    SHA-512:543D0E4DCA567887A00B418D66E1CDC45505F74265696173EE2F97BF0E030D66400013494E1041BE6F57ACE4303CE099103F8C238EC6CB818E51D18AEFE5C48D
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):294
                    Entropy (8bit):5.320647683581552
                    Encrypted:false
                    SSDEEP:
                    MD5:E0F5DE2D8C92BE4080C7A240F3622384
                    SHA1:C8A34E402FFE839E6BAEF231E583B4CA1B5F7F2F
                    SHA-256:319CC309BE42DEB16F3A1364B9A685A4178CFB448D5239715A60E23D8EE7BE06
                    SHA-512:6264F643ABBFCAB9F3724AE534C9AD005E131FE5098C2EB4CB694EEE6777080579FABE55DBC459C69D91FAA269F4F4A6273AA687F0E50D47BF8866D3C3C692BB
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):285
                    Entropy (8bit):5.381801846609208
                    Encrypted:false
                    SSDEEP:
                    MD5:030607F8C4407D801F9169AD5BBFD6C0
                    SHA1:3C048FE99019AB9DA4FEBF5640FA7042598ACFFB
                    SHA-256:EF84B79809133450DC828669DD9B18E0899A3D77CD1FF90EAD87912E53A14B59
                    SHA-512:3AD8B908C664122C2325350D424BF4C3BDA920EF4BCA56C543A9E330AF945BCAE7ABFC77C8E7E14999CC4E9A34B0F71D33A0A15F4BD42A5E815E97DE7DB52BCC
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):1063
                    Entropy (8bit):5.671286766137359
                    Encrypted:false
                    SSDEEP:
                    MD5:736C920233C7327779BD4A9194FB9F27
                    SHA1:405E1F56B0D36011407365354A018D0CC7299840
                    SHA-256:D47664FE8CD1E2DFA7AF3122F569566C5DF8785CDE7B6D1F992833EA75768D16
                    SHA-512:D834F9B9608C8993A79840D16BA0F889A697EDB266EFAD7FDF04D2A5488189F8F2B28063EA9679532A3458159FAEAE172F05435A050579DFF316119A285B2CDF
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_2","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"afb9c2a3-eaf4-41f9-9d73-768e72f72282","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgZmlsZXMgdG8gYW5kIGZyb20gUERGXG53aXRob3V0IGxpbWl0cy4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingSc

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):1050
                    Entropy (8bit):5.658295257269002
                    Encrypted:false
                    SSDEEP:
                    MD5:C361424D79E1FEADCB6804EC8358B45C
                    SHA1:9B5C3E79ACAB0787A49D590D2B55F69B125BC145
                    SHA-256:99F61A35CE9BBF52BFD361B61A304AC1BDBB08133522A3F9088EC9157CD10F7F
                    SHA-512:E1962844327F241148881A9020C8EC6D455305D0EFF15EC7ABB833446C2FAB6248AA85FA1BF706AD80269169CA923A5F4D6C4CAE8FEA047C71770DE15FFEE99E
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):292
                    Entropy (8bit):5.3338860978182705
                    Encrypted:false
                    SSDEEP:
                    MD5:1B8C36CE8AE73AEDDF8ABE02EA4BF225
                    SHA1:0D11BC2B5EC86A73E66FBF3DE500FFA181E18782
                    SHA-256:5DD62BCB9EF7DBE5F0D082418DFF611F6ED5CFB3CF5FDA2D6E95C7DFEACDA2AF
                    SHA-512:EECEF2775184F902C3902E55C80867476BE03B8463D0C54EC8FE9FB047E5E4C766679D22453B890057B89DA66CC215D5B3962FA201910886407528FE631B58B9
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):1038
                    Entropy (8bit):5.6546944724131585
                    Encrypted:false
                    SSDEEP:
                    MD5:FFE9D87D43132597EE2B0681A51EDE85
                    SHA1:FF3AF4917C7DA952EC66E17BBA32E88740A840A9
                    SHA-256:689BB6E3C49D756AE3CA6B50AC1DBCE977F3CC165F3104BABA240E45990934CB
                    SHA-512:387966B941989AD3A4ED324B0AFDB17AB56642A987FAD4513D23E5070656DBF18998BD3A0A5F82BB3729746FC4E1CF9D0777F630DEB808BAA825B52C52C825EA
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):1164
                    Entropy (8bit):5.704773793544729
                    Encrypted:false
                    SSDEEP:
                    MD5:85B80C0F310112E325B24B903901CBC6
                    SHA1:C2A04D96BC2F0ECF7C90790000702018785FAB54
                    SHA-256:194C3F5DADD09FB771EC10E5D8D7738730254C380766D3A1F2477B42EE6467C8
                    SHA-512:508B10F85349E755944999047CA67109AA6F9FA5EC15F52C7F2A25C155C63088B6F2987657845E29DA340CCE5DEB5B972012DB4235020AEF0E924319E250777F
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):289
                    Entropy (8bit):5.337348715534718
                    Encrypted:false
                    SSDEEP:
                    MD5:5A5E7D68AFBFB99C34512BDC66722F19
                    SHA1:C62F95FF9C023B521010CBF0A5F22181F82E4776
                    SHA-256:18F80A3CF1A7C521BD1370BD5C15EBC57C31F8514B6D329B71C2076D7CA8EB3D
                    SHA-512:60D98D1B4E4F47A498CB65AA328AA0CC86994DF822F8053BF9EDB90A946910477F74DE9D2B9344B98A74C3ACF2E97E00E581E584A38EC7BEA267DE35A2BF8C6E
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):1395
                    Entropy (8bit):5.774908621229549
                    Encrypted:false
                    SSDEEP:
                    MD5:B90FE6E6D313B30B3B9284B4CDD678C9
                    SHA1:144492E11365F0551A14E3DD086A32EA781A1B73
                    SHA-256:DD289880A23A6179765940FADE5246E0ED2AEE9607E4CEB9B54ABE68613710F1
                    SHA-512:4A39D519E730BE6AF08744B7BCD2B6752B788316E930198A3B89F368D8662A57D44C9E579647C8FF05AE20F91B2884E8C323CB1AF52FE138C505B3C10827F869
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):291
                    Entropy (8bit):5.320639121005594
                    Encrypted:false
                    SSDEEP:
                    MD5:913BD7D8962E32E7277590113E98598A
                    SHA1:3AB726C06E776DF7AFED56A5850D3F8E59814D1D
                    SHA-256:4AFD5D258BB997DA6A470FDA4F0EF3B4505AB2C7F562FC81EB0D24ECB19AF2F5
                    SHA-512:EBEC2723FA4D7B9C9EBDC112594773F05547A540F6774109BE3EA723A1B7C2625D0408FDCE0A40A7700A9E7CFE46639DA4FEE3FFC02B67908126A55153E3F978
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):287
                    Entropy (8bit):5.324537403316825
                    Encrypted:false
                    SSDEEP:
                    MD5:DFCFC6E6425176D3F72854B88A9CF806
                    SHA1:FEBEFCB1FA8DBEDC40816E7085E67FAFB2755FB7
                    SHA-256:1CC98895C9F63B9FA0A25ED8EA6E7CB6CCC625B1C2D2BF5583495402177A9C42
                    SHA-512:D19641DB00BB2388FC072181FC697805B71D1BE25CB2A368A639F1F320567CE283877A3106A2E8DDD3B839F4C033F8CF83B5B15291D08881C780239A9F6BC4A4
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):1058
                    Entropy (8bit):5.661146444036772
                    Encrypted:false
                    SSDEEP:
                    MD5:22817F6D2CB5F7DB488AA2D60D0EF3CD
                    SHA1:AC586BA1368BD3B04405C57139AD333C94210D08
                    SHA-256:BF078E6D2120137A11199010B730A2266B977309837F5A1B6815D98E368C8BC1
                    SHA-512:4C44C50657715DAB069F550C11F7DEB1BD53DAEB894E5CF61A72E83D70C7B54CEFC3373A697CD26727DD31C58C893B06EEF086E6CFE2F7E07DB6F2803F9B9418
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_3","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"ece07729-7db6-4f20-9f8d-7976ad373049","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlNlbmQgZG9jdW1lbnRzICYgZm9ybXNcbmZvciBmYXN0IGUtc2lnbmluZyBvbmxpbmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme"

