Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
al arts).msg

Overview

General Information

Sample name:al arts).msg
renamed because original name is a hash value
Original sample name:Application - Including ActorModel InfluencerIntertainer (IT qualified with model and martial arts).msg
Analysis ID:1541254
MD5:241b70549c9c6658839a4055bfc9e1e7
SHA1:bebe04c35f1e46634fc61e087a2c3d951bee3912
SHA256:f455df8ff4f49e71faf1595e7a22498e0faa700a0f59999f941ebec0a67f929a
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:60%

Signatures

Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Outlook Security Settings Updated - Registry

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6164 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\al arts).msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6200 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "91BBC8C8-C3F8-4BCC-A83A-134AC6805A1F" "CE449DFF-05F8-4366-9183-92382898AABF" "6164" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • Acrobat.exe (PID: 6396 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Portfolio.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
      • AcroCEF.exe (PID: 4480 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
        • AcroCEF.exe (PID: 1960 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2260 --field-trial-handle=1600,i,7747233440129350338,15545740786662772743,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
    • Acrobat.exe (PID: 1288 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Qualifications.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
      • AcroCEF.exe (PID: 4480 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
        • AcroCEF.exe (PID: 5736 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1652,i,1819166867340817594,11624593012543888002,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
    • Acrobat.exe (PID: 2268 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\SACAP Recommendation Panel Member.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
      • AcroCEF.exe (PID: 2828 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
        • AcroCEF.exe (PID: 2272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2064 --field-trial-handle=1664,i,3015666642311836785,12591759560587696159,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
    • Acrobat.exe (PID: 3652 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Civoc Committee Member Re-Appointment.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6164, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\SearchToolbarsDisabled
Sigma detected: Outlook Security Settings Updated - Registry
Source: Registry Key setAuthor: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6164, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 23.38.184.133
Source: unknownTCP traffic detected without corresponding DNS query: 23.38.184.133
Source: unknownTCP traffic detected without corresponding DNS query: 23.38.184.133
Source: unknownTCP traffic detected without corresponding DNS query: 23.38.184.133
Source: unknownTCP traffic detected without corresponding DNS query: 23.38.184.133
Source: unknownTCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknownTCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknownTCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknownTCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknownTCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknownTCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknownTCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknownTCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknownTCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknownTCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknownTCP traffic detected without corresponding DNS query: 96.7.168.138
Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: classification engineClassification label: clean1.winMSG@54/81@1/70
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241024T1015570167-6164.etl
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\al arts).msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "91BBC8C8-C3F8-4BCC-A83A-134AC6805A1F" "CE449DFF-05F8-4366-9183-92382898AABF" "6164" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Portfolio.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2260 --field-trial-handle=1600,i,7747233440129350338,15545740786662772743,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "91BBC8C8-C3F8-4BCC-A83A-134AC6805A1F" "CE449DFF-05F8-4366-9183-92382898AABF" "6164" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Portfolio.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2260 --field-trial-handle=1600,i,7747233440129350338,15545740786662772743,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Qualifications.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1652,i,1819166867340817594,11624593012543888002,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Qualifications.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1652,i,1819166867340817594,11624593012543888002,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\SACAP Recommendation Panel Member.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2064 --field-trial-handle=1664,i,3015666642311836785,12591759560587696159,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Civoc Committee Member Re-Appointment.pdf"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\SACAP Recommendation Panel Member.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2064 --field-trial-handle=1664,i,3015666642311836785,12591759560587696159,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Civoc Committee Member Re-Appointment.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\InProcServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: al arts).msgStatic file information: File size 17753088 > 1048576
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		2
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading		Security Account Manager14
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.214.172
truefalse
    		unknown
    x1.i.lencr.org
    		unknown
    		unknownfalse
      		unknown

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      52.113.194.132
      		unknownUnited States
      		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
      162.159.61.3
      		unknownUnited States
      		13335CLOUDFLARENETUSfalse
      2.23.197.184
      		unknownEuropean Union
      		1273CWVodafoneGroupPLCEUfalse
      93.184.221.240
      		unknownEuropean Union
      		15133EDGECASTUSfalse
      23.38.184.133
      		unknownUnited States
      		16625AKAMAI-ASUSfalse
      52.109.28.48
      		unknownUnited States
      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
      184.28.88.176
      		unknownUnited States
      		16625AKAMAI-ASUSfalse
      96.7.168.138
      		unknownUnited States
      		262589INTERNEXABRASILOPERADORADETELECOMUNICACOESSABRfalse
      104.124.11.8
      		unknownUnited States
      		20940AKAMAI-ASN1EUfalse
      18.207.85.246
      		unknownUnited States
      		14618AMAZON-AESUSfalse
      13.89.179.9
      		unknownUnited States
      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

      General Information

      Joe Sandbox version:41.0.0 Charoite
      Analysis ID:1541254
      Start date and time:2024-10-24 16:15:14 +02:00
      Joe Sandbox product:CloudBasic
      Overall analysis duration:
      Hypervisor based Inspection enabled:false
      Report type:full
      Cookbook file name:defaultwindowsinteractivecookbook.jbs
      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
      Number of analysed new started processes analysed:25
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • EGA enabled
      Analysis Mode:stream
      Analysis stop reason:Timeout
      Sample name:al arts).msg
      renamed because original name is a hash value
      Original Sample Name:Application - Including ActorModel InfluencerIntertainer (IT qualified with model and martial arts).msg
      Detection:CLEAN
      Classification:clean1.winMSG@54/81@1/70
      Cookbook Comments:
      • Found application associated with file extension: .msg

      Warnings

      • Exclude process from analysis (whitelisted): dllhost.exe
      • Excluded IPs from analysis (whitelisted): 52.113.194.132
      • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
      • Not all processes where analyzed, report is missing behavior information
      • Report size getting too big, too many NtCreateFile calls found.
      • Report size getting too big, too many NtQueryAttributesFile calls found.
      • Report size getting too big, too many NtQueryValueKey calls found.
      • Report size getting too big, too many NtReadVirtualMemory calls found.
      • Report size getting too big, too many NtSetInformationFile calls found.
      • Report size getting too big, too many NtSetValueKey calls found.
      • Timeout during stream target processing, analysis might miss dynamic analysis data
      • VT rate limit hit for: al arts).msg

      LLM Input / Output

      InputOutput
      URL: Model: claude-3-5-sonnet-20240620
      {
    "explanation": [
        "The email content is incoherent and unrelated to any legitimate job application or professional communication",
        "The sender's address (analyzer@analyzer.securityeducation.com) doesn't match the content or claimed identity of the sender",
        "The email contains personal information and opinions unrelated to a job application, which is unusual and potentially suspicious"
    ],
    "phishing": false,
    "confidence": 7
}
      Is this email content a phishing attempt? Please respond only in valid JSON format:
    Email content converted to JSON:
{
    "date": "Thu, 24 Oct 2024 15:59:12 +0200", 
    "subject": "Application - Including Actor/Model/ Influencer/Intertainer (IT qualified with model and martial arts)", 
    "communications": [
        "________________________________\n\nCAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.\n________________________________\n\n________________________________\n\nCAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.\n________________________________\n\nSir/Madam\n\nJob Search:\n\nFor you to have a clear view of my opinions on everything that is happening around me in the world, I did some YouTube videos and online radio episode.\n\nWill apply for asylum, other country citizenship when I arrive outside my country - one fight was created over another one into covering up the problems from 2005 when I left Department of&nbs p;Health, I can not elaborate on this or any other techniques were&are used as one of the countries I am applying here is my country for experience/money and international rules.\n\nHow many techniques can you use to cover up something from then until now, even as we speak I have no privacy in my country as they make sure I know that every day. How can I know that, but the are many more. Why are black people in my case falling inline of fire, who is 'promoting' them. The only thing I am doing is my curre nt job and secretly apply for high level jobs with no limit, they behave as if they know as if I am in a village.\n\nand you don't have authority or capacity or jurisdiction... to investigate such things, but I am force to say enough to get work.\n\nDave Chappelle's career started at the same time as Seinfeld, but I bet Seinfeld is a retired billionaire some were now and Dave Chappelle has to work. To fight for there 20 years experience, cleaning there public image and the money those people made that time, they create  a new fight saying he is fighting with the Gay community and now its them the people who attack him before who are in his side.\n\nHeight - 6'1,\nJacket - Large,\nShoe - 11,\nWaist - 33,\nWeight - 81.\n\nYours Faithfully,\nS. Bukula\nCell. +27762083323 (Whatsapp too)\n15 Yoyo Street,\nZwide,\nPort Elizabeth,\nEastern Cape,\nSouth Africa,\n6201.\n(Applicant) \n"
    ], 
    "from": "analyzer@analyzer.securityeducation.com", 
    "to": "clear-abuse@weisigergroup.com"
}
      URL: PDF document Model: claude-3-haiku-20240307
      ```json
{
  "contains_trigger_text": true,
  "trigger_text": "To view secured document, click here",
  "prominent_button_name": "Click here",
  "text_input_field_labels": [
    "Email Address",
    "Cell phone",
    "Fax number"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false
}
      URL: Email Model: claude-3-haiku-20240307
      ```json
{
  "contains_trigger_text": true,
  "trigger_text": "CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.",
  "prominent_button_name": "unknown",
  "text_input_field_labels": [
    "Job Search:"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false
}
      URL: PDF document Model: claude-3-haiku-20240307
      ```json
{
  "brands": []
}
      URL: Email Model: claude-3-haiku-20240307
      ```json
{
  "brands": []
}

      Created / dropped Files

      C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
      Category:dropped
      Size (bytes):118
      Entropy (8bit):3.5700810731231707
      Encrypted:false
      SSDEEP:
      MD5:573220372DA4ED487441611079B623CD
      SHA1:8F9D967AC6EF34640F1F0845214FBC6994C0CB80
      SHA-256:BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
      SHA-512:F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
      Malicious:false
      Reputation:unknown
      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):290
      Entropy (8bit):5.146735403018413
      Encrypted:false
      SSDEEP:
      MD5:A42CD5AF59050B51964C580FA3C776BC
      SHA1:ED649288B2FC568AF1F7E1412C77AF50C816ACE1
      SHA-256:EA73909502B8B6B4A3FECED6D2AC1D516D9D8C6E0928F5D9B967932C3697B89F
      SHA-512:56B655752D3DA9A4634BB41661205E47FB504442AE4C593D46F8967DFA808D8784DA6C90D545686152B9F60CD9B59FE543C594FB28FF4D6D35086D0632B429D5
      Malicious:false
      Reputation:unknown
      Preview:2024/10/24-10:16:14.864 12a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/24-10:16:14.868 12a8 Recovering log #3.2024/10/24-10:16:14.868 12a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):0
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:A42CD5AF59050B51964C580FA3C776BC
      SHA1:ED649288B2FC568AF1F7E1412C77AF50C816ACE1
      SHA-256:EA73909502B8B6B4A3FECED6D2AC1D516D9D8C6E0928F5D9B967932C3697B89F
      SHA-512:56B655752D3DA9A4634BB41661205E47FB504442AE4C593D46F8967DFA808D8784DA6C90D545686152B9F60CD9B59FE543C594FB28FF4D6D35086D0632B429D5
      Malicious:false
      Reputation:unknown
      Preview:2024/10/24-10:16:14.864 12a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/24-10:16:14.868 12a8 Recovering log #3.2024/10/24-10:16:14.868 12a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF52a8f3.TMP (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):0
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:A42CD5AF59050B51964C580FA3C776BC
      SHA1:ED649288B2FC568AF1F7E1412C77AF50C816ACE1
      SHA-256:EA73909502B8B6B4A3FECED6D2AC1D516D9D8C6E0928F5D9B967932C3697B89F
      SHA-512:56B655752D3DA9A4634BB41661205E47FB504442AE4C593D46F8967DFA808D8784DA6C90D545686152B9F60CD9B59FE543C594FB28FF4D6D35086D0632B429D5
      Malicious:false
      Reputation:unknown
      Preview:2024/10/24-10:16:14.864 12a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/24-10:16:14.868 12a8 Recovering log #3.2024/10/24-10:16:14.868 12a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):334
      Entropy (8bit):5.195707977208552
      Encrypted:false
      SSDEEP:
      MD5:88D5DA178FF73F469A9AB1BFFA573408
      SHA1:FBEA79D24D8D49CDBAED304AFAF2841155BF0F52
      SHA-256:B30EB476E98C470D122EDD56340B34169804725B51C1EACDC984BE689086D66C
      SHA-512:263617B7A5A3D28115C4AA8155C81F130914E7E4051BE6D5428774EBF7C551861C8ABCF3C12D25A83CAC5979A9BC7780B810A75DAFC1F4DF41C9611CA23EBA12
      Malicious:false
      Reputation:unknown
      Preview:2024/10/24-10:16:14.762 1988 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/24-10:16:14.766 1988 Recovering log #3.2024/10/24-10:16:14.766 1988 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):0
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:88D5DA178FF73F469A9AB1BFFA573408
      SHA1:FBEA79D24D8D49CDBAED304AFAF2841155BF0F52
      SHA-256:B30EB476E98C470D122EDD56340B34169804725B51C1EACDC984BE689086D66C
      SHA-512:263617B7A5A3D28115C4AA8155C81F130914E7E4051BE6D5428774EBF7C551861C8ABCF3C12D25A83CAC5979A9BC7780B810A75DAFC1F4DF41C9611CA23EBA12
      Malicious:false
      Reputation:unknown
      Preview:2024/10/24-10:16:14.762 1988 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/24-10:16:14.766 1988 Recovering log #3.2024/10/24-10:16:14.766 1988 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old~RF52a912.TMP (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):0
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:88D5DA178FF73F469A9AB1BFFA573408
      SHA1:FBEA79D24D8D49CDBAED304AFAF2841155BF0F52
      SHA-256:B30EB476E98C470D122EDD56340B34169804725B51C1EACDC984BE689086D66C
      SHA-512:263617B7A5A3D28115C4AA8155C81F130914E7E4051BE6D5428774EBF7C551861C8ABCF3C12D25A83CAC5979A9BC7780B810A75DAFC1F4DF41C9611CA23EBA12
      Malicious:false
      Reputation:unknown
      Preview:2024/10/24-10:16:14.762 1988 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/24-10:16:14.766 1988 Recovering log #3.2024/10/24-10:16:14.766 1988 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0a5edc79-5c7a-4ac3-8f06-d6812a213fdf.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:JSON data
      Category:modified
      Size (bytes):403
      Entropy (8bit):4.9778647207873625
      Encrypted:false
      SSDEEP:
      MD5:F6B183CCBDFE092B00892F64AB8BBDC6
      SHA1:1BAB7B09AA4DA6DEB68888605ED3C9AC97E9162A
      SHA-256:5094C6D7C80F1F499F450C575C3E8C2921E249F700314DF8BB5D8C8D29CC4B35
      SHA-512:F095D6425AD8BB00E1056222E37399F810C927AF2F881C8582CE771949728F524BF64FB19E99EAD21ABBE7C536B2149A9CA44E78B31732DC884ECC935350B9A2
      Malicious:false
      Reputation:unknown
      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374339467830499","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":444769},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3967b086-1717-4e31-91ac-c445515a7138.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:JSON data
      Category:modified
      Size (bytes):403
      Entropy (8bit):4.979888673529212
      Encrypted:false
      SSDEEP:
      MD5:1F395308CAE205F02BB086A688E9D488
      SHA1:8CFB4846CEDCDD64099492A32F491F7EA1353714
      SHA-256:2C5535833EE88588481480C84051AFAD74FE28589C7A7ED0B845614116E3F799
      SHA-512:8EC187F153A7DF0A5A591C649D0DE71B9676A16FE965E236BD2C9C574AFFF966CCF2BD2C16AF2E91035DC0AE82465796ADFCAD2F393A307963857103EE816D63
      Malicious:false
      Reputation:unknown
      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374339441915366","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":408397},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\79c9e04a-5a38-4a09-9af7-9fe888b15657.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:JSON data
      Category:modified
      Size (bytes):403
      Entropy (8bit):4.98141020715722
      Encrypted:false
      SSDEEP:
      MD5:8ED11C9751FFC7CE80BA9FF0643848E5
      SHA1:A811D2C408D25F0CC0488090317ED5C034AD3F71
      SHA-256:9BD5A5917FE7BA7DC7987E6347FC6AEB2C66CA52BC721EEE42FD8A30EED760CD
      SHA-512:16FEE5A7BBDAD1A5B21F8774A31B4007C9EEEC8B562514CCBAE683D98BD5B0D7510BDE68A5CA724E9FE7ED0377E2AF53F784582B1808C9C8D32C8CEAE23338E7
      Malicious:false
      Reputation:unknown
      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374339380561419","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":232801},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):0
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:8ED11C9751FFC7CE80BA9FF0643848E5
      SHA1:A811D2C408D25F0CC0488090317ED5C034AD3F71
      SHA-256:9BD5A5917FE7BA7DC7987E6347FC6AEB2C66CA52BC721EEE42FD8A30EED760CD
      SHA-512:16FEE5A7BBDAD1A5B21F8774A31B4007C9EEEC8B562514CCBAE683D98BD5B0D7510BDE68A5CA724E9FE7ED0377E2AF53F784582B1808C9C8D32C8CEAE23338E7
      Malicious:false
      Reputation:unknown
      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374339380561419","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":232801},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5298e5.TMP (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):0
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:8ED11C9751FFC7CE80BA9FF0643848E5
      SHA1:A811D2C408D25F0CC0488090317ED5C034AD3F71
      SHA-256:9BD5A5917FE7BA7DC7987E6347FC6AEB2C66CA52BC721EEE42FD8A30EED760CD
      SHA-512:16FEE5A7BBDAD1A5B21F8774A31B4007C9EEEC8B562514CCBAE683D98BD5B0D7510BDE68A5CA724E9FE7ED0377E2AF53F784582B1808C9C8D32C8CEAE23338E7
      Malicious:false
      Reputation:unknown
      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374339380561419","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":232801},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF531837.TMP (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):0
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:8ED11C9751FFC7CE80BA9FF0643848E5
      SHA1:A811D2C408D25F0CC0488090317ED5C034AD3F71
      SHA-256:9BD5A5917FE7BA7DC7987E6347FC6AEB2C66CA52BC721EEE42FD8A30EED760CD
      SHA-512:16FEE5A7BBDAD1A5B21F8774A31B4007C9EEEC8B562514CCBAE683D98BD5B0D7510BDE68A5CA724E9FE7ED0377E2AF53F784582B1808C9C8D32C8CEAE23338E7
      Malicious:false
      Reputation:unknown
      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374339380561419","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":232801},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:data
      Category:dropped
      Size (bytes):4509
      Entropy (8bit):5.23439215833857
      Encrypted:false
      SSDEEP:
      MD5:C7565184B49D68FDFC3C73FB4B80EAC7
      SHA1:6446391D0CFE058CDC91B77E98B4A93F5B6B0335
      SHA-256:5320CEFA7CB379BA4C0C68F8081296F4F5258C10D223E88B2351B86492524641
      SHA-512:906DB16DD3DA6FD50DE10D9DC2B09AC19833F88AF3CA2247566091AD6E1F54EFB332DAF656539E1A03F7B4B7E403AEC38ACB37F82BA8DAC2FA4CD1597F6ED94A
      Malicious:false
      Reputation:unknown
      Preview:*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):322
      Entropy (8bit):5.183147957594199
      Encrypted:false
      SSDEEP:
      MD5:CDCCA50CEAD0A1DCFDA9138A5CA2394E
      SHA1:8EA40E372F758D50E5A1AD228C046C6F87454D96
      SHA-256:023BD6B17C552073AD572EA73E455D1EAB10722EF7296A95B45568C2E3E7A24A
      SHA-512:C7FE1830AE78539DB6A7CDC7B6296DE9F0C2242E4FBCFF44E6C1DD199ADD8D404922B2DD45FE448553F3187F3F303C75804DAF76519CC82634848D92E9D6356A
      Malicious:false
      Reputation:unknown
      Preview:2024/10/24-10:16:14.926 1988 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/24-10:16:14.928 1988 Recovering log #3.2024/10/24-10:16:14.929 1988 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):0
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:CDCCA50CEAD0A1DCFDA9138A5CA2394E
      SHA1:8EA40E372F758D50E5A1AD228C046C6F87454D96
      SHA-256:023BD6B17C552073AD572EA73E455D1EAB10722EF7296A95B45568C2E3E7A24A
      SHA-512:C7FE1830AE78539DB6A7CDC7B6296DE9F0C2242E4FBCFF44E6C1DD199ADD8D404922B2DD45FE448553F3187F3F303C75804DAF76519CC82634848D92E9D6356A
      Malicious:false
      Reputation:unknown
      Preview:2024/10/24-10:16:14.926 1988 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/24-10:16:14.928 1988 Recovering log #3.2024/10/24-10:16:14.929 1988 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old~RF52a950.TMP (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:ASCII text
      Category:dropped
      Size (bytes):0
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:CDCCA50CEAD0A1DCFDA9138A5CA2394E
      SHA1:8EA40E372F758D50E5A1AD228C046C6F87454D96
      SHA-256:023BD6B17C552073AD572EA73E455D1EAB10722EF7296A95B45568C2E3E7A24A
      SHA-512:C7FE1830AE78539DB6A7CDC7B6296DE9F0C2242E4FBCFF44E6C1DD199ADD8D404922B2DD45FE448553F3187F3F303C75804DAF76519CC82634848D92E9D6356A
      Malicious:false
      Reputation:unknown
      Preview:2024/10/24-10:16:14.926 1988 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/24-10:16:14.928 1988 Recovering log #3.2024/10/24-10:16:14.929 1988 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241024141618Z-172.bmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
      Category:dropped
      Size (bytes):65110
      Entropy (8bit):2.542987246290696
      Encrypted:false
      SSDEEP:
      MD5:86B7E89A0BD668868BCB428D7F99841F
      SHA1:085EF804D67E579E322957752052188319D7BE84
      SHA-256:EC46B1CF86BDCF66E99801005EBAA9D4442FBC0C866AC90288A83C1E2FCE7D17
      SHA-512:DCD0BA84CA72B4BB97E1A21A3D9B4D990C0EAD9C0271A67F7E313AA7FCE787785BA730C1CD3A9F8895EF6E0C5E5E966D9F8C43D5216B947E35B3EBA7E9FBB0FC
      Malicious:false
      Reputation:unknown
      Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241024141714Z-159.bmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
      Category:dropped
      Size (bytes):65110
      Entropy (8bit):3.347804211263152
      Encrypted:false
      SSDEEP:
      MD5:0F5766FA500D876AF6A576DFFBD591AE
      SHA1:795903AAEC9C034D4AFA15AB693943EDD6E6EDF5
      SHA-256:E6FD2C08616DE521B4414E7F610CE240E5A51737D79BF9120E3F516F67CDC93F
      SHA-512:E2C837977338B4BD583263A63B85A9AF1B02510CBA243064CEE244EDE74E81356917584606B26227E915F16F898FB52F9D3B689B0B053C29C3056CA27CE485F6
      Malicious:false
      Reputation:unknown
      Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241024141740Z-153.bmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
      Category:dropped
      Size (bytes):65110
      Entropy (8bit):3.0994372577208322
      Encrypted:false
      SSDEEP:
      MD5:49649DC454A2122CB8621D5D6E6B93B9
      SHA1:83B5415E9C839C4E93FFAACF11C1A950B1240C4B
      SHA-256:37CAAB2319BF536CED0F702620F252D7A4904B4C39D9AB98286D9B864681B182
      SHA-512:834802DD261D021DC4BCB159BEFC0CEBB71DB13A769402691725DFADD8EA5459792427AE359CED204FA7522F303DB8413893AE287524E797C85EDB155D4EF133
      Malicious:false
      Reputation:unknown
      Preview:BMV.......6...(...k...h..... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................|z..`P..bR..fV..fW..j[..iZ..j[..j[..j[..j[..j[..j[..j[..j[..j[..k\..n`..k\..l]..j[..l^..k\..n_..pb..sd..qb..tf..sd..se..tf..tf..tf..tf..tf..tf..tf..vi..tg..tg..vi..vi..wi..{m..~q..~q..~q..~q..~q..~q..}p..~q..}p..~q..~q..~q..~q..~q..~q..~q..~q..~q..~q..~q...r..~q..~q...u...r...v...x...v...z...|...|...|...|...}...|...}..............i...g...b...b...^...^...^...^...^...^...^...^...`...b...b...b...`...^...^...`..._.

      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
      Category:dropped
      Size (bytes):57344
      Entropy (8bit):3.291927920232006
      Encrypted:false
      SSDEEP:
      MD5:A4D5FECEFE05F21D6F81ACF4D9A788CF
      SHA1:1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
      SHA-256:83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
      SHA-512:FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
      Malicious:false
      Reputation:unknown
      Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:SQLite Rollback Journal
      Category:dropped
      Size (bytes):16928
      Entropy (8bit):1.2135297356815338
      Encrypted:false
      SSDEEP:
      MD5:F24AE963D5D374720E02C42542BEE3C7
      SHA1:3A319E058471D49810D21E5F3A255045BB5598F0
      SHA-256:5990BA614ABA7D3F0D4D8EC342F7D5B25CE3B4A02AF8605977AF7A1C6B87AE67
      SHA-512:8C33AB6CB5B5C23EFA6D7B3250A9B9E6E686C0485321C3D3548CD294A2580F67A1791D9015ABF8EBF153FE1D8C2E85D8711E7B5E628E2722C332CAB9DD64E161
      Malicious:false
      Reputation:unknown
      Preview:.... .c.....o\.P........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:Certificate, Version=3
      Category:dropped
      Size (bytes):1391
      Entropy (8bit):7.705940075877404
      Encrypted:false
      SSDEEP:
      MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
      SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
      SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
      SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
      Malicious:false
      Reputation:unknown
      Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
      Category:dropped
      Size (bytes):71954
      Entropy (8bit):7.996617769952133
      Encrypted:true
      SSDEEP:
      MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
      SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
      SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
      SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
      Malicious:false
      Reputation:unknown
      Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:data
      Category:dropped
      Size (bytes):192
      Entropy (8bit):2.7569015731729736
      Encrypted:false
      SSDEEP:
      MD5:635C2FA3CE8389EEAF903437C59E7962
      SHA1:0CDC2AA13E834CDE188BDD1BF2E36390922C9443
      SHA-256:A6E2C150A7E37A115B9138BD2E88B35CEBC1EAFFAF11F2C9CC7A25EEA7D2CD0F
      SHA-512:16261223C0F26DBD360A25BEF447FE85F4B08495A51A85A4215E8ECD193A5299FF69402DA74C8613BBF6987FD96B85D66966C14016955ACE819ED60639AB2FEC
      Malicious:false
      Reputation:unknown
      Preview:p...... ...........P.&..(....................................................... ..........W.....q..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:data
      Category:modified
      Size (bytes):328
      Entropy (8bit):3.1159790350223777
      Encrypted:false
      SSDEEP:
      MD5:D33BA754CFCDB17449D100D4171A242D
      SHA1:C302A7EE8E39DF96F6302A8CE8083D821CC0A16B
      SHA-256:F7D89E3CD5E34C1704BBF1E37FC2976E287CA83470DE7396BA4C3522E6ADECF3
      SHA-512:F84532BFCE5D1341A0965BF7F3716AE81519FE01E5D6D94D9076C203AEAFC6FC91FC986529358138FD5EF4F0BC8FD401FAD302E5012891528ED508A69394B1E2
      Malicious:false
      Reputation:unknown
      Preview:p...... ........Iu8c.&..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6008