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):286
                    Entropy (8bit):5.299693428297955
                    Encrypted:false
                    SSDEEP:
                    MD5:50CC8988AAA24817A8DE30234EA15FD7
                    SHA1:17808021D8B3F508E0FFA930CD7060F539989789
                    SHA-256:FED1E68EA39511866179D154076AFACB9B121065BD3BBCE57DC2268AC787C6AF
                    SHA-512:A33AF4E57B6F4663318C7094E16A7A888985D013BB7E8A56AA5B7358004AB46CFCAEA2A25652F26D1DB513C6AD039A6D3CB26A53C232545F0E67E16B1C9E4851
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):782
                    Entropy (8bit):5.376452862094446
                    Encrypted:false
                    SSDEEP:
                    MD5:181CAC26BD52C81BAE32168FBE55DC7C
                    SHA1:4D0389D086BE9942D87A15FAEEDCC18DD0288586
                    SHA-256:8C14F3933902CA7C6E12A270BE860C200205E899921BC37DED5ACCAD51C5C275
                    SHA-512:B778976B60E90A06984BB40F9423960CA03ADAD698FED978C89A1D0402001B35321055E2B5EB3C608A66CA4AA2164C948535F23F3DDB2A2B8F663A6B1CEF3B74
                    Malicious:false
                    Reputation:unknown
                    Preview:{"analyticsData":{"responseGUID":"8bf962dc-a230-4399-b223-2f4d4af80939","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1727983336315,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1727806351349}}}}

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):4
                    Entropy (8bit):0.8112781244591328
                    Encrypted:false
                    SSDEEP:
                    MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                    SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                    SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                    SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                    Malicious:false
                    Reputation:unknown
                    Preview:....

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):2818
                    Entropy (8bit):5.1364288329999255
                    Encrypted:false
                    SSDEEP:
                    MD5:D6C2811B2E4ED657F5E8C7F9E371128F
                    SHA1:608264014C277E55D6F7C69EF9E9C894DBD366FE
                    SHA-256:FF7BEAEB8E4B10936ED47DEB91801D645B7DB806231A4FDFD3009F10FB433428
                    SHA-512:D256FE8BBC8B19758D54179D865BDF78565D2859ABB9CC16662FB865A677283FC2D0B8EC48C68B9A5CB23458796FF72D06E5AB79B713B4F8383B15D39C265DDA
                    Malicious:false
                    Reputation:unknown
                    Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c863d7258c63ab0483b25ccf77f36864","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1727806350000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"cadf2c0460733c2fe58f9725dcf1dc6c","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1727806350000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f5a594308591b5382fd0d6795e8b9b3a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1058,"ts":1727806350000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"1d09595f4b0513d9e9bf256b9e005a14","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1063,"ts":1727806350000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"362d9c2a7066d05ee0342d5d35909eba","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1727806350000},{"id":"Edit_InApp_Aug2020","info":{"dg":"9afb7a4bc4b124c51eff0a2f4702b1cd","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
                    Category:dropped
                    Size (bytes):12288
                    Entropy (8bit):0.9884323399921464
                    Encrypted:false
                    SSDEEP:
                    MD5:5846E7B845F766129698657689BCB91D
                    SHA1:65C2A5F3DDFE1BCEA66A9B3E42D2F08230A58F6D
                    SHA-256:771828B100480910CE91CFBC4A24BC66754CECCD0F7D93306E79E839EBAEAFA3
                    SHA-512:C200E255F313A3FBFC9DB06AF31A4E5D41A06BA34E9AC4ADA2A1D9988FC15962E60E153FFA35F13FECBB345498463ABB83E21C1B4C6F9E44B055F40F5CC25D4C
                    Malicious:false
                    Reputation:unknown
                    Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:SQLite Rollback Journal
                    Category:dropped
                    Size (bytes):8720
                    Entropy (8bit):1.3431767641922439
                    Encrypted:false
                    SSDEEP:
                    MD5:538A5BEC5D3DA5FBB1B79A96445EC047
                    SHA1:4177A03F979FA479665FCC797B34543306BFAB70
                    SHA-256:990BEB37DAEC81DBFC5ADDD0D8E80CEF91EFFC71B9CE65A455212DD40524B8E8
                    SHA-512:7C9F51A2519DDBB3C929C4E564899A0B30D56E8E241FBBD9B3DD28B5DEB7C5DBD5FD81434626121F25CB49F29E02005CF91EE995D3B3E58ABFBE1C77FFD507EF
                    Malicious:false
                    Reputation:unknown
                    Preview:.... .c.......a.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):231348
                    Entropy (8bit):4.384773683549304
                    Encrypted:false
                    SSDEEP:
                    MD5:912FE8980D0A58702FB0E5765E5EFB4C
                    SHA1:06912BA2703179D19994E727344DFBA5AC04DA89
                    SHA-256:111C011B0F039995D716BD67C74AF52942E92F0065901A0DA2582F4D2D8802D8
                    SHA-512:12F5F81557FFECCA05111852FCB1F79B5E52674692DAD9CC759B535387152013C11BFFE46F54D0B293C38C8B333B7E9315A72B663D2E788A2F8968F9F0D6999B
                    Malicious:false
                    Reputation:unknown
                    Preview:TH02...... .@7.`-.......SM01X...,...`n._-...........IPM.Activity...........h...............h............H..h.O........_...h........@=..H..h\cal ...pDat...hh...0...@.O....h..n6...........h........_`Pk...h^.n6@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k5.5.....6.5...!h.............. h>..1....X.O...#h....8.........$h@=......8....."hX............'h.._...........1h..n6<.........0h....4....Uk../h....h.....UkH..h8...p....O...-h .........O...+h..n6.....O......... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:ASCII text, with very long lines (65536), with no line terminators
                    Category:dropped
                    Size (bytes):322260
                    Entropy (8bit):4.000299760592446
                    Encrypted:false
                    SSDEEP:
                    MD5:CC90D669144261B198DEAD45AA266572
                    SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                    SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                    SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                    Malicious:false
                    Reputation:unknown
                    Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):10
                    Entropy (8bit):2.9219280948873623
                    Encrypted:false
                    SSDEEP:
                    MD5:74CA424E46024CADE6212A2F09D83689
                    SHA1:08EF02691B2401B23C3CB79CAB4370707F41D344
                    SHA-256:D8BA4C3F41E8D7332DA3F312DFECF704F3769FE137A735B749ADEB4690A7235C
                    SHA-512:549ECD7B48DF19745279F014F62E22266D9CA20E8DF304DE6E90A78128C1A4BF51607C40484126505E47DA71441A0809DEE90A9080E05CCAB2229A3C25DB62F2
                    Malicious:false
                    Reputation:unknown
                    Preview:1727806324