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PostScript document text
      Category:dropped
      Size (bytes):185099
      Entropy (8bit):5.182478651346149
      Encrypted:false
      SSDEEP:
      MD5:94185C5850C26B3C6FC24ABC385CDA58
      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
      Malicious:false
      Reputation:unknown
      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:PostScript document text
      Category:dropped
      Size (bytes):0
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:94185C5850C26B3C6FC24ABC385CDA58
      SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
      SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
      SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
      Malicious:false
      Reputation:unknown
      Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:data
      Category:dropped
      Size (bytes):236500
      Entropy (8bit):3.353488920719721
      Encrypted:false
      SSDEEP:
      MD5:D5E08A196F39C813C9549A8292A89682
      SHA1:31AD226F3F8CDAFADC75F4E31939A0B1CA36FDFC
      SHA-256:6C02579C58D557B9EA66D0DC8C369FFE69A66D255083B7BD865806CC2A3A71C2
      SHA-512:944CAD58E62F5B1B32DB8AA8FAE5D50D9A6FD892819D9883E5BFA08ED9ADE3966A4401C65C075A9A76DA1E5FF93DA1E05D844E1002CEC32B9F9F2487A1F6DD7C
      Malicious:false
      Reputation:unknown
      Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):295
      Entropy (8bit):5.358244723901628
      Encrypted:false
      SSDEEP:
      MD5:BB1306CB76E25D3324A60FA69AE10635
      SHA1:E379E7BA833FACF7817C170440A33573CB0F58F6
      SHA-256:46150EB25131751AFA6A81476D88BB52C3D51EC68245F9ABEC2E4E74CB7AF492
      SHA-512:69B0BB3E45011847A01BA601A53C9C175C2372FD88DA59DFA9877D49AABFE3C63D1F06D1CEA35DDBD9F32E2B259C4BE46A78BD3DD4BDA7EC52B71A9AF22879D7
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):294
      Entropy (8bit):5.306655555614327
      Encrypted:false
      SSDEEP:
      MD5:86C2BD9AEF9755E134F094F80AE4ED34
      SHA1:0A8481209B59C0E11CF9AA63E4A8B22FE1B63136
      SHA-256:90FEA32BB96451F85FE99AE6F3F05F80CB6679E8B7054DC006E22E796234AEA2
      SHA-512:C1E05084FA3A018476AAB0C9A3E24E26115710D22D4862D5FC30000490B726CDBB1F48069B0F722E9DBFD3CBE62607CF6EBF5F5089C193F1DDDAB799CD18C1DC
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):294
      Entropy (8bit):5.2852038721403325
      Encrypted:false
      SSDEEP:
      MD5:5F3D496900E5C3E19955629CFCC2E7DC
      SHA1:4B3CD00C4A9FAE9FCF2E226844C735BC09D869DE
      SHA-256:8C132CF75D841D2FA84211B60B323E6248C1EFB42FFF9677CD403DC71B97CDCF
      SHA-512:DCFB7BA640A16450D89E8FBB861E2AFF974C39D2CAC41E7E45CB294330D8561BC2FCF58992CB97A7E339DB621E3DAF265346ECDAD50C96322E8C4FB0D9842130
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):285
      Entropy (8bit):5.346445310452604
      Encrypted:false
      SSDEEP:
      MD5:5D2206FEA9F00AF987BC7F698DB8B5EC
      SHA1:D1EEA5D901A08BECBB4122ABB7B6D7F4FE802EB1
      SHA-256:C63B3651A92611B8AAF0D1279976B4423FB8898EB85CFAA6E2E6D9AB9C2E0B81
      SHA-512:3718B3639824DE5980A93A642CE66D96764B591FD90896A0740537694FEE33ACCE85DE88388D3CAAD2745964B936237502241BC149651E1F176154C4B3AA6230
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):1055
      Entropy (8bit):5.666538072059351
      Encrypted:false
      SSDEEP:
      MD5:B6BD24B8B6C939BDEE4226395436E887
      SHA1:0455271AF78E232997BC5626A4F7C8A848E3215A
      SHA-256:D41BEB3D2821403278ADE06844CF793B45F45B967CB3E366078BFA83E184AD18
      SHA-512:7F58334E02C9E37207D4E325B1C59E8A57B23B1A413A6C684F6537EE2CA92EC08DD01A5AFA6E74C786953FF846FD46DB33DEE607EF32D4C56DA36923B10C0732
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"92038_285529ActionBlock_1","campaignId":92038,"containerId":"1","controlGroupId":"","treatmentId":"eb1a4bce-8215-46f1-b44c-154b21a85d60","variationId":"285529"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingScheme":tr

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):1050
      Entropy (8bit):5.656812273442783
      Encrypted:false
      SSDEEP:
      MD5:82D28655526535D9723E0DF128550FE7
      SHA1:0570D284A3B74BA8C28B8AB1D4C03C935AB8C0FB
      SHA-256:D38F9A84B1C0600B697D8D383FB093A04CB7B34D6AF738D89121580A0A073E20
      SHA-512:0586D6CCB8ACE7FE15FCFDA1ED547846C4CE2A7CA8104B1359AC491D6D070995E508E734382A7427787690B2B0582D4096D8A0813026F324EDDE52B6C267BCBC
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):292
      Entropy (8bit):5.299154584536039
      Encrypted:false
      SSDEEP:
      MD5:9E7E2CB0BAC936005B6DA0BCC90BEFD5
      SHA1:2A435F52C6979F6AC8D11C5BC3E281438FD3AC3A
      SHA-256:FF46E47B4E612F53F827AE443EE8BF3EFC6E9F89B94D77567F9C63344975DD0A
      SHA-512:1DFDF3FAA6A526848B8F697324D508660668069F3ECBDE26CCB4B059D3C84F4D46C973DF653EECCABD77F172D8FBE675083751F0FEDAB38931D96573991868DA
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):1038
      Entropy (8bit):5.651266294159443
      Encrypted:false
      SSDEEP:
      MD5:D306D924AB2F46D5D983961BA552AF46
      SHA1:52E6E326C850BB95E74C295E5799A31A5C2E34A2
      SHA-256:6D9362A5065C33934F8A272991A1911DA1A40412E9B967425FF0B397A4D32251
      SHA-512:16EBACCFE7287A959B7D94F704633502DFE2BB9A1E788127433E280A05244217F98C468B610886C42DEA75B9178ADD8FC954AC054891E90B1050E3F72D21F66F
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):1164
      Entropy (8bit):5.699134559962206
      Encrypted:false
      SSDEEP:
      MD5:1C2645529589AAD54E300368DA3433A0
      SHA1:FC535503ACC03C1E0D605E21D298CEF21049F47A
      SHA-256:0C0CDE08032EE3C4153EEAC10CEEC46C671C511113670D727188CAABBD3D7C50
      SHA-512:1460579E6E7A5DDD373A42EEAAC855C6010F8141EE34CA0487489AF11BA3BCE0E39B49AE0E31D821A6B41909EF0DBFB8797DB613EB75E358D6EEBC31CB7DBD39
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):289
      Entropy (8bit):5.302756705298843
      Encrypted:false
      SSDEEP:
      MD5:8CCC8C2437ABC5240FA99AE682BAD82E
      SHA1:718B12504E46EFCEBABCE7E81355E95A56FBF4A3
      SHA-256:A7C58D8318FDD2CA4987C72375607BBDE6391D5B0AEC9D733F9489A0DEBBEEF6
      SHA-512:737B75AECBA6A11EA2EEBA29B4F6A57A084F07FEF2B7C5AFDBAAFA3B088AFAA338EF5E38756A9A6A6EF7C29E642CF7926B826876CB0B8823AD86A355BE4C8820
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):1395
      Entropy (8bit):5.774150465226061
      Encrypted:false
      SSDEEP:
      MD5:9EA79CD0F0F3CE1C5108032950DE0D70
      SHA1:73902C0811C090432DC9286A3E00A9B45D7C91A6
      SHA-256:1015592E6F732B6EBD072694E3025B9383EB4BAC3B3B5F21B8258810B89F8F08
      SHA-512:73C953A6852222F2CC1BCB8E7259A2D6BC5826356AD4B21623FC1C9618135D6CB4508935F45817A4D1DC3EC27D10650F40FB1FDC900BE3F4822B2C1136415C47
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):291
      Entropy (8bit):5.286284856544536
      Encrypted:false
      SSDEEP:
      MD5:936C3DD0E8E73E7CED5D599AB0F4E865
      SHA1:6C530EBC9F841C635B7E943051F9F2D1D9A00F2F
      SHA-256:339EF05F29AE17A3E6C7654A6D9D3B8B49D4E4EC949C20A0B9D99C60C63E6CB7
      SHA-512:FE0B09A1184C9A95F7AE61B6265A13EE54DF018F68168C758C28C2E660E9B428F45FE96DF3F70590C779C756206C227E376318BBCD3346203D7DEDE4D33B47EC
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):287
      Entropy (8bit):5.28970433377617
      Encrypted:false
      SSDEEP:
      MD5:E6E624BAF1685607D3E018568A874CD7
      SHA1:2B563233EFC9676817AE0FB57D75EAAB3CD74838
      SHA-256:6F1127704A800B95D5B1B8953B84D4E60242FC5811F7157557C05B0BE1C8688C
      SHA-512:377B4D9609D0B6F2F42031B0394A7AF81BCB36151F3CEAE2A6206360E571985DC1402DD829F4D2080C2A4464898A16D5A147B47E46A2943207849C9F2110E764
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):1026
      Entropy (8bit):5.63549525140274
      Encrypted:false
      SSDEEP:
      MD5:B98467A4BFF7A100DADFCDCD4BEFC36E
      SHA1:6ED8D0EF35FE88BC786F4DDF97A024E0532E40E0
      SHA-256:28365363D357B519D795219B3A20D9682B8D3E1FE8C14A07A991FA5EC03ECE6D
      SHA-512:19153A1A85BE63EE1CC3D92739BDB05982D6A8B2DFB9DAC04508C4094CB593F884896F1A2E8D2461B9BC66815FDD4D179F0D57CE16C12F5FF31F32785BE24CE2
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"92038_285529ActionBlock_0","campaignId":92038,"containerId":"1","controlGroupId":"","treatmentId":"6291f52b-6cb0-4d31-bc46-37ce85e9eb25","variationId":"285529"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1751323379000,"s

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):286
      Entropy (8bit):5.267641231559211
      Encrypted:false
      SSDEEP:
      MD5:D8D89238D0D986E4B8FCB6EE6FE4C120
      SHA1:2CFBE0C53FD1240647708776350AB8EBB4A57FCD
      SHA-256:26E20495C2A50D07FB74FD6C01B719A4532656CE205036219D31EB7411C6E646
      SHA-512:AB33E9D098673AB6E35CFE0A4DDD2F0C8A08245531CF83837CEEBEC18BE060A1784390EABAA840A8408C02696747624FECD1524D4AF66CA9D9D2BA36123654AD
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):782
      Entropy (8bit):5.3664524217394725
      Encrypted:false
      SSDEEP:
      MD5:BF5E6BB75E43C1FF01CC895773A3BA93
      SHA1:9BCA46AA8D3F42B8BF42339C067089EC455F1C5D
      SHA-256:1649515BCE044CD3861D1C01BC68100492FED14095C17C4D74240F86B2DBBC47
      SHA-512:8407D015A59935A1CF92108F2E52CA516E6AD5D49656DF2F6E161105BC6FAC963E86F8B1D95DB6C0C07341E98F1CC2E68E4940BDDD9860315B089C8094E2056D
      Malicious:false
      Reputation:unknown
      Preview:{"analyticsData":{"responseGUID":"7a6f96c7-8753-4410-9907-be7b607a1ec5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729957506134,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1729779381168}}}}

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:data
      Category:dropped
      Size (bytes):4
      Entropy (8bit):0.8112781244591328
      Encrypted:false
      SSDEEP:
      MD5:DC84B0D741E5BEAE8070013ADDCC8C28
      SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
      SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
      SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
      Malicious:false
      Reputation:unknown
      Preview:....

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:JSON data
      Category:dropped
      Size (bytes):2818
      Entropy (8bit):5.133212534949926
      Encrypted:false
      SSDEEP:
      MD5:4B610571D54517312FEEF8932DF278A4
      SHA1:3D024908196F8B65E02839CB3C0B081313AB0551
      SHA-256:D669C2F0BA3DA697B6C7DF15227F4D9E44769F7E4D5BBFB5919C70A41D9F19BD
      SHA-512:080BD84216697F01DD66A689510134B0C2766515701FE0446B2D214F8755F653B91EA7BAAFF9F8EE64E031A1116968BC99CF212E41A130FD2C44AEA069EBF318
      Malicious:false
      Reputation:unknown
      Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"773aa8d218723f423d6da21460e60298","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1729779381000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3ed83c34a2c2b311a86b8f4a7c499f16","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1729779380000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"21d0c156de8776686e8f3fe32eda68cb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1026,"ts":1729779380000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"1c02688054a5ff6dbe90a5033002f8da","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1055,"ts":1729779380000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"cb53f2602fcc5f66e81ffff2a4c7f264","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1729779380000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"a1b9598833ebf19af5d238091a8f86e9","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"t

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
      Category:dropped
      Size (bytes):12288
      Entropy (8bit):0.9888149416874573
      Encrypted:false
      SSDEEP:
      MD5:57864AB0A3CB78D9BFD3AE8C45A1897A
      SHA1:D4729310E0D4C98EB0F96B9D35E132599811C5CF
      SHA-256:734A9255C9A8C9B33A5922B679F2A8C37DA27DECEEBBCC6DDE4FA2222604BBBA
      SHA-512:16CAA82D41078007F45C4C86A24A2E6CAAF972DF22E75B1E30307D233B55A8F1BAB3C4DA31B777CB53941F410F7DA32E475489F4156200ED9A49CA7281174477
      Malicious:false
      Reputation:unknown
      Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:SQLite Rollback Journal
      Category:dropped
      Size (bytes):8720
      Entropy (8bit):1.3451612950570084
      Encrypted:false
      SSDEEP:
      MD5:88930B82B89D8B6DA4CF3E912BC46D08
      SHA1:7FD5D0894412D6F376638F637B2C81865F08C30C
      SHA-256:093A1BD1A423F8FF2748FA114AE5BD2D4C5785BDFD8DA3916BFAC4857E4AFDE0
      SHA-512:D33E8E544E4F96CBBF265196331C8358D379C5FD1354791AE078717C215002AEFF0EEF549766491D8D6F8C74559B262E4D19B22E4B4C09632F1E9FCFC6435AE8
      Malicious:false
      Reputation:unknown
      Preview:.... .c........A......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:data
      Category:dropped
      Size (bytes):245980
      Entropy (8bit):4.206961353685366
      Encrypted:false
      SSDEEP:
      MD5:59D925F96594608333A227B5B6524057
      SHA1:90139894085223EBCBBA249CEF08761DA96C52DE
      SHA-256:6130DF9724565AB1A3D4124CB9CC11CF57D88EB3D0F6327B5142062386C7EFFD
      SHA-512:72729AFA01D67DD35DDEE4759D60FE0A05314E4A1361650FB7C5477F15B984F598EDF4978A2E2BC3545BBDA23031CDF3BFF312A3D2F16BD6BD77AA13AE0EC23D
      Malicious:false
      Reputation:unknown
      Preview:TH02...... ..;.F.&......SM01........`.C..&..........IPM.TaskRequest.Decline........h...............h............H..hT.V.....2.e....h............H..h\cal ...pDat...h8.j.0.....V....hb..y..h........h........_`Rk...h...yH...I.lw...h....P...8.Wk...0....\...............l.........2h...............k...........F..!h.............. h.c.......V...#h....8.........$h........@....."hP.i.......i...'h..s...........1hb..y..........0h.........Wk../h..........WkH..h8lh. ...T.V...-h ...0.....V...+h.y4...H.V.........M.i.c.r. ..............FS..............FIPM.TaskRequest.Decline.Form.d.dStandard.PM.Task Decline.PM.IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1111110000000000.icrMicrosoft.isThis form is used to decline a task request.........kf...... ..........&...........(.......(... ...@...............................................................................................................................D@..............D@x.............DG...p..........DH..www.wwp.....