                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.CampaignStates.json

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):1538
                    Entropy (8bit):5.170046666246265
                    Encrypted:false
                    SSDEEP:
                    MD5:F903C4A051E8AA36E9E085B08D1BC55E
                    SHA1:FF9AF9BBA28D4F3FF2238A64425CABE8123250AB
                    SHA-256:59D97433D58543D3CAE4BFDF9AC0DC6990A99BFB10D118B0D62D32DA15D30968
                    SHA-512:7B9A526C71B8DF94CF6556AB827C07E2265ACF6F81B4A12B3303ACCD6601C92735ECAA0F4AD5DC054FD1E7EA19B29FC220F41213822CD04E71DC27FDA8C9027B
                    Malicious:false
                    Reputation:unknown
                    Preview:{"CampaignStates":[{"CampaignId":"398f8b35-ef06-4a2b-a5dc-d85540d6fff3","LastNominationTimeUtc":"2023-10-06T09:25:18Z","LastNominationBuildNumber":"16.0.16827.20130","DeleteAfterSecondsWhenStale":31536000,"ForceCandidacy":false,"IsCandidate":true,"DidCandidateTriggerSurvey":false,"LastSurveyActivatedTimeUtc":"1601-01-01T00:00:00Z","LastSurveyId":"7e1f72bd-2c13-423b-93cf-2786588bccbb","LastSurveyStartTimeUtc":"2023-10-06T09:25:18Z","LastSurveyExpirationTimeUtc":"2024-10-05T09:25:18Z","LastCooldownEndTimeUtc":"1601-01-01T00:00:00Z"},{"CampaignId":"8a42827d-29d2-473e-998e-3217724c5b68","LastNominationTimeUtc":"2023-10-06T09:25:18Z","LastNominationBuildNumber":"16.0.16827.20130","DeleteAfterSecondsWhenStale":31536000,"ForceCandidacy":false,"IsCandidate":true,"DidCandidateTriggerSurvey":false,"LastSurveyActivatedTimeUtc":"1601-01-01T00:00:00Z","LastSurveyId":"0bb7f335-0b8a-4926-bb93-540e4e5b86c8","LastSurveyStartTimeUtc":"2023-10-06T09:25:18Z","LastSurveyExpirationTimeUtc":"2024-10-05T09:25

                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.GovernedChannelStates.json

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):740
                    Entropy (8bit):4.578658879460996
                    Encrypted:false
                    SSDEEP:
                    MD5:439A34DE8DA5C04AF25AADB84A2120D4
                    SHA1:F12F9FF6E03A5762BD03061557029446680B1DAE
                    SHA-256:32B560C75C25C6F56C0439F67A3FA7D4F271F07B435EE41575A3D82C6C612880
                    SHA-512:BE704CD0DF8041945D16B8103135650B33D5E97D6F7C202E9C9499C3AE57E33855C2CC3A8F73B578DB482F47026C756F1FAA411A2CC58B5E53CE23CD24229834
                    Malicious:false
                    Reputation:unknown
                    Preview:{"ChannelStates":[{"ChannelType":0,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":1209600},{"ChannelType":1,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":0},{"ChannelType":2,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":0},{"ChannelType":3,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":3600},{"ChannelType":4,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":10800},{"ChannelType":5,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":7776000},{"ChannelType":6,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":1800},{"ChannelType":7,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":0},{"ChannelType":8,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":1209600}]}

                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.Settings.json

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):87
                    Entropy (8bit):4.576828956814449
                    Encrypted:false
                    SSDEEP:
                    MD5:E4E83F8123E9740B8AA3C3DFA77C1C04
                    SHA1:5281EAE96EFDE7B0E16A1D977F005F0D3BD7AAD0
                    SHA-256:6034F27B0823B2A6A76FE296E851939FD05324D0AF9D55F249C79AF118B0EB31
                    SHA-512:BD6B33FD2BBCE4A46991BC0D877695D16F7E60B1959A0DEFC79B627E569E5C6CAC7B4AD4E3E1D8389A08584602A51CF84D44CF247F03BEB95F7D307FBBA12BB9
                    Malicious:false
                    Reputation:unknown
                    Preview:{"ShouldFloodgateTakePrecedenceOverRateAndReview":false,"AreRatingSurveysEnabled":true}

                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.SurveyEventActivityStats.json

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):14
                    Entropy (8bit):3.378783493486176
                    Encrypted:false
                    SSDEEP:
                    MD5:6CA4960355E4951C72AA5F6364E459D5
                    SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                    SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                    SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                    Malicious:false
                    Reputation:unknown
                    Preview:{"Surveys":{}}

                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\D035570F-6A46-4DE3-ACDF-DAB6753B00B1

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):177088
                    Entropy (8bit):5.286720435659269
                    Encrypted:false
                    SSDEEP:
                    MD5:A51C48C98D85D9F30F33AC29F041AF90
                    SHA1:4D3B3A2A9E4FED6D74A942C6700A9DD30CF50F11
                    SHA-256:EDB7B3641CE5223EBD1362BBE8F95B05DEFACCB0E6792AF7ABBD585B9E502115
                    SHA-512:C5DE453D15981D3A23E2A9D6C79F53F086A6DCCAA3447AD5CA17F32BC027B8DDB2F356E2EA3CE8D0B45FA9DB7966CAA99812DD8AED1C97D9C7CEFC2DE1524EAC
                    Malicious:false
                    Reputation:unknown
                    Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-01T18:12:02">.. Build: 16.0.18112.40129-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:SQLite 3.x database, last written using SQLite version 3034001, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
                    Category:dropped
                    Size (bytes):4096
                    Entropy (8bit):0.09304735440217722
                    Encrypted:false
                    SSDEEP:
                    MD5:D0DE7DB24F7B0C0FE636B34E253F1562
                    SHA1:6EF2957FDEDDC3EB84974F136C22E39553287B80
                    SHA-256:B6DC74E4A39FFA38ED8C93D58AADEB7E7A0674DAC1152AF413E9DA7313ADE6ED
                    SHA-512:42D00510CD9771CE63D44991EA10C10C8FBCF69DF08819D60B7F8E7B0F9B1D385AE26912C847A024D1D127EC098904784147218869AE8D2050BCE9B306DB2DDE
                    Malicious:false
                    Reputation:unknown
                    Preview:SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:SQLite Rollback Journal
                    Category:dropped
                    Size (bytes):4616
                    Entropy (8bit):0.1384465837476566
                    Encrypted:false
                    SSDEEP:
                    MD5:9D607DF1E6DDF032AC706B5293F0E35A
                    SHA1:9D79148C7034C7EC760776929B10CF3EAC2B0100
                    SHA-256:66CB5E409816B88541C119EB76933E049860677A30C3C2A93D6990479512F56E
                    SHA-512:4F06564D4BD3DFA009BE9DE78089465EE38286756DE92660B06D5E9A73247904CC6A6282280B67E04947ADAD6EFAC44F66CFB755ED829B464A147B79AEA02B1F
                    Malicious:false
                    Reputation:unknown
                    Preview:.... .c.....,......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K.................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):32768
                    Entropy (8bit):0.0441720588658491
                    Encrypted:false
                    SSDEEP:
                    MD5:3E7697563B7E68E7C4765039FD7EC60C
                    SHA1:394845C3957E39B9C824314D8976E3C135A823CC
                    SHA-256:1AF06EA10809E14665FE8C90EE22E380EBE07C22A88929B4CED2BEA64ADF12BB
                    SHA-512:D801FC9C8442C60131BCC3247E4D8337CF7CD134659FB682BD6705A45700973823C7F34B5042013772FC549B9ED400801E98BC70453E8A1B0B9EC0DC91B517C3
                    Malicious:false
                    Reputation:unknown
                    Preview:..-......................t..{.$....y..Q.z.X....-......................t..{.$....y..Q.z.X..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:SQLite Write-Ahead Log, version 3007000
                    Category:modified
                    Size (bytes):45352
                    Entropy (8bit):0.3938651109251305
                    Encrypted:false
                    SSDEEP:
                    MD5:D4044B764CAC0DBB774F3FDF6A30A36A
                    SHA1:27A6C1DA0A27FBF5E25F8199C7D32AEAE0C59BB6
                    SHA-256:8A102B95C549753C9C358711B1146B46CC3937DE96937D6C9D2C7BAD65443C13
                    SHA-512:39296259DE8019224D964D9C7B07B5FA49FA15D7EC3CD695038028AE4003191B6F78C7A9709BBB3EF2FDAEBA9F8A998660F30FF0E0C08B7728191B9977A254AB
                    Malicious:false
                    Reputation:unknown
                    Preview:7....-..............y......d..............y..c.Y...%.SQLite format 3......@ ..........................................................................K.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\593FF297.dat

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:GIF image data, version 89a, 121 x 54
                    Category:dropped
                    Size (bytes):2776
                    Entropy (8bit):7.866968883995294
                    Encrypted:false
                    SSDEEP:
                    MD5:11519C41628E729D2A3509F6C85F6D08
                    SHA1:6FCA97B226C09E96AEBEDD6AB61D0E1BE762552D
                    SHA-256:71E719884CE4B53FB62B3F28CAB0328E18C8FF7F04B8683D9103E9A126DBABBC
                    SHA-512:8FF239B68A095FA788B01C3D71FABEB7F35BE7D3492B276180511F8AF371CF2B6C7188816B50E881C6365C94BA1573C49A9ED33A1EED20A1284B5F9C6045D879
                    Malicious:false
                    Reputation:unknown
                    Preview:GIF89ay.6............."$!5746859;9=?<>@=?A>@B?CECGIFJLIMOLNPMOQNPROQSPRTQUWT\^[^`]`b_bebcfcfhfikhkmjrtq.........vxu...wyv...xzw...y{x...z}z!..#..}.}%....~'....$....)....6..7....9..:..<..=..?....@....I....J..K..L..V....N..O....P....Q..[....\..Y..b..Z..d..\..e....h....j.....p..q....r..s..t...u...v..w...y..}.......~................................................................................................................................................................................................................................................................................................................................................................................................!..Created with GIMP.!.......,....y.6........H......*\....#JD..]9p.3j..#.{.C..I..*"<.\....6.#I.fC`8\......@..<5....%}.r..{..J.J...Xm2.......f.K.a>I Z....%..e..-.H.~uW~X6.oYv........,..X....!....G.).,Ex#x.Q

                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C0D93D6E.dat

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:GIF image data, version 89a, 120 x 28
                    Category:dropped
                    Size (bytes):2263
                    Entropy (8bit):7.825820279021233
                    Encrypted:false
                    SSDEEP:
                    MD5:F0A63F4E4A806005C6AAB216731881B4
                    SHA1:6CC872D6384D7E7D66658DFDD5689D578D78CCBD
                    SHA-256:C8FD49AF9004CE02982A69ECEF2E52207350E38AD1512190BCCECB7FB5FBE5CF
                    SHA-512:F9BC9A1D0140C6436991A74C4EF77D869FB09D2789DF2D90C72EF38473EF0DC1FBE1151CAE1256216D0010A70C36160D507798DEFF98F3E49A8B20E91E3FD57C
                    Malicious:false
                    Reputation:unknown
                    Preview:GIF89ax......p|..C\..:..T..:........Ar....i........{...........K........._.....V...........Cy.^.......M..:....L.fWs.H.......>.....................:....G........G9..;..t..`q}.........o.......M|...A......9s..C......z........o...............p.....F..Y....y....Ra....Bw......W...C.........C:............s.....^_t...S.............D.....................Hu....k.....T..:.....?....c...f..R.......G9{.......O......PYv.]..:v....9~......P............F......:.....Ov....................J.........F...F...k.....Br.......hy...................9z...]...pt.........x....F..[u....V...c.....~............d.........:..Hr........O..8k.........E..E..........a...9t.Au.....s...a..Qz..........E..............|.....;..Rr.cy...................Cz..........9.....!.......,....x..........H......*\....#J....H.P.....L.p..0..0..]YC..@.).]h..I.b.``.$.3{....@....r.)..R..49.w..F.A...q......:.KV..v..2(V....-).A.A:.W,tr.n'.....t...W...jRW!.z).....L......'i..7....O..@M2.<..3..H

                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\2P5O7RTN\0006660398 (002).PDF

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:PDF document, version 1.7 (zip deflate encoded)
                    Category:dropped
                    Size (bytes):70420
                    Entropy (8bit):7.965508688427317
                    Encrypted:false
                    SSDEEP:
                    MD5:DF1B4A7CF0052631273EEBB25F6D28EB
                    SHA1:62A306DB66F7F1F8235D6815446B8E3FA6FBACA4
                    SHA-256:BAB596E28F810584284AFA9D6A6435D4B2523173983A0AB1DBD773461A4651EA
                    SHA-512:6248E3365818ECD5EA9100CCE9BE75B2E8FC0A98D8A816566A6576AD472E6FDEDB86E61D722197BCA3CC78B38F84FD5306D34610D2F24425F82FB4BBBB8DDC48
                    Malicious:false
                    Reputation:unknown
                    Preview:%PDF-1.7.%......1 0 obj.<</CreationDate(D:20241001162626Z)/ModDate(D:20241001162626Z)/Producer(PDFTron PDFNet, V9.20793\n)>>.endobj.2 0 obj.<</Pages 3 0 R/Type/Catalog/Version/1.4>>.endobj.4 0 obj.<</Annots 5 0 R/Contents 6 0 R/MediaBox[0 0 612 792]/Parent 3 0 R/Resources 7 0 R/Type/Page>>.endobj.6 0 obj.<</Filter/FlateDecode/Length 6247>>.stream.x....8r...W...=.$ X.n.......{.r.fw.,.L...?.D.G.G.^Kv.gg.v.S,.....X..~...?.......4..?.~~h.)...4...uC7....6.>|~.<.........&...?x...........h.:v\.n.....*...../.}.i&yBs....|........X....l?.j..u.Y"..2.........v....)2m\..$..Q..5...v.2.. .I....qi..+...^.%....Q|......T........5.K...}..'...'....%.{....H....l<@.$l..W.z........=...ktt.x:^:..X.....'.9'..19t.[.=.].....0kWw.H..........dV....w.?.....h%..:.\,..Z..s....\.....v@/I...9....R..3I....>"_....&....=,*......'Z...@.Z..'h#....3.R.1.2"c...j..........Yj..a..5;...DA...m...DdO..2.h.....^B.>.....g.T.....:......"....<.NJ.H.4..z....2.@k.|.:* .r.%.;..g.^.....w....y;...:...V_.Wa..