      C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:ASCII text, with very long lines (65536), with no line terminators
      Category:dropped
      Size (bytes):322260
      Entropy (8bit):4.000299760592446
      Encrypted:false
      SSDEEP:
      MD5:CC90D669144261B198DEAD45AA266572
      SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
      SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
      SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
      Malicious:false
      Reputation:unknown
      Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

      C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:ASCII text, with no line terminators
      Category:dropped
      Size (bytes):10
      Entropy (8bit):2.1219280948873624
      Encrypted:false
      SSDEEP:
      MD5:7060DF57AFCAD07EDB238D44799BAC71
      SHA1:1EC6791B65C87BF895D69EF5D8A0F69507384F90
      SHA-256:D61E8940C0726D69D726ADF9567982A7A28B162B9B49DD68852315FB12F8737A
      SHA-512:11D9562312A830E3A9895544694D8A843EB2914CE6429D555228BAEA8961769FDB29E6D466D678E4B049CB711037D8FE00B8B09EB028D34112A8A87B0E70E259
      Malicious:false
      Reputation:unknown
      Preview:1729779372

      C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:data
      Category:dropped
      Size (bytes):32768
      Entropy (8bit):0.04591939678467531
      Encrypted:false
      SSDEEP:
      MD5:C314A2BCF286D633C7B8849DA70217FE
      SHA1:87AFD4AD82DD2D4A88F468CDBDA10BF5D5AB2F63
      SHA-256:4CCE16B27973C3F2BE4418078455C757C5743255DB276C174BAB362B251E9317
      SHA-512:697EF666B2DDB73DF85DF0917ADFE9DD29EAB132515BD1AC83D8E160B30AEEE781AA186BCDC1D02AD25B07BBE34DB084CB4402998A4CC208F445F32E4D965A48
      Malicious:false
      Reputation:unknown
      Preview:..-......................WP.@..y....L.~.7.!`v!..-......................WP.@..y....L.~.7.!`v!........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:SQLite Write-Ahead Log, version 3007000
      Category:modified
      Size (bytes):49472
      Entropy (8bit):0.4828872140355741
      Encrypted:false
      SSDEEP:
      MD5:6822D6E1529D0A706D991C5CFA848AD7
      SHA1:D08481E1A33C015CEE5912CB9138C3A8316D1B36
      SHA-256:24B6B9DA77C5C2925B7AB25CC8FC0C4F95E8F2E5F74E099BE6A5E01A63887F83
      SHA-512:24B3D78A3C6AC03A3B21C9CEE74978491C3D255173C21207BACA71458AD1605D7ADB3CC44B48C2F22EC5AD243CDA7DAF55740037D7B09140C69B316FD00714CB
      Malicious:false
      Reputation:unknown
      Preview:7....-..........y....L.....yF........y....L.dU.R(...SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Age40.jpeg

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=17, description=, manufacturer=HUAWEI, model=AMN-LX2, orientation=[*0*], xresolution=314, yresolution=322, resolutionunit=2, software=MediaTek Camera Application, datetime=2020:06:21 12:34:34], baseline, precision 8, 1232x2560, components 3
      Category:dropped
      Size (bytes):376660
      Entropy (8bit):7.335955034340647
      Encrypted:false
      SSDEEP:
      MD5:4DB069420E93F6D9E7B4BF9951898904
      SHA1:6522BCBD4C80E4B629383FE3115DB96A5F024AB3
      SHA-256:15D246AF8E763132EBE98A3E26CFB4B3FDF8056EA660E8E6B99E11DD86ED946C
      SHA-512:61E19D746A4F0B9CAC35982735F1E7BDF1B38BAB4613B55AB283C84BB122B49BCC68FD46EC110568007973FB94EC9F5390FB4786620F5C141BA110964ACA3439
      Malicious:false
      Reputation:unknown
      Preview:.....|Exif..II*........... ........... ........... ...........................:...........B...(...........1... ...J...2.......j............... ...........!..........."...........#...........$...........%... ...~...i...........>...................................HUAWEI..........................AMN-LX2.........................H.......H.......MediaTek Camera Application.....2020:06:21 12:34:34..........................................................."...........'...................0220............................................ ...............................................(...|.......0...........78..........78..........78..........0100................................................................................6.................................,...;........2020:06:21 12:34:34.2020:06:21 12:34:34.................AF_MF.d...d.....................................................(...................................................H.......H.................R98.........0100..............

      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Civoc Committee Member Re-Appointment (002).pdf

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:PDF document, version 1.4, 1 pages
      Category:dropped
      Size (bytes):45931
      Entropy (8bit):7.268843940466701
      Encrypted:false
      SSDEEP:
      MD5:B07749AAE84E1F7FFD820ED7FFBC13A6
      SHA1:FFF18C6DCD7F89947CAF0D136CAA75A12F3972D9
      SHA-256:220B082CCA754D2A60DCB6BB7C0B68CFAEAF3D7AC4E44FC484D83C9AFA46649C
      SHA-512:2340232B99007F2D9D26F2EFE563E6D1A9EED1244BEAC2D06FA5B6FB841918D7A0BDC5BB516B161105CCDB0D89E22A1100E750B12AE50E25EB6863F32C7F9BE8
      Malicious:false
      Reputation:unknown
      Preview:%PDF-1.4.%......1 0 obj.<< /Type /Catalog./Pages 2 0 R.>>.endobj..2 0 obj.<< /Type /Pages./Kids [4 0 R]./Count 1.>>.endobj..3 0 obj.<< /ProcSet [/PDF /Text /ImageB /ImageC /ImageI]./XObject << /XIPLAYER0 6 0 R./XIPLAYER_CM1 7 0 R./XIPLAYER_CM2 9 0 R./XIPLAYER_CM3 10 0 R./XIPLAYER_CM4 11 0 R./XIPLAYER_CM5 12 0 R./XIPLAYER_CM6 13 0 R.>>..>>.endobj..4 0 obj.<< /Type /Page./Parent 2 0 R./Resources 3 0 R./MediaBox [0 0 596 842]./Contents 5 0 R.>>.endobj..5 0 obj.<< /Length 270./Filter /FlateDecode.>>..stream.x...N.0.......`l.....@.&........@....E......R..YY.m.P._....e.8.......'...w./7OX..K.q..!......(Z.0.i.B..l@.T.`...{.....J....kS.......A.@..t....1.....C...3ZwY......T.-.#j. ...Q...?. ..H.m..'..[.].S!..-F.B402.......Gl ....i...~..0.......(.f..30....v.7.}...endstream.endobj..6 0 obj.<< /Length 23302./Type /XObject./Subtype /Image./BitsPerComponent 8./Width 832./Height 1184./ColorSpace /DeviceRGB./Filter /DCTDecode./DecodeParms << >>..>>..stream......C.......................

      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Civoc Committee Member Re-Appointment (002).pdf:Zone.Identifier (copy)

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:PDF document, version 1.4, 1 pages
      Category:dropped
      Size (bytes):0
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:B07749AAE84E1F7FFD820ED7FFBC13A6
      SHA1:FFF18C6DCD7F89947CAF0D136CAA75A12F3972D9
      SHA-256:220B082CCA754D2A60DCB6BB7C0B68CFAEAF3D7AC4E44FC484D83C9AFA46649C
      SHA-512:2340232B99007F2D9D26F2EFE563E6D1A9EED1244BEAC2D06FA5B6FB841918D7A0BDC5BB516B161105CCDB0D89E22A1100E750B12AE50E25EB6863F32C7F9BE8
      Malicious:false
      Reputation:unknown
      Preview:%PDF-1.4.%......1 0 obj.<< /Type /Catalog./Pages 2 0 R.>>.endobj..2 0 obj.<< /Type /Pages./Kids [4 0 R]./Count 1.>>.endobj..3 0 obj.<< /ProcSet [/PDF /Text /ImageB /ImageC /ImageI]./XObject << /XIPLAYER0 6 0 R./XIPLAYER_CM1 7 0 R./XIPLAYER_CM2 9 0 R./XIPLAYER_CM3 10 0 R./XIPLAYER_CM4 11 0 R./XIPLAYER_CM5 12 0 R./XIPLAYER_CM6 13 0 R.>>..>>.endobj..4 0 obj.<< /Type /Page./Parent 2 0 R./Resources 3 0 R./MediaBox [0 0 596 842]./Contents 5 0 R.>>.endobj..5 0 obj.<< /Length 270./Filter /FlateDecode.>>..stream.x...N.0.......`l.....@.&........@....E......R..YY.m.P._....e.8.......'...w./7OX..K.q..!......(Z.0.i.B..l@.T.`...{.....J....kS.......A.@..t....1.....C...3ZwY......T.-.#j. ...Q...?. ..H.m..'..[.].S!..-F.B402.......Gl ....i...~..0.......(.f..30....v.7.}...endstream.endobj..6 0 obj.<< /Length 23302./Type /XObject./Subtype /Image./BitsPerComponent 8./Width 832./Height 1184./ColorSpace /DeviceRGB./Filter /DCTDecode./DecodeParms << >>..>>..stream......C.......................

      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\FullPic (002).jpg

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=9], baseline, precision 8, 2304x4096, components 3
      Category:dropped
      Size (bytes):1991997
      Entropy (8bit):7.937165931365252
      Encrypted:false
      SSDEEP:
      MD5:5B7B25B7E28506CE279B30274AF312F2
      SHA1:2914CD24FF656E8706430C8D95030228ADC94EBB
      SHA-256:4936EDA68D7A3A3CB828EC681B129818602B1458BC92DC353D8BF750A4AD2B9A
      SHA-512:1C9AC0957BC90B42C00B838525EA56352DAD69B9169538BAF1F3AC6D13E68275446A668EF70AF926196B3EFEC9BAB734365E0F0CFD5AF9BED9A40820E2220FE9
      Malicious:false
      Reputation:unknown
      Preview:....P.Exif..MM.*..............ZTE............z.........................(...........2.......................i...........%..............ZTE T920.\...H.......H....2018:06:30 09:01:39................"...........'.......2..........0220.......................2.......................F...........N...........V...................................^.|.........f...........t...........|....................0100............................................................................................................................................................2018:06:30 09:01:39.2018:06:30 09:01:39...*=...........d.......d.........5............436594.;436594..436594.`...o..............R98.........0100.............................d.....................................".(.....................*..........M^.......H.......H............................................. $.' ",#..(7),01444.'9=82<.342...........2!.!22222222222222222222222222222222222222222222222222........ .."..............................

      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\FullPic (002).jpg:Zone.Identifier (copy)

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=17, description=, manufacturer=HUAWEI, model=AMN-LX2, orientation=[*0*], xresolution=314, yresolution=322, resolutionunit=2, software=MediaTek Camera Application, datetime=2020:06:21 12:34:34], baseline, precision 8, 1232x2560, components 3
      Category:dropped
      Size (bytes):0
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:4DB069420E93F6D9E7B4BF9951898904
      SHA1:6522BCBD4C80E4B629383FE3115DB96A5F024AB3
      SHA-256:15D246AF8E763132EBE98A3E26CFB4B3FDF8056EA660E8E6B99E11DD86ED946C
      SHA-512:61E19D746A4F0B9CAC35982735F1E7BDF1B38BAB4613B55AB283C84BB122B49BCC68FD46EC110568007973FB94EC9F5390FB4786620F5C141BA110964ACA3439
      Malicious:false
      Reputation:unknown
      Preview:.....|Exif..II*........... ........... ........... ...........................:...........B...(...........1... ...J...2.......j............... ...........!..........."...........#...........$...........%... ...~...i...........>...................................HUAWEI..........................AMN-LX2.........................H.......H.......MediaTek Camera Application.....2020:06:21 12:34:34..........................................................."...........'...................0220............................................ ...............................................(...|.......0...........78..........78..........78..........0100................................................................................6.................................,...;........2020:06:21 12:34:34.2020:06:21 12:34:34.................AF_MF.d...d.....................................................(...................................................H.......H.................R98.........0100..............

      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Portfolio (002).pdf:Zone.Identifier

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:ASCII text, with CRLF line terminators
      Category:dropped
      Size (bytes):26
      Entropy (8bit):3.95006375643621
      Encrypted:false
      SSDEEP:
      MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
      SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
      SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
      SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
      Malicious:false
      Reputation:unknown
      Preview:[ZoneTransfer]..ZoneId=3..

      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Portfolio.pdf

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:PDF document, version 1.4, 19 pages
      Category:dropped
      Size (bytes):2988434
      Entropy (8bit):7.96712292630859
      Encrypted:false
      SSDEEP:
      MD5:886BD460986CD5D08CC71371370A5CE8
      SHA1:E90C9305EDCB6B9E6D1426670A920C22325EF8D6
      SHA-256:FAE55B539E06B1B9355E2674F35F3AC33B61F94C54FEA6BE36AC1E51CD26E526
      SHA-512:A902988CA728AD28F6317587B0578601E37D35A973C3F4988498D369D75A5027D2126FC9D14F6BC80FC8F1C1B18F771CF1D1FD08B59F537B4CF3ED53900FCCA4
      Malicious:false
      Reputation:unknown
      Preview:%PDF-1.4.%...5 0 obj.<</Length 6 0 R/Filter /FlateDecode>>.stream.x.+T0.3.P0.A.#9.K?.\!.....3475V.55..I=#c.cC#.2...|.@.....*-.U..[..`.E...Di ...>..endstream.endobj.6 0 obj.82.endobj.14 0 obj.<</Length 15 0 R/Filter /FlateDecode>>.stream.x.+T0.3.P0.A.#9.K?.\!.....3475V.55..I=#c.cC#.2C3..|.@.....J....[..`.U..Di ...< .endstream.endobj.15 0 obj.82.endobj.22 0 obj.<</Length 23 0 R/Filter /FlateDecode>>.stream.x.+T0.3.P0.A.#9.K?.\!.....3475V.55..I=#c.cC#.2#...|.@.....JM...[..`.U..Di .... .endstream.endobj.23 0 obj.82.endobj.30 0 obj.<</Length 31 0 R/Filter /FlateDecode>>.stream.x.+T0.3.P0.A.#9.K?.\!.....3475V.55..I=#c.cC#.2c#..|.@.....J....[..`.U..Di .... .endstream.endobj.31 0 obj.82.endobj.38 0 obj.<</Length 39 0 R/Filter /FlateDecode>>.stream.x.+T0.3.P0.A.#9.K?.\!.....3475V.55..I=#c.cC#.2....|.@.....J....[..`.U..Di ...q .endstream.endobj.39 0 obj.82.endobj.46 0 obj.<</Length 47 0 R/Filter /FlateDecode>>.stream.x.+T0.3.P0.A.#9.K?.\!.....3475V.55..I=#c.cC#.2...|.@.....J-...[..`

      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Qualifications (002).pdf

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:PDF document, version 1.4, 6 pages
      Category:dropped
      Size (bytes):1062785
      Entropy (8bit):7.920551976531359
      Encrypted:false
      SSDEEP:
      MD5:E2E10B77B6E765F10953A4B51FA9ACBC
      SHA1:CDB1045B150E6B7B9AAB092B5AB2ECAED810DB35
      SHA-256:731F3970385A23BF9723126A9DE578A05D390958DC9AB961EDAA1EC4194318BD
      SHA-512:94DEA9555364D4F53C573EC673E41813221EDDF5F2EAA5548047657027CD29287A2EF67C4E0941FE5409B542B2EDFBFC77E1ABC48D437ACC64EB406D145F10F7
      Malicious:false
      Reputation:unknown
      Preview:%PDF-1.4.%...%%Invocation: path/gswin32c.exe -dDisplayFormat=198788 -dDisplayResolution=96 --permit-file-all=C:\Users\SIVUYI~1\AppData\Local\Temp\PDFCRE~1\Temp\JOB_0A~1\ -I? -sFONTPATH=? -dNOPAUSE -dBATCH -sOutputFile=? -sDEVICE=pdfwrite -dCompatibilityLevel=1.4.%%+ -dPDFSETTINGS=/default -dEmbedAllFonts=true -dAutoRotatePages=/PageByPage -dParseDSCComments=false -sColorConversionStrategy=RGB -dProcessColorModel=/DeviceRGB -dConvertCMYKImagesToRGB=true -dAutoFilterColorImages=true -dAutoFilterGrayImages=true.%%+ -dEncodeColorImages=true -dEncodeGrayImages=true -dColorImageFilter=/DCTEncode -dGrayImageFilter=/DCTEncode -dEncodeMonoImages=true -dMonoImageFilter=/CCITTFaxEncode -f ?.5 0 obj.<</Length 6 0 R/Filter /FlateDecode>>.stream.x.+T0.37U0.A.#9...H....)...........HV?.\.%.+.I...1.m."..Y@..r.. ...endstream.endobj.6 0 obj.68.endobj.11 0 obj.<</Length 12 0 R/Filter /FlateDecode>>.stream.x.+T0.37U0.A.#9...H....)...........HV?..X.%.+.I...1.m."..@..r..H&..endstream.endobj.12 0 obj.69.

      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\Qualifications (002).pdf:Zone.Identifier (copy)

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:PDF document, version 1.4, 6 pages
      Category:dropped
      Size (bytes):0
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:E2E10B77B6E765F10953A4B51FA9ACBC
      SHA1:CDB1045B150E6B7B9AAB092B5AB2ECAED810DB35
      SHA-256:731F3970385A23BF9723126A9DE578A05D390958DC9AB961EDAA1EC4194318BD
      SHA-512:94DEA9555364D4F53C573EC673E41813221EDDF5F2EAA5548047657027CD29287A2EF67C4E0941FE5409B542B2EDFBFC77E1ABC48D437ACC64EB406D145F10F7
      Malicious:false
      Reputation:unknown
      Preview:%PDF-1.4.%...%%Invocation: path/gswin32c.exe -dDisplayFormat=198788 -dDisplayResolution=96 --permit-file-all=C:\Users\SIVUYI~1\AppData\Local\Temp\PDFCRE~1\Temp\JOB_0A~1\ -I? -sFONTPATH=? -dNOPAUSE -dBATCH -sOutputFile=? -sDEVICE=pdfwrite -dCompatibilityLevel=1.4.%%+ -dPDFSETTINGS=/default -dEmbedAllFonts=true -dAutoRotatePages=/PageByPage -dParseDSCComments=false -sColorConversionStrategy=RGB -dProcessColorModel=/DeviceRGB -dConvertCMYKImagesToRGB=true -dAutoFilterColorImages=true -dAutoFilterGrayImages=true.%%+ -dEncodeColorImages=true -dEncodeGrayImages=true -dColorImageFilter=/DCTEncode -dGrayImageFilter=/DCTEncode -dEncodeMonoImages=true -dMonoImageFilter=/CCITTFaxEncode -f ?.5 0 obj.<</Length 6 0 R/Filter /FlateDecode>>.stream.x.+T0.37U0.A.#9...H....)...........HV?.\.%.+.I...1.m."..Y@..r.. ...endstream.endobj.6 0 obj.68.endobj.11 0 obj.<</Length 12 0 R/Filter /FlateDecode>>.stream.x.+T0.37U0.A.#9...H....)...........HV?..X.%.+.I...1.m."..@..r..H&..endstream.endobj.12 0 obj.69.

      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\SACAP Recommendation Panel Member (002).pdf:Zone.Identifier (copy)

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:PDF document, version 1.4, 1 pages
      Category:dropped
      Size (bytes):0
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:FE762CCF8A67ED2C0605907B650E337A
      SHA1:159C76B4F924AF995DB470E7E399CC79E695F65A
      SHA-256:EDD3576AF1F785B9DB7448E3833AF675C0C38DA7D7C385AE92DBF2592BFB6578
      SHA-512:0D2FA92FE7EBBF921028473F905473424DB4C702DBAE26B0A7F4D4742842E88799FF1F6AEE81657DCD366938BD2CCC24CA8A08C20DC3E727B34EE0F35220C990
      Malicious:false
      Reputation:unknown
      Preview:%PDF-1.4.%...%%Invocation: path/gswin32c.exe -dDisplayFormat=198788 -dDisplayResolution=96 -I? -sFONTPATH=? -dNOPAUSE -dBATCH -sOutputFile=? -sDEVICE=pdfwrite -dCompatibilityLevel=1.4 -dPDFSETTINGS=/default -dEmbedAllFonts=true -dAutoRotatePages=/PageByPage.%%+ -dParseDSCComments=false -sColorConversionStrategy=RGB -dProcessColorModel=/DeviceRGB -dConvertCMYKImagesToRGB=true -dAutoFilterColorImages=true -dAutoFilterGrayImages=true -dEncodeColorImages=true -dEncodeGrayImages=true -dColorImageFilter=/DCTEncode.%%+ -dGrayImageFilter=/DCTEncode -dEncodeMonoImages=true -dMonoImageFilter=/CCITTFaxEncode -f ?.5 0 obj.<</Length 6 0 R/Filter /FlateDecode>>.stream.x.+T0.37U0.A.#9.K?.\!.....3442R.55..I=C.s.."...|.@$eF..@.9.DRf.Q.....m.=endstream.endobj.6 0 obj.73.endobj.4 0 obj.<</Type/Page/MediaBox [0 0 595 842]./Parent 3 0 R./Resources<</ProcSet[/PDF /ImageC]./ExtGState 10 0 R./XObject 11 0 R.>>./Contents 5 0 R.>>.endobj.3 0 obj.<< /Type /Pages /Kids [.4 0 R.] /Count 1.>>.endobj.1 0 obj.<</T

      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\SACAP Recommendation Panel Member.pdf

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:PDF document, version 1.4, 1 pages
      Category:dropped
      Size (bytes):47215
      Entropy (8bit):7.505165303028909
      Encrypted:false
      SSDEEP:
      MD5:FE762CCF8A67ED2C0605907B650E337A
      SHA1:159C76B4F924AF995DB470E7E399CC79E695F65A
      SHA-256:EDD3576AF1F785B9DB7448E3833AF675C0C38DA7D7C385AE92DBF2592BFB6578
      SHA-512:0D2FA92FE7EBBF921028473F905473424DB4C702DBAE26B0A7F4D4742842E88799FF1F6AEE81657DCD366938BD2CCC24CA8A08C20DC3E727B34EE0F35220C990
      Malicious:false
      Reputation:unknown
      Preview:%PDF-1.4.%...%%Invocation: path/gswin32c.exe -dDisplayFormat=198788 -dDisplayResolution=96 -I? -sFONTPATH=? -dNOPAUSE -dBATCH -sOutputFile=? -sDEVICE=pdfwrite -dCompatibilityLevel=1.4 -dPDFSETTINGS=/default -dEmbedAllFonts=true -dAutoRotatePages=/PageByPage.%%+ -dParseDSCComments=false -sColorConversionStrategy=RGB -dProcessColorModel=/DeviceRGB -dConvertCMYKImagesToRGB=true -dAutoFilterColorImages=true -dAutoFilterGrayImages=true -dEncodeColorImages=true -dEncodeGrayImages=true -dColorImageFilter=/DCTEncode.%%+ -dGrayImageFilter=/DCTEncode -dEncodeMonoImages=true -dMonoImageFilter=/CCITTFaxEncode -f ?.5 0 obj.<</Length 6 0 R/Filter /FlateDecode>>.stream.x.+T0.37U0.A.#9.K?.\!.....3442R.55..I=C.s.."...|.@$eF..@.9.DRf.Q.....m.=endstream.endobj.6 0 obj.73.endobj.4 0 obj.<</Type/Page/MediaBox [0 0 595 842]./Parent 3 0 R./Resources<</ProcSet[/PDF /ImageC]./ExtGState 10 0 R./XObject 11 0 R.>>./Contents 5 0 R.>>.endobj.3 0 obj.<< /Type /Pages /Kids [.4 0 R.] /Count 1.>>.endobj.1 0 obj.<</T

      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\heyyo_1622491349820_2865035801737406320 (002).jpg:Zone.Identifier (copy)

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 700x700, components 3
      Category:dropped
      Size (bytes):0
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:765B23491FEE21EBE2902EC8D517AEA8
      SHA1:1FAEE0EA06B20F2EA751F05DFB2C5FC251DBA9C6
      SHA-256:3DE4D276B05C79CE905FFCBD037EF913B2D57FD983089F92DEE75D05F22FFC4B
      SHA-512:47D70266BFE2894D2D89E395F1F5DE7A97D443A4BB4410B33C42AB116474599D74639ACE63A65A4C3DFC471A33BD9E0974809AAAF90717480F0FDF0590D71984
      Malicious:false
      Reputation:unknown
      Preview:......JFIF.............(ICC_PROFILE...............mntrRGB XYZ ............acsp.......................................-....................................................desc.......trXYZ...d....gXYZ...x....bXYZ........rTRC.......(gTRC.......(bTRC.......(wtpt........cprt.......<mluc............enUS...X.....s.R.G.B................................................................................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........para..........ff......Y.......[........XYZ ...............-mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................".........................................M..........................!1.."AQa.q..#2...BR......3..$b.4CSr..%&c...s..Dt..................................+........................1.!2AQa.."3.B.#..............?....N.+Ic.I...6.sR.F...v.....OJ...:...........>..P..3A...`>......>

      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\0KMBSEFF\heyyo_1622491349820_2865035801737406320.jpg

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 700x700, components 3
      Category:dropped
      Size (bytes):135836
      Entropy (8bit):7.96762033473387
      Encrypted:false
      SSDEEP:
      MD5:765B23491FEE21EBE2902EC8D517AEA8
      SHA1:1FAEE0EA06B20F2EA751F05DFB2C5FC251DBA9C6
      SHA-256:3DE4D276B05C79CE905FFCBD037EF913B2D57FD983089F92DEE75D05F22FFC4B
      SHA-512:47D70266BFE2894D2D89E395F1F5DE7A97D443A4BB4410B33C42AB116474599D74639ACE63A65A4C3DFC471A33BD9E0974809AAAF90717480F0FDF0590D71984
      Malicious:false
      Reputation:unknown
      Preview:......JFIF.............(ICC_PROFILE...............mntrRGB XYZ ............acsp.......................................-....................................................desc.......trXYZ...d....gXYZ...x....bXYZ........rTRC.......(gTRC.......(bTRC.......(wtpt........cprt.......<mluc............enUS...X.....s.R.G.B................................................................................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........para..........ff......Y.......[........XYZ ...............-mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................".........................................M..........................!1.."AQa.q..#2...BR......3..$b.4CSr..%&c...s..Dt..................................+........................1.!2AQa.."3.B.#..............?....N.+Ic.I...6.sR.F...v.....OJ...:...........>..P..3A...`>......>

      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{7F785987-736A-47C9-82C8-2153B0AE9ADC}.tmp

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:data
      Category:dropped
      Size (bytes):1536
      Entropy (8bit):0.05040082585602993
      Encrypted:false
      SSDEEP:
      MD5:05AFCB863358468C56B59B6970828132
      SHA1:062F82DECE3B5C7A83A7F81555A92ECD532BC17B
      SHA-256:F2D3729D9F8F5521C28D22E206B36A2377572CB65D41F4C0BE42C188C49DD323
      SHA-512:BA4F38E5642BEE7A2E102057FB6E6D8FCF49E03B6DAD2CFF84B8C6C2419FC6EDF2EFBB8499A829DBB986B21E2B33B505095087734BA2B906C24589049A8D84C5
      Malicious:false
      Reputation:unknown
      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729779367826265900_105FAFC8-0F72-4621-8E6C-43E5BAFB6981.log

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:ASCII text, with very long lines (28783), with CRLF line terminators
      Category:dropped
      Size (bytes):20971520
      Entropy (8bit):0.16086660595155983
      Encrypted:false
      SSDEEP:
      MD5:C81F625855EA8EDBBEE3DA1FCBAE11E8
      SHA1:3F5FE30FC5361D778F2BAD6A3592B4396E7CDEA0
      SHA-256:2F507F23333F5125A2CE69FC50D00E794977EF3FEA562C827784ED2AC15B3CA2
      SHA-512:9E398CBF47407FCFEB5358D15CB0C1D4D71CAB3876DD182F45F6DA502A0DA44E8954289247FA54BABBA0947452A03AC076DBF17F5C63F2F295E30E3F71F32012
      Malicious:false
      Reputation:unknown
      Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/24/2024 14:16:07.874.OUTLOOK (0x1814).0x1810.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":27,"Time":"2024-10-24T14:16:07.874Z","Contract":"Office.System.Activity","Activity.CV":"yK9fEHIPIUaObEPluvtpgQ.4.11","Activity.Duration":17,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/24/2024 14:16:07.890.OUTLOOK (0x1814).0x1810.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":29,"Time":"2024-10-24T14:16:07.890Z","Contract":"Office.System.Activity","Activity.CV":"yK9fEHIPIUaObEPluvtpgQ.4.12","Activity.Duration":12485,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajor

      C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729779367827837000_105FAFC8-0F72-4621-8E6C-43E5BAFB6981.log

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:data
      Category:dropped
      Size (bytes):20971520
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
      SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
      SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
      SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
      Malicious:false
      Reputation:unknown
      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Temp\MSI1a80d.LOG

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
      Category:dropped
      Size (bytes):246
      Entropy (8bit):3.493870954423123
      Encrypted:false
      SSDEEP:
      MD5:1C8ED2C85264770DD8A6C2650149B125
      SHA1:43A6224D7C86439C05B77C85E9C0C552F46ECB5B
      SHA-256:EC133684CE5AAD7B385EEE777D57582BC8E702731226E41CA02130067CBB845D
      SHA-512:AD799D975E2793AFBFD6D46B33C2CFF2EFE9CD21CFEA9458B635255B7A04665B6A89807E27F165E29843FB0790CC7CFF6F29805EF946A64A6E2641BBE2EC6CC0
      Malicious:false
      Reputation:unknown
      Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.4./.1.0./.2.0.2.4. . .1.0.:.1.6.:.2.1. .=.=.=.....