                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\2P5O7RTN\0006660398 (002).PDF:Zone.Identifier

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:ASCII text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):26
                    Entropy (8bit):3.95006375643621
                    Encrypted:false
                    SSDEEP:
                    MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                    SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                    SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                    SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                    Malicious:false
                    Reputation:unknown
                    Preview:[ZoneTransfer]..ZoneId=3..

                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{3C31D574-9630-4996-A1EB-1EB1770F69E3}.tmp

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):7580
                    Entropy (8bit):3.3120455466216683
                    Encrypted:false
                    SSDEEP:
                    MD5:4F6296E51E9840A2156FB54D6EC6BA21
                    SHA1:133E19D822D7F1712BCAFA55D9DADC0745958FFD
                    SHA-256:5F35B5367F64DE61F44E8E99526811D3F143EA8673D611BE65F9B511D05B2E8A
                    SHA-512:3CB55C8E9C96A326DC629904ED48ADBA3E07DD0F1F154244F0B37182C4D7391461A0E792F33DD96FC8BABE873156253EE158F525CDA594DEED66946007EE81DA
                    Malicious:false
                    Reputation:unknown
                    Preview:......Y.o.u. .d.o.n.'.t. .o.f.t.e.n. .g.e.t. .e.m.a.i.l. .f.r.o.m. .n.o.-.r.e.p.l.y.@.s.h.o.o.m...c.o.m... .H.Y.P.E.R.L.I.N.K. .".h.t.t.p.s.:././.a.k.a...m.s./.L.e.a.r.n.A.b.o.u.t.S.e.n.d.e.r.I.d.e.n.t.i.f.i.c.a.t.i.o.n."...........................................................................................................................................................................................................................................................................................................................................L...N...................2...F...H...h....................................................................................................................................................................................................................................................................................$.a$.............$..$.If....:V.......t.....6......4........4........a....*...$..$.If........!v..h.#v....:V.......t.....6......5.......4

                    C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727806320172519500_FB4710DE-24C4-4BC4-BF86-FDB950D39711.log

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:ASCII text, with very long lines (28726), with CRLF line terminators
                    Category:dropped
                    Size (bytes):20971520
                    Entropy (8bit):0.17657926790766867
                    Encrypted:false
                    SSDEEP:
                    MD5:A8E152D3D72D11B10D032677E8FDB712
                    SHA1:7CD2E71DAEBAA11B3D09573CB0A9585AD2593319
                    SHA-256:2550431697CC8CA5641E28B9F32C115A410AEB515C1E538CD396ECB6F52803A2
                    SHA-512:F728DB49F996464CE91831C311128F9D83300B68913FA3E63DAF97975187762D46CA0E43ABA79DC1EF8DE0B205E2D8756B8D088BE8B94BEA5BC4F22ED61CB536
                    Malicious:false
                    Reputation:unknown
                    Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/01/2024 18:12:00.212.OUTLOOK (0x1B0C).0x1B10.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":21,"Time":"2024-10-01T18:12:00.212Z","Contract":"Office.System.Activity","Activity.CV":"3hBH+8QkxEu/hv25UNOXEQ.4.9","Activity.Duration":16,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/01/2024 18:12:00.228.OUTLOOK (0x1B0C).0x1B10.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":23,"Time":"2024-10-01T18:12:00.228Z","Contract":"Office.System.Activity","Activity.CV":"3hBH+8QkxEu/hv25UNOXEQ.4.10","Activity.Duration":18565,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorV

                    C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727806320173147400_FB4710DE-24C4-4BC4-BF86-FDB950D39711.log

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):20971520
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:
                    MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                    SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                    SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                    SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                    Malicious:false
                    Reputation:unknown
                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\MSI4599e.LOG

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):246
                    Entropy (8bit):3.4917080724083283
                    Encrypted:false
                    SSDEEP:
                    MD5:7594D98F996EA83C74AA58EBAD42DC54
                    SHA1:1A2F1BCD01B86941A088EF1E7B2744A5FF7F5967
                    SHA-256:C6B6C5B0B40D8C3CA919D1159E976CBFE16AD57DA71BD01561DAEC4EC74A5748
                    SHA-512:A9A78AA3CE7B2A2CDC78F49DA24F5BA36CCAD2CC0E30AA5F9AA6BA8325D25C48D6AFA0C87CC96FA0CC0E76DC413F2EA544447770A48671AA1AD1A7D3C7AA1E23
                    Malicious:false
                    Reputation:unknown
                    Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.1./.1.0./.2.0.2.4. . .1.4.:.1.2.:.3.1. .=.=.=.....

                    C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241001T1412000004-6924.etl

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:modified
                    Size (bytes):94208
                    Entropy (8bit):4.435325655905969
                    Encrypted:false
                    SSDEEP:
                    MD5:E24E4F6BE32AE929A0AA1F8E6DE8D8B3
                    SHA1:D169ABF661ECD77DAC6FC34E538D5D3D4EB591DC
                    SHA-256:0EC3EADE007DE386182FB00258905CE36A3DF16624F4ACD73F63665C2E887AD2
                    SHA-512:83A703B537098832ABBD020263E6D801682A2C2E154D0922D202623875C2A60730B822414DECC18238AC74A72A3A68FCA5CBDA4D8EB802B9346C990AB162822C
                    Malicious:false
                    Reputation:unknown
                    Preview:............................................................................`...........c..h-...................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................p....Y..........c..h-...........v.2._.O.U.T.L.O.O.K.:.1.b.0.c.:.f.b.9.4.a.7.c.9.5.6.c.9.4.7.c.5.b.b.9.8.3.5.7.7.7.c.e.f.2.d.8.6...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.0.1.T.1.4.1.2.0.0.0.0.0.4.-.6.9.2.4...e.t.l.......P.P.........4..h-...........................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 14-12-15-928.log

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:ASCII text, with very long lines (393)
                    Category:dropped
                    Size (bytes):16525
                    Entropy (8bit):5.353642815103214
                    Encrypted:false
                    SSDEEP:
                    MD5:91F06491552FC977E9E8AF47786EE7C1
                    SHA1:8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
                    SHA-256:06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
                    SHA-512:A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
                    Malicious:false
                    Reputation:unknown
                    Preview:SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