      C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241024T1015570167-6164.etl

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:data
      Category:dropped
      Size (bytes):98304
      Entropy (8bit):4.475937490912306
      Encrypted:false
      SSDEEP:
      MD5:80C604A1F86826B0A7B6F4342DD7F05A
      SHA1:BFD6F731E82D9B3DF0282FEB384997EEE316CCB4
      SHA-256:B719AD1893D570C367ABE29AE58B5180C4AA797218FED41D593FB72840880923
      SHA-512:02DF4DE48442A17E54ED2D52F12B3BA5CF949C41C4DAB0EE18D16432C103D8BE9B9FD9DF34B496978849EEBA907A966ADEE53F4C238E65E12CE5B57876446A2E
      Malicious:false
      Reputation:unknown
      Preview:............................................................................`............[{>.&..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1.............................................................4..Y...........[{>.&..........v.2._.O.U.T.L.O.O.K.:.1.8.1.4.:.f.9.2.1.d.0.e.2.7.f.f.d.4.e.b.9.9.3.5.3.c.2.5.6.6.a.d.c.3.e.5.8...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.2.4.T.1.0.1.5.5.7.0.1.6.7.-.6.1.6.4...e.t.l.......P.P..........[{>.&..........................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-24 10-16-16-754.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with very long lines (393)
      Category:dropped
      Size (bytes):16525
      Entropy (8bit):5.353642815103214
      Encrypted:false
      SSDEEP:
      MD5:91F06491552FC977E9E8AF47786EE7C1
      SHA1:8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
      SHA-256:06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
      SHA-512:A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
      Malicious:false
      Reputation:unknown
      Preview:SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-24 10-17-12-235.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with very long lines (393)
      Category:dropped
      Size (bytes):16529
      Entropy (8bit):5.328387385644691
      Encrypted:false
      SSDEEP:
      MD5:CBF94260BD00A2849E21C8518798C997
      SHA1:DF8B7F062A69440778F02104A61DE681047FCA22
      SHA-256:598DDF38AF1DA8FD93FD1B8AD6527749F97690A561730C8BC1C5CD6B212BBD20
      SHA-512:D18263485F3690E3698C37EFF4C173737B9E443B75196B30CF8E466CE06987A6F4E9C9A7AF122130076EEF67C3F7AA7CB5A7451FB4459DDE7B61BE6A9B8CB322
      Malicious:false
      Reputation:unknown
      Preview:SessionID=fc49e505-7ff8-4f1c-a7bf-6bf50ae09b77.1729779376764 Timestamp=2024-10-24T10:16:16:764-0400 ThreadID=3996 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=fc49e505-7ff8-4f1c-a7bf-6bf50ae09b77.1729779376764 Timestamp=2024-10-24T10:16:16:766-0400 ThreadID=3996 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=fc49e505-7ff8-4f1c-a7bf-6bf50ae09b77.1729779376764 Timestamp=2024-10-24T10:16:16:766-0400 ThreadID=3996 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=fc49e505-7ff8-4f1c-a7bf-6bf50ae09b77.1729779376764 Timestamp=2024-10-24T10:16:16:767-0400 ThreadID=3996 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=fc49e505-7ff8-4f1c-a7bf-6bf50ae09b77.1729779376764 Timestamp=2024-10-24T10:16:16:767-0400 ThreadID=3996 Component=ngl-lib_NglAppLib Description="SetConfig:

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-24 10-17-29-634.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with very long lines (393)
      Category:dropped
      Size (bytes):16529
      Entropy (8bit):5.328619440153083
      Encrypted:false
      SSDEEP:
      MD5:02E94728FA17CC8C58AB4927275A2DDF
      SHA1:217E39CC8638464442E28A7D1DA034EA88F30F3E
      SHA-256:DF2E166AB7B9D2BAC72803C735836FC74C04800C9D217AC4E4EEDC2E93085211
      SHA-512:B356F7CEB9179E77225ADA6485F7A9B45AD60793044D4BC992F888B56F2C7A910B4CCE061446809CBBB837D2B9706BD4F13227794B3CCF4C0CC6BB768CEE83EC
      Malicious:false
      Reputation:unknown
      Preview:SessionID=f2f84399-1e60-407a-bcb7-a747508cd9f5.1729779432248 Timestamp=2024-10-24T10:17:12:248-0400 ThreadID=4416 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f2f84399-1e60-407a-bcb7-a747508cd9f5.1729779432248 Timestamp=2024-10-24T10:17:12:249-0400 ThreadID=4416 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f2f84399-1e60-407a-bcb7-a747508cd9f5.1729779432248 Timestamp=2024-10-24T10:17:12:249-0400 ThreadID=4416 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f2f84399-1e60-407a-bcb7-a747508cd9f5.1729779432248 Timestamp=2024-10-24T10:17:12:249-0400 ThreadID=4416 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f2f84399-1e60-407a-bcb7-a747508cd9f5.1729779432248 Timestamp=2024-10-24T10:17:12:250-0400 ThreadID=4416 Component=ngl-lib_NglAppLib Description="SetConfig:

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-24 10-17-38-155.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with very long lines (393)
      Category:dropped
      Size (bytes):16529
      Entropy (8bit):5.322658572382513
      Encrypted:false
      SSDEEP:
      MD5:7920734C8AB28929DD1EF675F2E65223
      SHA1:25081E0D95570B01035BD6126A3F3773F3D14D94
      SHA-256:A6C7A93ED9BBB1491338FDD0E8A91479072846BCC1C49A14384689E4FE2316BF
      SHA-512:E7CCFE3A2FC4426DF5D441783DF8DF2B75E8CF9D4C3BB11A7218A0C94FFB3BBA5630CE93651EA09E19DE32B83400BEA3B32897A8403309793A0C392F1BF7A796
      Malicious:false
      Reputation:unknown
      Preview:SessionID=97878fd5-13b1-452f-af75-3701292421f0.1729779449646 Timestamp=2024-10-24T10:17:29:646-0400 ThreadID=4124 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=97878fd5-13b1-452f-af75-3701292421f0.1729779449646 Timestamp=2024-10-24T10:17:29:647-0400 ThreadID=4124 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=97878fd5-13b1-452f-af75-3701292421f0.1729779449646 Timestamp=2024-10-24T10:17:29:647-0400 ThreadID=4124 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=97878fd5-13b1-452f-af75-3701292421f0.1729779449646 Timestamp=2024-10-24T10:17:29:647-0400 ThreadID=4124 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=97878fd5-13b1-452f-af75-3701292421f0.1729779449646 Timestamp=2024-10-24T10:17:29:647-0400 ThreadID=4124 Component=ngl-lib_NglAppLib Description="SetConfig:

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with very long lines (393), with CRLF line terminators
      Category:dropped
      Size (bytes):16603
      Entropy (8bit):5.345862451385527
      Encrypted:false
      SSDEEP:
      MD5:4B315B21B02DA8C9FCDF00EE95D0849B
      SHA1:323913657A47D13453A60BF026BC7F2C2F14C770
      SHA-256:0A9878E16B8290EDEDEEAFDF004C3BD543FF62304331928C59D37D5B4362A819
      SHA-512:88E3B3365AB0C5326DE1070E729AC65089C2C0AB61B2AC743203F0BB81FD6D440D0192570709DD3DEAE8E2283262FE7ECF712C542DCD0E2B82B975A696CE28AC
      Malicious:false
      Reputation:unknown
      Preview:SessionID=fc49e505-7ff8-4f1c-a7bf-6bf50ae09b77.1729779376764 Timestamp=2024-10-24T10:16:16:764-0400 ThreadID=3996 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=fc49e505-7ff8-4f1c-a7bf-6bf50ae09b77.1729779376764 Timestamp=2024-10-24T10:16:16:766-0400 ThreadID=3996 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=fc49e505-7ff8-4f1c-a7bf-6bf50ae09b77.1729779376764 Timestamp=2024-10-24T10:16:16:766-0400 ThreadID=3996 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=fc49e505-7ff8-4f1c-a7bf-6bf50ae09b77.1729779376764 Timestamp=2024-10-24T10:16:16:767-0400 ThreadID=3996 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=fc49e505-7ff8-4f1c-a7bf-6bf50ae09b77.1729779376764 Timestamp=2024-10-24T10:16:16:767-0400 ThreadID=3996 Component=ngl-lib_NglAppLib Description="SetConf

      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
      File Type:ASCII text, with CRLF line terminators
      Category:dropped
      Size (bytes):29845
      Entropy (8bit):5.416380500181731
      Encrypted:false
      SSDEEP:
      MD5:64E6B1B6DCADF0F51B0FFCB61DDE001B
      SHA1:80D73BF0929D30D777E2B640B690D34EB05AF730
      SHA-256:846B8DF17E16AAFA43B4EFF7AA471F00583019E732D05C3028AEAD447AAB538C
      SHA-512:B0D2F83A2020CC1612CEDC0AF17241EB9CA9E6F0B989797E4BC74D202AD675994E08ADE0E35A19AEED20FEFEE958ADEAEB4FCAC6298E5436A8F7396AFFE2C994
      Malicious:false
      Reputation:unknown
      Preview:06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

      C:\Users\user\AppData\Local\Temp\acrocef_low\431bb1ec-b586-47ca-b23b-671e2396e7ab.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
      Category:dropped
      Size (bytes):386528
      Entropy (8bit):7.9736851559892425
      Encrypted:false
      SSDEEP:
      MD5:5C48B0AD2FEF800949466AE872E1F1E2
      SHA1:337D617AE142815EDDACB48484628C1F16692A2F
      SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
      SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
      Malicious:false
      Reputation:unknown
      Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

      C:\Users\user\AppData\Local\Temp\acrocef_low\73642d5c-edb2-4a37-9abd-445d284a4271.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
      Category:dropped
      Size (bytes):386528
      Entropy (8bit):7.9736851559892425
      Encrypted:false
      SSDEEP:
      MD5:774036904FF86EB19FCE18B796528E1E
      SHA1:2BA0EBF3FC7BEF9EF5BFAD32070BD3C785904E16
      SHA-256:D2FC8EA3DDD3F095F7A469927179B408102471627C91275EDB4D7356F8E453AD
      SHA-512:9E9662EA15AE3345166C1E51235CDCE3123B27848E4A4651CC4D2173BDD973E4AD2F8994EFF34A221A9F07AA676F52BEB6D90FF374F6CCB0D06FA39C3EFE6B31
      Malicious:false
      Reputation:unknown
      Preview:...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

      C:\Users\user\AppData\Local\Temp\acrocef_low\75bd1d75-c556-49ee-a90e-d4313f5773e4.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
      Category:dropped
      Size (bytes):758601
      Entropy (8bit):7.98639316555857
      Encrypted:false
      SSDEEP:
      MD5:59EE5E2FB56A099CAA8EDFD7AF821ED6
      SHA1:F5DC4F876768D57B69EC894ADE0A66E813BFED92
      SHA-256:E100AAAA4FB2B3D78E3B6475C3B48BE189C5A39F73CFC2D22423F2CE928D3E75
      SHA-512:77A45C89F6019F92576D88AE67B59F9D6D36BA6FDC020419DAB55DBD8492BA97B3DAC18278EB0210F90758B3D643EA8DCF8EC2BD1481930A59B8BB515E7440FE
      Malicious:false
      Reputation:unknown
      Preview:...........].s..R/c..D@..\......3Z.....E.,...d{.k.~..H3....-......A...<>n.......X..Dp..d......f.{...9&F..........R.UW-..^..zC.kjOUUMm...nW...Z.7.J.R.....=*.R........4..(WCMQ..u]]R...R......5.*..N)].....!.-.d]M....7.......i..rmP...6A.Z .=..~..$C-..}..Mo.T......:._'.S....r.9....6.....r....#...<U@.Iiu..X].T x.j....x...:q.....j]P3......[.5]|..7;.5....^..7(.E..@..s...2..}..j....*...t.5J...6Rf..%P{2T^$Y.V.O9.W...4...\ .5............Q.&j....h.+.u......W...4f]..s..(...:....`.<W_...z*Bs|tF5 NI4.zD..5...u...!........M.0.K%F....,.c.....>R6..i..Am.y.~5..S....M...^......F.&..V...Z.......i....b....V..,.UH"...W...5}A.....KUT..=6jZ.....B...Z...Y(..u...=....x,2..."._Cf.....b...z7..... r..#.r..L9....2...R,..J?&..p..~.....3.=z...w..m..U..%._#<....r.....B.z..G..D.:4m.Z.&.N......</..Dz+.......vn.....;Qhk....!dw...A......3..a..K...).Q.`t[..)].6.%@....v.g.%E>;Z...uz.L..6Ct..O.Eo.O.e..........J.J$...:....K..)......F.....ZWE...z..5..g.io...l2[.,m9X..f......5|:bj[.._R{gi...^

      C:\Users\user\AppData\Local\Temp\acrocef_low\9b2f77f6-b4ce-4186-9495-18c594976c75.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
      Category:dropped
      Size (bytes):1407294
      Entropy (8bit):7.97605879016224
      Encrypted:false
      SSDEEP:
      MD5:1D64D25345DD73F100517644279994E6
      SHA1:DE807F82098D469302955DCBE1A963CD6E887737
      SHA-256:0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
      SHA-512:C0A37437F84B4895A7566E278046CFD50558AD84120CA0BD2EAD2259CA7A30BD67F0BDC4C043D73257773C607259A64B6F6AE4987C8B43BB47241F3C78EB9416
      Malicious:false
      Reputation:unknown
      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