                    C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                    File Type:ASCII text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):29752
                    Entropy (8bit):5.4121303799098355
                    Encrypted:false
                    SSDEEP:
                    MD5:FA4EEBF2D2CA101872136BE1967705C0
                    SHA1:EA36958A37E6844C4F8CE03BC0A4DF7AE37DBDD3
                    SHA-256:C4EB2867225D397F31F7D3041F53834C8FFF91E23B40CCF7E517CDB282209F63
                    SHA-512:347240682F599DCCE903A5C300A4505EA5C636FBAA65A401F0335EDE7F1A91C273E6693F1304B70F67BFAB90C1C9031D9CC6687A1189218FA1E04E789F1231CF
                    Malicious:false
                    Reputation:unknown
                    Preview:06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

                    C:\Users\user\AppData\Local\Temp\acrocef_low\4a368fae-2db3-452a-a8c0-00e1b8e8183e.tmp

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                    Category:dropped
                    Size (bytes):1407294
                    Entropy (8bit):7.97605879016224
                    Encrypted:false
                    SSDEEP:
                    MD5:716C2C392DCD15C95BBD760EEBABFCD0
                    SHA1:4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
                    SHA-256:DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
                    SHA-512:E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
                    Malicious:false
                    Reputation:unknown
                    Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                    C:\Users\user\AppData\Local\Temp\acrocef_low\902bf697-34fa-4d38-83b7-600e4a145626.tmp

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                    Category:dropped
                    Size (bytes):1419751
                    Entropy (8bit):7.976496077007677
                    Encrypted:false
                    SSDEEP:
                    MD5:1511824272239FFF34341EE91285B13F
                    SHA1:264CBD4E83B8201C440C68B6C217F6712A7685C3
                    SHA-256:6EC16C37F1F3FF3E8DDA7DF2B40144ED6DFED63F2BA84D11F8E86C124135BB9E
                    SHA-512:AB8CAD6F1E585DBD8D516DE76D613ED59A6287BB7D468298A209DD510AA865EFCC87428D208D4CDA2E854F935B46B4E0FBFABA941ADCFA44382707379F0A9728
                    Malicious:false
                    Reputation:unknown
                    Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                    C:\Users\user\AppData\Local\Temp\acrocef_low\e70f705a-3db1-4b18-b04b-8e901221fa1a.tmp

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                    Category:dropped
                    Size (bytes):386528
                    Entropy (8bit):7.9736851559892425
                    Encrypted:false
                    SSDEEP:
                    MD5:5C48B0AD2FEF800949466AE872E1F1E2
                    SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                    SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                    SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                    Malicious:false
                    Reputation:unknown
                    Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                    C:\Users\user\AppData\Local\Temp\acrocef_low\f855cc44-8c6b-4a04-8265-e1250f3a4039.tmp

                    Download File
                    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                    Category:dropped
                    Size (bytes):758601
                    Entropy (8bit):7.98639316555857
                    Encrypted:false
                    SSDEEP:
                    MD5:3A49135134665364308390AC398006F1
                    SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                    SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                    SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                    Malicious:false
                    Reputation:unknown
                    Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                    C:\Users\user\AppData\Local\Temp\~DF05F81843DBAD152C.TMP

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):155648
                    Entropy (8bit):0.42401468049647334
                    Encrypted:false
                    SSDEEP:
                    MD5:62C3CED541B938676DBA647A76AE2D22
                    SHA1:288CC02787B6BE3929D6DE544573C84827AB393A
                    SHA-256:E1E4DF076E9B2FB40C46F3FE6424C18C18C50DCB743B05F1EAA0F53141EED4DE
                    SHA-512:39E43BB8C6A87CBB4A6CDC97D1AA1816AE1A00C206F30BD78A8517E7893F593A225C8CA97DDD1D5897C5F67C04FE85D34C506B86960094F31E10916118BEF71B
                    Malicious:false
                    Reputation:unknown
                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):30
                    Entropy (8bit):1.2389205950315936
                    Encrypted:false
                    SSDEEP:
                    MD5:BAA58BA75A55A906718C5E12B00AA852
                    SHA1:B3FB6A1836B54FB9D6F34FE6C7AD583CBE69F2B3
                    SHA-256:DF204CD3FF2EC1103EBCDF188B5F2C1FC0598E9B560EE850C153E9FD39DAEB3A
                    SHA-512:DA135705F03D422C336A6798FE7BFCD6701C2C1B56CCFF5EEC251CAD06FBBAF384DC08B85044880DB4C12E71B47D68ED7EF0C2437D9EA33083E88CF4EE98266A
                    Malicious:false
                    Reputation:unknown
                    Preview:....|.........................

                    C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:Composite Document File V2 Document, Cannot read section info
                    Category:dropped
                    Size (bytes):2560
                    Entropy (8bit):2.0168215085440093
                    Encrypted:false
                    SSDEEP:
                    MD5:0C8A0EFB0AC2A5EB6641AE647FDF8B44
                    SHA1:1B753EEEDB62FACDDC11FE6B7FFC30C758A5E0CE
                    SHA-256:D1F1DF8F6D9520E4D58D558BF6178289250771B5AD106440EADE75873DE56CEF
                    SHA-512:A9EE45EA2FCF225E32AEC5B66C901E8BC9A76658E0786CAAD9B04FC9F3DC6942E6340747E7E22376DAA3C21E901D52FE761BA6D4CA65EC2D759DAD2ECDA4749A
                    Malicious:false
                    Reputation:unknown
                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm (copy)

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:Microsoft Word 2007+
                    Category:dropped
                    Size (bytes):0
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:
                    MD5:D6FF02AE5E458E60470650ACD568D3DF
                    SHA1:C4C2B02D426B40BEB50DCA93C6666AC990B77D27
                    SHA-256:CCD46BDFA6332E08B6F7C04EE64E4B253A7B3648BB106AB35484CB2CECA6C666
                    SHA-512:DF73B4A96FBE046A32CFF8FC25CB21E4C279C6793CC9BD760007FC0D79ED5DF02B2552B8062663A2D9C3C926D2D64283E5B59BD63C2BDD5CC2CCF50F7A952300
                    Malicious:false
                    Reputation:unknown
                    Preview:PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R*.D.g..3.H....M!`.l.....J.j;*...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

                    C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:modified
                    Size (bytes):162
                    Entropy (8bit):3.883779999208136
                    Encrypted:false
                    SSDEEP:
                    MD5:0E5F9C28A676269F20FA204E5201A24B
                    SHA1:CFAB05B35E0856DC2EE8B05006C7CF9BFE3F7559
                    SHA-256:05DD5F8E8BFB62EFB44AC3AE0BD73E8BD7DC82FF1396299DF9860778B38D4C91
                    SHA-512:51248FDB56A2335DF30B32624C5C1D78FD38E36891616090E95C8B829A51B08B56111DB37CDFE41EC8BCA6A05161C191F64C16AE2AD7A11F4A10B4E9966503B7
                    Malicious:false
                    Reputation:unknown
                    Preview:.user...................................................c.a.l.i...\JO..<.u..........Z.,`O.Xz.dM....JO...xb..........Z.0qO...'...p...p.M.............p.....p`O.0qO.

                    C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:Microsoft Word 2007+
                    Category:dropped
                    Size (bytes):19606
                    Entropy (8bit):7.474097919941067
                    Encrypted:false
                    SSDEEP:
                    MD5:D6FF02AE5E458E60470650ACD568D3DF
                    SHA1:C4C2B02D426B40BEB50DCA93C6666AC990B77D27
                    SHA-256:CCD46BDFA6332E08B6F7C04EE64E4B253A7B3648BB106AB35484CB2CECA6C666
                    SHA-512:DF73B4A96FBE046A32CFF8FC25CB21E4C279C6793CC9BD760007FC0D79ED5DF02B2552B8062663A2D9C3C926D2D64283E5B59BD63C2BDD5CC2CCF50F7A952300
                    Malicious:false
                    Reputation:unknown
                    Preview:PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R*.D.g..3.H....M!`.l.....J.j;*...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 17:12:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2673
                    Entropy (8bit):3.9838008594272076
                    Encrypted:false
                    SSDEEP:
                    MD5:47EE0DC1ADBA13FAC96F10DE52105E63
                    SHA1:8EB8023199A95185D2EECE87342A77AB8D378FF1
                    SHA-256:AAB4FBB069CFC90759DB517240EE65C0AA216C92A4E867496C4D2DE244457449
                    SHA-512:9A6C9210384807F5539FCBB52713C36EC9D9F77ADF150CCD576A3F2E867FC4E9766C9462921859CAD3223BBD6C7449F10943A405C0CA59CA58A3DA75E10441C0
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,....?kD.-...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYv.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0.RY.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 17:12:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2675
                    Entropy (8bit):4.002316313964173
                    Encrypted:false
                    SSDEEP:
                    MD5:647E16186D43B3292DC734A8A13023CE
                    SHA1:D62F92653D8B1ACA2D0F4C22237B2C0A85C03C0A
                    SHA-256:D3C5A353FC879D7ABA4640501F25AB265B1885312A80CECBCB15A9A881534E34
                    SHA-512:13AE26BFC4FBF9F8CAA3F7813EED579A51365107E6AA34A62E8AAF3D12710387FC6007DA80ACD137A6DA767BE0483C10F84F6CADF6DDDC311C3E05577353F0A5
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,....?]8.-...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYv.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0.RY.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2689
                    Entropy (8bit):4.00875916407572
                    Encrypted:false
                    SSDEEP:
                    MD5:28F4373E0526FECAC43AC1827C6BF487
                    SHA1:A6F3FB9D9CAB596FB822956622972A41FC96A21A
                    SHA-256:A4DA02956EEFF76B81C8042050745AE3BC00467373BE8F63F7DA64821FDCE1EC
                    SHA-512:966576B8B1FCF524E7DE58A337CD7AA4ED441408E82A012FB4054DA61A7EEB2F022AA6DD94BD8DF1F76A49B2A5E2E39AAB4370F56FA2D5382DD82E30AD65F9F7
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYv.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0.RY.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 17:12:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2677
                    Entropy (8bit):3.999914240456206
                    Encrypted:false
                    SSDEEP:
                    MD5:626DD550566EC5F624E75B4F399F88AA
                    SHA1:17A76075A47D0C5F8EED8EE6A7AA5417A1E48EFC
                    SHA-256:A6510EF7CD92439A1B75D57E65743091CD2AC9A688DE3C4F4DBE1324CAB60759
                    SHA-512:DF22ED3DB188C0B7D4B5EF23DCE4508AC55796F370CA14C75D01E4BE9D6D40000968EED6DB33AB8E4B93D1F31123587DCA23323AB5BC360A1AD9E0D54EBFF1DF
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,.....5/.-...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYv.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0.RY.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 17:12:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2677
                    Entropy (8bit):3.9882500305954975
                    Encrypted:false
                    SSDEEP:
                    MD5:D11D0F437F69CF931C3CD9BA750CE4C0
                    SHA1:E27E463FD8605668B18C1C37057A415BCA6875B5
                    SHA-256:9A40D6416FDA103101C852773424A8A88224D83BD5C7D985B08B5F19027F9DF9
                    SHA-512:509A7727DA5800D70B129FDC8C784DEF12B42DC3CAA97A37AD627CDB5742553B510813185583F5365FEEE889E5D75B180F7A94C2AEDB63D5BCD0505657B025E6
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,.....w>.-...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYv.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0.RY.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 17:12:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2679
                    Entropy (8bit):3.998692489579475
                    Encrypted:false
                    SSDEEP:
                    MD5:9F4FBEC91362E3A2CB7888FC995C2A98
                    SHA1:3178043300E48BC1653E6BFAD19C18417ED9520B
                    SHA-256:9A738312E59A16F5D7913B8C6FC76F592E138FD0C9F2B882C5145D4D4C9FF2C9
                    SHA-512:A9006D65AE1585C7433508F783098504333AF85FD7C802C5C180C6387DE66E1BF404CF43C49561CBAC5C61A9D2B3419081153E7C67CF6D9FA5F9D1F0263192D8
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,........-...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYv.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0.RY.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:Microsoft Outlook email folder (>=2003)
                    Category:dropped
                    Size (bytes):271360
                    Entropy (8bit):1.523792886689919
                    Encrypted:false
                    SSDEEP:
                    MD5:7356D220996612ABF33AD3CCFA265566
                    SHA1:BC553113506934B8C63502194AC7C337AAA48AD1
                    SHA-256:6D3CE9B9467EB48EACAA872357C3D369628691F2BB9776849E82495BC86CE793
                    SHA-512:512380CF486E3E9FDF5CF91483B2DE5D201A4EBA4453F05DE099302FAAAE328AB0A4CA291337D9182ACD956AEA82761ED002B0AC9F9AA27BDC60CA5D79D4EDF7
                    Malicious:false
                    Reputation:unknown
                    Preview:!BDN...1SM......\.......................]................@...........@...@...................................@...........................................................................$.......D.......:..........................................................................................................................................................................................................................................................................................................................H.........'...i.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):131072
                    Entropy (8bit):0.9485666611042001
                    Encrypted:false
                    SSDEEP:
                    MD5:54C7520CFADB61A389C767E27EFD1054
                    SHA1:AA3955FA85D946C1FE008804795644806D483129
                    SHA-256:D502C3A6EBFAC286CA40D0D3FF57F115701ED62777DF5FDAF56574196A5FC527
                    SHA-512:D699C082DE1FC24C46181A41B5CE13CA401638C31018A435D4D500A04083F35ED80ACAB1458AC56220AA1887B0A102BEB8DC3D09162AB697F53CE62932B973FD
                    Malicious:false
                    Reputation:unknown
                    Preview:.v..C...K...........<..h-.....................#.!BDN...1SM......\.......................]................@...........@...@...................................@...........................................................................$.......D.......:..........................................................................................................................................................................................................................................................................................................................H.........'...i.<..h-........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                    Static File Info

                    General

                    File type:CDFV2 Microsoft Outlook Message
                    Entropy (8bit):6.6704282858360715
                    TrID:
                    • Outlook Message (71009/1) 58.92%
                    • Outlook Form Template (41509/1) 34.44%
                    • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                    File name:Invoice From LocaliQ TexasNew Mexico.msg
                    File size:137'216 bytes
                    MD5:c845385253f18d7a090c7295be756d8f
                    SHA1:2d4c34994b972a32e3024976c1dda3f8c14f4d69
                    SHA256:da7fdf184268007c625cb4cd27dd7245e3a7b92a769088a7a6aab9b143ef6062
                    SHA512:18dd4d53df78f25d6e8aed36d378f1f40b1e40cfa5ffc2ae17e061275bf40c75c2620caa3e48396f7b79902a6bca4e11437e84904584d135eb0d60565c1b5b8b
                    SSDEEP:3072:t9vED/k+ZMAtTSHElKxVpStSvePQRjUxgCQAFTqcnSx1:IMeNmHFVcc8QRgRlq
                    TLSH:1AD34B152AF65619F2B7DF325DF2909789367C826D109A4F3191330E0A72A81E972F3F
                    File Content Preview:........................>.......................................................k..............................................................................................................................................................................