      C:\Users\user\AppData\Local\Temp\acrocef_low\b8732bfd-e386-4991-82c8-33ade5f0783b.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
      Category:dropped
      Size (bytes):1419751
      Entropy (8bit):7.976496077007677
      Encrypted:false
      SSDEEP:
      MD5:FE60ABB4959B314F6FBE62BCC3F63E7E
      SHA1:E4DEB0E21298CD42C94791CC29C88575DD1C4261
      SHA-256:50A67401A02D0BB4FD8A34E4B34D7BFABBF163EDD6A1614083577849D763B93A
      SHA-512:772072EFBEA3F471F8DF01CC892CE6FF825692FB1E76785B9802406D9B011123B0B3E8FE3D64C2A0E252372D8BEF70D4E4D92B1515A6A9313B844B9FE71767AA
      Malicious:false
      Reputation:unknown
      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

      C:\Users\user\AppData\Local\Temp\acrocef_low\cd732d47-2b5f-4884-b173-dff0c27bf264.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
      Category:dropped
      Size (bytes):1419751
      Entropy (8bit):7.976496077007677
      Encrypted:false
      SSDEEP:
      MD5:1A39CAAE4C5F8AD2A98F0756FFCBA562
      SHA1:279F2B503A0B10E257674D31532B01EA7DE0473F
      SHA-256:57D198C7BDB9B002B8C9C1E1CCFABFE81C00FE0A1E30A237196A7C133237AA95
      SHA-512:73D083E92FB59C92049AF8DC31A0AA2F38755453FFB161D18A1C4244747EE88B7A850F7951FC10F842AE65F6CC8F6164231DB6261777EC5379B337CB379BEF99
      Malicious:false
      Reputation:unknown
      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

      C:\Users\user\AppData\Local\Temp\acrocef_low\e008470d-3966-4d83-b70c-c1a5aaf60a5d.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
      Category:dropped
      Size (bytes):1407294
      Entropy (8bit):7.97605879016224
      Encrypted:false
      SSDEEP:
      MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
      SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
      SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
      SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
      Malicious:false
      Reputation:unknown
      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

      C:\Users\user\AppData\Local\Temp\acrocef_low\f6930ab6-5bb3-4f87-89c8-e561795e5e39.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
      Category:dropped
      Size (bytes):1407294
      Entropy (8bit):7.97605879016224
      Encrypted:false
      SSDEEP:
      MD5:AB257B40662354BAC827D038355D38BA
      SHA1:5C70BBD65A030260375E4FEB44D26A396995567F
      SHA-256:B83E3BBACBBC71A96B4EFB330678CFDD07F34CA25AF13916362F1EE74585435C
      SHA-512:659D9B691F5F7FEC2BD2B9A4AF162B86C2F2425B46026EAB920F8E10446C6BF78A65C10E507E84424B457DD9B5A7F84AB30A02EE23153B8AC821DB039CF3AA12
      Malicious:false
      Reputation:unknown
      Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

      C:\Users\user\AppData\Local\Temp\acrocef_low\fcb321d2-937f-46f0-b0d6-e375d4995ac9.tmp

      Download File
      Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
      Category:dropped
      Size (bytes):758601
      Entropy (8bit):7.98639316555857
      Encrypted:false
      SSDEEP:
      MD5:3A49135134665364308390AC398006F1
      SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
      SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
      SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
      Malicious:false
      Reputation:unknown
      Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

      C:\Users\user\AppData\Local\Temp\~DF091E8B326A397A77.TMP

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:data
      Category:dropped
      Size (bytes):512
      Entropy (8bit):0.0
      Encrypted:false
      SSDEEP:
      MD5:BF619EAC0CDF3F68D496EA9344137E8B
      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
      Malicious:false
      Reputation:unknown
      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Temp\~DF4A58D414DBC57E3C.TMP

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:Composite Document File V2 Document, Cannot read section info
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.3613836054883338
      Encrypted:false
      SSDEEP:
      MD5:679672A5004E0AF50529F33DB5469699
      SHA1:427A4EC3281C9C4FAEB47A22FFBE7CA3E928AFB0
      SHA-256:205D000AA762F3A96AC3AD4B25D791B5F7FC8EFB9056B78F299F671A02B9FD21
      SHA-512:F8615C5E5CF768A94E06961C7C8BEF99BEB43E004A882A4E384F5DD56E047CA59B963A59971F78DCF4C35D1BB92D3A9BC7055BFA3A0D597635DE1A9CE06A3476
      Malicious:false
      Reputation:unknown
      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Temp\~DFE6B4BBD94DB4D650.TMP

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:data
      Category:dropped
      Size (bytes):163840
      Entropy (8bit):0.39116837658471787
      Encrypted:false
      SSDEEP:
      MD5:B4713DBB03BB73515C05013964BBA27D
      SHA1:9519AE3CEAE5836DC4C5FB95628FC62D632F3C6F
      SHA-256:6DCBF9F5F75E67A5B45C31A5F20A5023D70EE2CA10F6DDDD1CBC0A7B2CA75193
      SHA-512:581FF9EF983ABC05007C453C9219E68D014EA3C92A3B12720C9C821B06A1C1F28B127CB2DD4C4E468ED3DADCEF474D6F86D5F846CD6762007EAD61FCD1A4C40A
      Malicious:false
      Reputation:unknown
      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:data
      Category:dropped
      Size (bytes):30
      Entropy (8bit):1.2389205950315936
      Encrypted:false
      SSDEEP:
      MD5:9DC601C32AD3EB2AE26DC1743E49B3D7
      SHA1:63AE2167736EDE2764D0AAB3FD539632B2CDFC4E
      SHA-256:FFB60AA78571389A37830F9D5213564921498F1153311D3BF43610F704B6EA39
      SHA-512:66BE6E5ED171C2E933CA4BD4EEA08CA88B20488EB532F2A2334988C0D5DE40A56A4B0715F220FD109A1BED3D6A547411263ABDFB1DF525B9392F48DE6D49171D
      Malicious:false
      Reputation:unknown
      Preview:.....6........................

      C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:Composite Document File V2 Document, Cannot read section info
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.6701313958679582
      Encrypted:false
      SSDEEP:
      MD5:701DC4B2F07215D37F347E054EF9F91E
      SHA1:15840FCF23F21A71BF1B472AEC32C834832E747E
      SHA-256:2CE2D2EE2233091DB5D6D63387C9AA4BBB65707630440D5865168AF5C9EC3D3D
      SHA-512:81C7BC64ADE13A8968C44156B6CBB8D3D23A6E272428EFCDA5169F1CF91AB8CB6AC2337C6B05A93B57CFF3664D5546E0A9AD6E706B45B9D2FD35046B6E03A15C
      Malicious:false
      Reputation:unknown
      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:Microsoft Outlook email folder (>=2003)
      Category:dropped
      Size (bytes):271360
      Entropy (8bit):1.1827597263687928
      Encrypted:false
      SSDEEP:
      MD5:FCE7B9B74117C19529360622708FB59D
      SHA1:1F17A97EFAB2C18CBCC613A0311A4F0ADB7C7968
      SHA-256:4CE5A7514E035701B9738D4B39D6CBBAA9EA592A311B9F185E39917D7820E073
      SHA-512:DA2626CE239DF00B6761D929C99C5A597EAA6E829B82E39A2E427F49DB5ABCC963141DC7E7C9515ADE6866E8AA21D1879A887E33EF9194606F0D847A634A1D44
      Malicious:false
      Reputation:unknown
      Preview:!BDN.<.RSM......\....4..........).......P................@...........@...@...................................@...........................................................................$.......D.......O..............%...............(...........................................................................................................................................................................................................................................................................................h.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

      Download File
      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:data
      Category:dropped
      Size (bytes):131072
      Entropy (8bit):1.2200699802416421
      Encrypted:false
      SSDEEP:
      MD5:897FC53B757CE1C27EE133C8B3D89E55
      SHA1:E50C5D8BB6A2621F49750A439FCF2A4721575ADA
      SHA-256:D5D25564EA08D1F1E478463EA11212895523A61F239C529C8A6876B7E016E375
      SHA-512:0DA0CD77F9A5132933DF7450410CE15097D65DDBE58BD1DA345757460B1E32A139A861E8C50C809DFB4785F1653B7EEB02686F240FD86BF76FFCB493F096F9C1
      Malicious:false
      Reputation:unknown
      Preview:] ..0...b.............T>.&.......D............#...........................................................~............................................................................................................................................................................................................................................................................................................................................................................................................................................................-.D......2.FB0...c.............T>.&.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

      Static File Info

      General

      File type:CDFV2 Microsoft Outlook Message
      Entropy (8bit):7.866742072411265
      TrID:
      • Outlook Message (71009/1) 58.92%
      • Outlook Form Template (41509/1) 34.44%
      • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
      File name:al arts).msg
      File size:17'753'088 bytes
      MD5:241b70549c9c6658839a4055bfc9e1e7
      SHA1:bebe04c35f1e46634fc61e087a2c3d951bee3912
      SHA256:f455df8ff4f49e71faf1595e7a22498e0faa700a0f59999f941ebec0a67f929a
      SHA512:c4f20176a5e2065aca11a4fb70699ddca23d458117f3310d7daa34f2f2c54ac659a861c21af2c8b19512c16aca6c88bfb7a1c9dbb04f21cb498725743bea8e8f
      SSDEEP:393216:9ClYrpL2c0EZztYiP+pe+F9Nak6HGN1ks3W8aUmVB2p:ZZ2yZL+P33mr8a
      TLSH:D90733335CC58652E276CA786FE73D6EF61EBF1A9C4062DB10622FCE2E306119C5D219
      File Content Preview:........................>.......................p...........................b...o...n...m...k...i...............................................................f...c..........................................................................................

      Static Mail

      General

      Subject:Application - Including Actor/Model/ Influencer/Intertainer (IT qualified with model and martial arts)
      From:analyzer@analyzer.securityeducation.com
      To:clear-abuse@weisigergroup.com
      Cc:
      BCC:
      Date:Thu, 24 Oct 2024 15:59:12 +0200
      Communications:
      • ________________________________ CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. ________________________________ ________________________________ CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. ________________________________ Sir/Madam Job Search: For you to have a clear view of my opinions on everything that is happening around me in the world, I did some YouTube videos and online radio episode. Will apply for asylum, other country citizenship when I arrive outside my country - one fight was created over another one into covering up the problems from 2005 when I left Department of&nbs p;Health, I can not elaborate on this or any other techniques were&are used as one of the countries I am applying here is my country for experience/money and international rules. How many techniques can you use to cover up something from then until now, even as we speak I have no privacy in my country as they make sure I know that every day. How can I know that, but the are many more. Why are black people in my case falling inline of fire, who is 'promoting' them. The only thing I am doing is my curre nt job and secretly apply for high level jobs with no limit, they behave as if they know as if I am in a village. and you don't have authority or capacity or jurisdiction... to investigate such things, but I am force to say enough to get work. Dave Chappelle's career started at the same time as Seinfeld, but I bet Seinfeld is a retired billionaire some were now and Dave Chappelle has to work. To fight for there 20 years experience, cleaning there public image and the money those people made that time, they create a new fight saying he is fighting with the Gay community and now its them the people who attack him before who are in his side. Height - 6'1, Jacket - Large, Shoe - 11, Waist - 33, Weight - 81. Yours Faithfully, S. Bukula Cell. +27762083323 (Whatsapp too) 15 Yoyo Street, Zwide, Port Elizabeth, Eastern Cape, South Africa, 6201. (Applicant)
      Attachments:
      • Portfolio.pdf
      • heyyo_1622491349820_2865035801737406320.jpg
      • Age40.jpeg
      • FullPic.jpg
      • VID_20220603_175408.mp4
      • Qualifications.pdf
      • SACAP Recommendation Panel Member.pdf
      • Civoc Committee Member Appointment.pdf
      • CIVOC term of office & Appreciation-June 2023.pdf
      • Civoc Committee Member Re-Appointment.pdf