                    Static Mail

                    General

                    Subject:Invoice From LocaliQ Texas/New Mexico
                    From:LocaliQ Texas/New Mexico Invoice <no-reply@shoom.com>
                    To:Yvonne Cortinas <Yvonne@bakerselderlaw.com>
                    Cc:
                    BCC:
                    Date:Tue, 01 Oct 2024 18:26:31 +0200
                    Communications:
                    • You don't often get email from no-reply@shoom.com. Learn why this is important <https://aka.ms/LearnAboutSenderIdentification> LocaliQ Texas/New Mexico Recipient: Yvonne Baker (Baker & Baker Law) Your invoice from Texas/New Mexico, a Gannett Co., is ready for you! Simply click on the link below (encrypted for your protection) to view your full invoicing detail. You can also conveniently pay online once you log into your account. Invoice Number: 0006660398 Billing Date: 9/30/2024 Billing Period: 9/1/2024 - 9/30/2024 Account Number: 1471620 Account Name: Baker & Baker Law https://www.shoom.com/Invoice?q=bxry57viHQpwzylX If your link does not work, just copy and paste it into your browser. Or, for additional accounting information, contact: Texas/New Mexico Customer Support Email: local@ccc.gannett.com <mailto:local@ccc.gannett.com> For login assistance or help finding invoices or tearsheets, contact: Shoom Customer Support Email: customerservice@shoom.com <mailto:customerservice@shoom.com>
                    Attachments:
                    • ATT00001.gif
                    • ATT00002.gif
                    • 0006660398.PDF

                    Headers

                    Key Value
                    Receivedfrom e231-237.smtp-out.amazonses.com (23.251.231.237) by
                    1626:37 +0000
                    by LV8PR22MB4835.namprd22.prod.outlook.com (260310b6:408:1c8::19) with
                    2024 1626:33 +0000
                    (260310b6:408:fd::23) with Microsoft SMTP Server (version=TLS1_2,
                    Transport; Tue, 1 Oct 2024 1626:33 +0000
                    via Frontend Transport; Tue, 1 Oct 2024 1626:32 +0000
                    FromLocaliQ Texas/New Mexico Invoice <no-reply@shoom.com>
                    ToYvonne Cortinas <Yvonne@bakerselderlaw.com>
                    SubjectInvoice From LocaliQ Texas/New Mexico
                    Thread-TopicInvoice From LocaliQ Texas/New Mexico
                    Thread-IndexAQHbFB6wBQogq02wBUObSPE/uDHrVQ==
                    DateTue, 1 Oct 2024 16:26:31 +0000
                    Message-ID<0100019248e79c58-5f94ef5f-281e-4c23-970e-ad55e10745cd-000000@email.amazonses.com>
                    Content-Languageen-US
                    X-MS-Exchange-Organization-AuthAsAnonymous
                    X-MS-Exchange-Organization-AuthSourceBN2PEPF00004FC0.namprd04.prod.outlook.com
                    X-MS-Has-Attachyes
                    X-MS-Exchange-Organization-Network-Message-Id051f7fdc-2a99-41de-3da0-08dce235cf81
                    X-MS-Exchange-Organization-SCL1
                    X-MS-TNEF-CorrelatorX-MS-Exchange-Organization-RecordReviewCfmType: 0
                    x-ms-publictraffictypeEmail
                    received-spfPass (protection.outlook.com: domain of amazonses.com designates
                    x-ms-exchange-organization-originalclientipaddress23.251.231.237
                    x-ms-exchange-organization-originalserveripaddress10.167.243.186
                    authentication-resultsspf=pass (sender IP is 23.251.231.237)
                    x-ms-office365-filtering-correlation-id051f7fdc-2a99-41de-3da0-08dce235cf81
                    x-microsoft-antispamBCL:0;ARA:13230040|12012899012|3072899012|5073199012|4073199012|2092899012|32142699015|3613699012;
                    x-ms-traffictypediagnosticBN2PEPF00004FC0:EE_|LV8PR22MB4835:EE_|CH2PR22MB2039:EE_
                    x-forefront-antispam-reportCIP:23.251.231.237;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:e231-237.smtp-out.amazonses.com;PTR:e231-237.smtp-out.amazonses.com;CAT:NONE;SFTY:9.25;SFS:(13230040)(12012899012)(3072899012)(5073199012)(4073199012)(2092899012)(32142699015)(3613699012);DIR:INB;SFTY:9.25;
                    x-ms-exchange-crosstenant-network-message-id051f7fdc-2a99-41de-3da0-08dce235cf81
                    x-ms-exchange-crosstenant-originalarrivaltime01 Oct 2024 16:26:32.0077 (UTC)
                    x-ms-exchange-crosstenant-fromentityheaderInternet
                    x-ms-exchange-crosstenant-id3538e1c2-3096-4561-9ceb-af4b04582bde
                    x-ms-exchange-transport-crosstenantheadersstampedLV8PR22MB4835
                    x-ms-exchange-transport-endtoendlatency00:00:05.6803455
                    x-ms-exchange-processed-by-bccfoldering15.20.8005.023
                    x-ms-exchange-crosstenant-authasAnonymous
                    x-ms-exchange-crosstenant-authsourceBN2PEPF00004FC0.namprd04.prod.outlook.com
                    dkim-signaturev=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
                    h=MIME-VersionFrom:To:Date:Subject:Content-Type:Message-ID:Feedback-ID;
                    x-eopattributedmessage0
                    x-eoptenantattributedmessage3538e1c2-3096-4561-9ceb-af4b04582bde:0
                    feedback-id::1.us-east-1.prQ/KCNc//1Cdlin0+mgJX+JkSsGU23vfIM8HSU8xZ4=:AmazonSES
                    X-Microsoft-Antispam-Mailbox-Deliveryucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
                    X-Microsoft-Antispam-Message-Info=?utf-8?B?bW4yUTFCRkErREIxeGQ2VGNVN20vZjFSNlQwRng0cjB6MklWb1ZpN3dtbUg4?=
                    Content-Typemultipart/mixed;
                    MIME-Version1.0
                    dateTue, 01 Oct 2024 18:26:31 +0200

                    File Icon

                    Icon Hash:c4e1928eacb280a2