      Headers

      Key Value
      Receivedfrom sonic.gate.mail.ne1.yahoo.com by sonic312.consmr.mail.bf2.yahoo.com with HTTP; Thu, 24 Oct 2024 13:59:36 +0000
      BYAPR20MB2821.namprd20.prod.outlook.com with HTTPS; Thu, 24 Oct 2024 1408:48
      by DS0PR20MB6413.namprd20.prod.outlook.com (260310b6:8:159::11) with
      2024 1408:31 +0000
      (260310b6:5:100::48) with Microsoft SMTP Server (version=TLS1_2,
      Transport; Thu, 24 Oct 2024 1408:29 +0000
      Authentication-Resultsspf=softfail (sender IP is 148.163.151.125)
      Received-SPFNeutral (protection.outlook.com: 148.163.155.71 is neither permitted nor denied by domain of yahoo.com)
      15.20.8093.14 via Frontend Transport; Thu, 24 Oct 2024 1408:28 +0000
      Thu, 24 Oct 2024 1008:23 -0400
      Authentication-Results-Originalcarolinacat.com; spf=pass smtp.mailfrom=bukulas@yahoo.com; dkim=pass header.s=s2048 header.d=yahoo.com; dmarc=pass header.from=yahoo.com
      for <clear-abuse@weisigergroup.com>; Thu, 24 Oct 2024 1008:18 -0400 (EDT)
      for <clear-abuse@weisigergroup.com>; Thu, 24 Oct 2024 1408:15 +0000 (UTC)
      Content-Typemultipart/mixed; boundary="===============5364670376583075750=="
      MIME-Version1.0
      DateThu, 24 Oct 2024 13:59:12 +0000 (UTC)
      SubjectApplication - Including Actor/Model/ Influencer/Intertainer (IT qualified with model and martial arts)
      DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1729778376; bh=CiMhU86+G431PeGU+MfnOG3cmXDrqRPK/Ma+0wlkJWY=; h=Date:From:In-Reply-To:References:Subject:From:Subject:Reply-To; b=sPdp1BEwZ47JOj+OCL8t9BjMdwzo0+/kF1x7wqbLQdj6D3ddYt7YFVU3NRxq7hiEQbEdJXoQkkL61UA82cwk5mT4gswhARr1SMdCtriuvpxQtCa5fncRSYBw3eHCrSGgasS+MUnBkiPsP3lJI0GhST4IQMnsoRTEEtZK1S0D9CoF+nVJ0BxHqXYTMGqReV189vU5rYzNYxxBRa59QluSUhHdfg82MyE4YmdiG7CwdgmhWkmChGg158BQ6hFAr6vddtBIZOXSSh74Bp1arMXoJUhIoWEWxo6wjERVmd6LphSbbbPb6IviF5tXyko6S3to+sAeVyj3VtVAZGa9JNMW7g==
      X-SONIC-DKIM-SIGNv=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1729778377; bh=x+NsuPXxE8I9q7Ym4em2AInpx8Fv/GLcaMeGVuiHGfG=; h=X-Sonic-MF:Date:From:Subject:From:Subject; b=VVEPVupSnzzlloF9wU6CCweyER8G2yvGFsHtmLc5FhOGzW/byFCQY02U30fiyEzd9oXT0N9l13f83leWpeZoH9vwPxaYt95vIYnfpFhCp+zFk1Mwl/3wD52GMPx/h20KhRBxBWtaTzAlaBivDPJjP/rdaTFd2D2xWzS9XUkwpdqFEFWqvmpeZJyDXrDcBKwsGXZ6sS6SbWjmp/VQqUyyU6ZJmlb9pgbIUhEr7oQ+MuLAN96s+ieD+6OVyDnxv/llg7ssUklKic2ye0RgrfF1wmHpjtImtvcETy1KVp1UKHC0e2tPK4sT1i2ivBMPJs934lqR4uae1exXWXTC8MMSJg==
      X-YMail-OSGlpmcs3AVM1lLlbojLOnGJpwNiv1uMBmulNPpak0yqdoiHjpdMIUs5aikveKBK7K cebv8HOv.b9DICuDdvgVZJQ4krjDz9D.L4IBrHHmASv9Wy3mVg7TyU5PPnIH.JghoQFI0gWmRPUI VXV7cQpleAd9ypPEDqNtOC8MAigSeEcS065GIKmpFkwI6_cLDLDuVNvdy5uEWTzpLtBibpHhrYSP jTNE6skFq1sm9FidZf3smS29SDnmJxXSvLiA6CyHR2z8DO4BbvKyr.mHqab0FUkMH9I65zh9.LHC k1WwEUNd8efijGLw21DGfNSKOiPr9qeiNPnDQehnOiJvB4SFblBoUZOdj8Qt5Y3ttb7Qb_WKruut btnm8YNH3I1F_0jfOL1kSigWoIN_WY03ryhJFJRRIkaS6XEWe5RkP1Ny_QWEO8BYzFkqLAaOBuQm Ml68JPXfk0lpLPKrzIFyiZSCmNf.4t2CS1ZDgMmhLPDmQgHVmWNe0dM6vTm9WibfLoZ0d4nPoIRb 8gn1v2ShMhJYHXOI4yDuGBRQtAEGxnklxvTZpfcEIwrCQ8msPnHmZbnBob9XTEPe5j6nfou.NUbX Y0OtUZa3dtzsX4KUBrkFbXpf9jWUQP2KjvKVWHS8_cYzjOpQ5WEUdTt8QR0v3QSUdVE_EvirS6sU 8W_mzpg_sLtMFlIBiityb_37hseav4RHxVlbnfwqplHdu8h.FtaPKYqr4GGmIiG.luSxg0zeJqVF xauvkWl6i2ihnIbjH.0ZXhsmealNiawl5BghpXGrIOt7TMyfsHqXolTz7Fx7J3Q05bkB_LIP32Wk rS3FPi1NHLrLnE7TfaGW2BVTGOsvCkiLEvXafqZJDIZq027EFM9CSeOGbvLI.SWIyLpo1tp8ftmz QC._5jiNCpfsB3xPP9j7fb9OHk2zKRNVCYdNJgP9UlPDmyXU28_ARsAtlcSLrXRuqYhNVSB_jI
      X-Sonic-MF<bukulas@yahoo.com>
      X-Sonic-ID4000518b-78f1-468f-bfe1-9416d250ff4e
      References<539852665.3986040.1694324994363.ref@mail.yahoo.com> <539852665.3986040.1694324994363@mail.yahoo.com> <914183103.3979046.1694325272314@mail.yahoo.com> <1646627252.845296.1699246089710@mail.yahoo.com> <1482034477.1944069.1699250067597@mail.yahoo.com> <1969046082.3265529.1701543991160@mail.yahoo.com> <213510698.1434995.1702304809625@mail.yahoo.com> <1402634623.1223416.1709966476144@mail.yahoo.com> <1355323837.1806307.1710235059679@mail.yahoo.com> <426142858.2086596.1710309792628@mail.yahoo.com> <1764374592.2084204.1710309929072@mail.yahoo.com> <1141307966.2208080.1710350192573@mail.yahoo.com> <1327375866.2333465.1710382978027@mail.yahoo.com> <2094992804.2345501.1710383111210@mail.yahoo.com> <470722878.265447.1711131935274@mail.yahoo.com> <1316629392.5411953.1713072003298@mail.yahoo.com> <1199441544.2422765.1718093017561@mail.yahoo.com> <1492166070.5242595.1724153940023@mail.yahoo.com> <115928812.5353137.1724178368284@mail.yahoo.com> <684949549.5357203.1724178612482@mail.yah
      X-MailerWebService/1.1.22806 YMailMini
      X-CLX-ShadesMLX
      X-Authority-Analysisv=2.4 cv=AbnjHGXG c=1 sm=1 tr=0 ts=671a52df cx=c_pps a=cQqS3QABa1i1je/Szeii9Q==:117 a=9cW_t1CCXrUA:10 a=DAUX931o1VcA:10 a=1enQG0Rb0DYA:10 a=x7bEGLp0ZPQA:10 a=6-3z4ESPaP4A:10 a=s23OOv2JePUA:10 a=Bp0BBvT7Al8zpM0Bt5sA:9 a=QEXdDO2ut3YA:10 a=TARHkEnC4JyF1C4K:21 a=vfoxlPI3TKfATZubiW4A:9 a=n3BslyFRqc0A:10 a=x9I3668ZiE8A:10 a=7hx2hz1aG1wuJMqA4-YA:9 a=KQqxNPgzF0kA:10 a=2rKnfEBQLkbx4ewl4uQA:9 a=pCLjeSqRgc2co1cIApoA:9 a=I95hUHFZ0FazP98U9_8A:9 a=11516z0XXmQA:10 a=hRP7tDuYUIaDnJOBiVQA:9 a=Cl_jrCwBs5k02ZoXhtEA:9 a=GuJGy58QHR1RPHZPEyIA:9 a=tUa-TQltbqEgj7bEXVsA:9 a=1FKUQzPpzFRvWJEUPiAA:9 a=KWZKrUnrgeO1kK65X3nB:22
      X-Proofpoint-GUIDgNn5-dF3mplUxI7PGilo6dCT_v3Tqwg2
      X-CLX-Response1TFkXEx8RCkx6FxkfGhEKWUQXZENMWR9IQUtBfE4RClhYF2hjUnNeRFBJHVN nEQp4Thd6RBwdb0VsbURDZhEKeUwXZV1NbG4bZ0JOemcRCkNIFwcdHBEKQ1kXBxgeHREKQ0kXGg QaGhoRCllNF2dmchEKWUkXGnEaEBp3Bh0fcR4eEB13BhgaBhoRClleF2xseREKSUYXSUtYRUZDR EtJS151QkVZXk9OEQpJRxd4T00RCkNOF01kRB8HTmwZR1pGf1JjHXptQ0ZFHE5pfnVcGX5bXU0Y EQpYXBcfBBoEGR0dBRsaBBsaGgQbGR4EGR8QGx4aHxoRCl5ZF09+BU4cEQpNXBcSGhEKTFoXaXt pQkVpEQpFWRdva00RCkxfF3oFBQUFBQUFBQVlEQpMRhdva2tsa2sRCkJPF2hGeUdMAUwcW3JuEQ pDWhcdHgQcBBsYEgQSGBEKQl4XGxEKRF4XGhEKQlwXGxEKXk4XGxEKQksXekQcHW9FbG1EQ2YRC kJJF3pEHB1vRWxtRENmEQpCRRdoY1JzXkRQSR1TZxEKQk4XekQcHW9FbG1EQ2YRCkJMF2hjUnNe RFBJHVNnEQpCbBdoY1JzXkRQSR1TZxEKQkAXZHJcHGd9Qx8bbWsRCkJYF2heE2BGYml/UEhPEQp NXhcbEQpaWBcZEQp5QxdiZHpDZVlHWmVYTBEKWUsXGxoSHRgRCnBoF2ROXUQbZk5JXxxNEBoRCn BoF2EaAWd4XnIfa2R8EBoRCnBoF2JmcAVfYRkdRhlpEBkaEQpwaBdlRAVbTmEccBtwEhAZGhEKc GgXYVMFbBp+bWVHX1kQGRoRCnBoF2lcTF4BfAFETWgSEBoRCnBoF2ATTAVvQkdaeRtLEBoRCnBo F2FhBVJOT2RiQkFQEBkaEQpwaxd6WkFETx9BfmNYYhAaEQpwSxdjGBhlfkt+QnJ9BRAbGxoRCm1 +FxsRClhN
      X-Proofpoint-ORIG-GUIDgNn5-dF3mplUxI7PGilo6dCT_v3Tqwg2
      X-Proofpoint-Virus-Versionvendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1051,Hydra:6.0.680,FMLib:17.12.62.30 definitions=2024-10-24_15,2024-10-24_02,2024-09-30_01
      X-Proofpoint-Spam-Detailsrule=inbound_notspam policy=inbound score=0 priorityscore=350 impostorscore=0 adultscore=0 lowpriorityscore=0 unknownsenderscore=20 clxscore=95 mlxlogscore=75 bulkscore=0 malwarescore=0 suspectscore=0 mlxscore=0 spamscore=0 phishscore=0 classifier=parse_limit authscore=0 adjust=0 reason=mlx scancount=1 engine=8.21.0-2409260000 definitions=main-2410240114 domainage_hfrom=10872
      X-EOPAttributedMessage1
      X-EOPTenantAttributedMessage8d82527c-9fb9-4488-b18a-02fa42b91d9b:1
      X-MS-TrafficTypeDiagnosticBL6PEPF0001AB51:EE_|IA1PR20MB6760:EE_|DS0PR20MB4960:EE_|DS3PEPF000099DC:EE_|DS0PR20MB6413:EE_|BYAPR20MB2821:EE_
      X-MS-Office365-Filtering-Correlation-Id3768f28c-b73f-4b8b-e6e7-08dcf43555c8
      X-Microsoft-Antispam-UntrustedBCL:0;ARA:13230040|7093399012|12012899012|8096899003;
      X-Forefront-Antispam-Report-UntrustedCIP:148.163.155.71;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:NSPM;H:mx0b-002cd101.pphosted.com;PTR:mx0b-002cd101.pphosted.com;CAT:NONE;SFS:(13230040)(7093399012)(12012899012)(8096899003);DIR:INB;
      X-Auto-Response-SuppressDR, RN, NRN, OOF, AutoReply
      X-MS-Exchange-Transport-CrossTenantHeadersStampedDS0PR20MB6413
      X-MS-Exchange-Transport-EndToEndLatency00:00:20.2171770
      X-MS-Exchange-Processed-By-BccFoldering15.20.8093.014
      X-Microsoft-Antispam-Mailbox-Deliveryucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1310096);
      X-Microsoft-Antispam-Message-Info-Original=?us-ascii?Q?Zg4fToQcORSCK1XyQ3EniFIChFtzbLP2GDO7yXvpA9uEKSZS9PPQRQXcgLv/?=
      X-PhishAlarm-FormatPhishAlarm O365 Add-In/4.5.211
      X-PhishAlarm-Sender"bukulas@yahoo.com" <bukulas@yahoo.com>
      X-PhishAlarm-ReporterSGray@weisigergroup.com
      X-PhishAlarm-SES-key78fad241-2f80-4c9c-9f47-b8015c4beacf
      In-Reply-To<1386046233.3176050.1729778360595@mail.yahoo.com>
      Message-ID<172977889371.8.10008684587329511309.analyzer@169.254.50.165>
      X-PhishAlarm-Clear-Id723af255-f691-484d-ad79-8d7e8bc23256
      X-PhishAlarm-Clear-Timeout180
      X-PhishAlarm-Overcast-Trace-TokenZGDX6g=NM-LqA=ZQ8-tLf9DDEGmOvHFxTJ
      Fromanalyzer@analyzer.securityeducation.com
      Toclear-abuse@weisigergroup.com
      Return-Pathanalyzer@analyzer.securityeducation.com
      X-MS-Exchange-Organization-ExpirationStartTime24 Oct 2024 14:08:28.9441
      X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
      X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
      X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
      X-MS-Exchange-Organization-Network-Message-Id3768f28c-b73f-4b8b-e6e7-08dcf43555c8
      X-MS-Exchange-Organization-MessageDirectionalityIncoming
      X-MS-Exchange-Transport-CrossTenantHeadersStrippedDS3PEPF000099DC.namprd04.prod.outlook.com
      X-MS-PublicTrafficTypeEmail
      X-MS-Exchange-Organization-AuthSourceDS3PEPF000099DC.namprd04.prod.outlook.com
      X-MS-Exchange-Organization-AuthAsAnonymous
      X-MS-Office365-Filtering-Correlation-Id-Prvs03419f0f-652c-49de-cc5f-08dcf4343273
      X-MS-Exchange-Organization-SCL-1
      X-Microsoft-AntispamBCL:0;ARA:13230040|13012899012|13102899012|12012899012|3092899012|5062899012|3072899012|35042699022|2092899012|8096899003;
      X-Forefront-Antispam-ReportCIP:148.163.151.125;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:NSPM;H:mx0a-002cd101.pphosted.com;PTR:mx0a-002cd101.pphosted.com;CAT:NONE;SFS:(13230040)(13012899012)(13102899012)(12012899012)(3092899012)(5062899012)(3072899012)(35042699022)(2092899012)(8096899003);DIR:INB;
      X-MS-Exchange-CrossTenant-OriginalArrivalTime24 Oct 2024 14:08:28.6160
      X-MS-Exchange-CrossTenant-Network-Message-Id3768f28c-b73f-4b8b-e6e7-08dcf43555c8
      X-MS-Exchange-CrossTenant-Id8d82527c-9fb9-4488-b18a-02fa42b91d9b
      X-MS-Exchange-CrossTenant-AuthSourceDS3PEPF000099DC.namprd04.prod.outlook.com
      X-MS-Exchange-CrossTenant-AuthAsAnonymous
      X-MS-Exchange-CrossTenant-FromEntityHeaderInternet
      X-Microsoft-Antispam-Message-Info=?us-ascii?Q?hojgbt6fGCjiQw44VMv5oZsFwyBvkruPNdQ3nASgjpW7t1UhQEB7McFfp7UR?=
      dateThu, 24 Oct 2024 15:59:12 +0200

      File Icon

      Icon Hash:c4e1928eacb280a2