Windows Analysis Report
Re_ Remittances needed.eml

Overview

General Information

Sample name:	Re_ Remittances needed.eml
Analysis ID:	1430568
MD5:	d928b57beb8c81fab5a24d5425ccd649
SHA1:	441e3cf923f7ad783c4734319806a625da046411
SHA256:	b64b417a28c3a5738f9e933ffe55e1ab64021f8d532d27f16496cf654f6619c8
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Creates a window with clipboard capturing capabilities

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Office Macro File Download

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.148.189

Source: global traffic

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443

Creates a window with clipboard capturing capabilities

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window created: window name: CLIPBRDWNDCLASS

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Re_ Remittances needed.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "01E97CA8-C49E-4DCA-A071-18C226FE18FF" "679C5ADE-C884-488F-BEEB-F72D7CDB76A5" "684" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7FZ81S7F\Stonhard Statement.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1564 --field-trial-handle=1604,i,6430779643885770178,13425831656830152615,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "01E97CA8-C49E-4DCA-A071-18C226FE18FF" "679C5ADE-C884-488F-BEEB-F72D7CDB76A5" "684" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7FZ81S7F\Stonhard Statement.pdf"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1564 --field-trial-handle=1604,i,6430779643885770178,13425831656830152615,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Re_ Remittances needed.eml	Binary or memory string: aOqZl0NrxcbNN/OpTJr4zHYoIunMN7niWx3vMx86G0voSO+nMyMq4QMIVwqQisyZnehhhoIEJ547
Source: Re_ Remittances needed.eml	Binary or memory string: MIllSE7Ko1nHswLfQwul2bc+F/F5p4JbrHHMGZbPGSo7tDNAZKVmCi2sBpK19K5aTZP1zF4tkU+C

ID:	1430568
Product:	CloudBasic
Start time:	22:08:41
Start date:	23.04.2024
Sample:	Re_ Remittances needed.eml
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	d928b57beb8c81fab5a24d5425ccd649
SHA1:	441e3cf923f7ad783c4734319806a625da046411
SHA256:	b64b417a28c3a5738f9e933ffe55e1ab64021f8d532d27f16496cf654f6619c8

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	A7B96285E78375CEA72F5B3004AEA566	D87CBC2437E73F19390A5F1C10C336E799C24550	D8EFEF6A723CEB9932C81478B1A3D39C6EAFFBC405B25FC7BE6C5FE116909266
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	A7B96285E78375CEA72F5B3004AEA566	D87CBC2437E73F19390A5F1C10C336E799C24550	D8EFEF6A723CEB9932C81478B1A3D39C6EAFFBC405B25FC7BE6C5FE116909266
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	EF1232B471EEA7CEF9845D9F36A40DA3	D11C11A74B9336C5D16093DDD14DA07AA9C80E61	45C9DBA352624B7F1469B7BA8C2F55FFDF03665027448B531BFFF6408781F177
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	EF1232B471EEA7CEF9845D9F36A40DA3	D11C11A74B9336C5D16093DDD14DA07AA9C80E61	45C9DBA352624B7F1469B7BA8C2F55FFDF03665027448B531BFFF6408781F177
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	5BBBD27D51B8F75806205C04045D795D	A9B4F0FD7403D7FCCCAE3B00A3F787E012FEBB9A	85F2FB2D00DF47DBC7A9100DA9E65D3D1A171485852CE7253678A1452753A3F6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eb41d3b1-7c58-463c-b014-e493a0032ee3.tmp	JSON data	5BBBD27D51B8F75806205C04045D795D	A9B4F0FD7403D7FCCCAE3B00A3F787E012FEBB9A	85F2FB2D00DF47DBC7A9100DA9E65D3D1A171485852CE7253678A1452753A3F6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	5A128B8B95968AB2FCE9877938C81660	9E77635712D07CBDBBE623C36B490AFE6E670434	B312E0A03DDB2589DE79EB799270FAAEE565C62F37284B237C353F11A44EDDA2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	8F1F9C12848E47F3E57F880526B461CA	85EB632CE29526767180F1576C9F808AC0231090	3361381CD991244E687B05FE0FC03482EE656B7B140BE4A95D1B580C417D4F85
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	8F1F9C12848E47F3E57F880526B461CA	85EB632CE29526767180F1576C9F808AC0231090	3361381CD991244E687B05FE0FC03482EE656B7B140BE4A95D1B580C417D4F85
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240423200932Z-158.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	D2B084DAFBCF385E60D5C7CD133407C7	A66486737812648971C2C0B99783873408BAEA29	9F5934C9628AE4DE1ADBF7B60C6DCF8D36654DC295F10F4BED5A9C5077E13560
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	0C373A2F206041D61E5643165D518B89	B1EF9A3B5347A855D783EDEDBF53B6BA0AD9DA7D	F5FB5107AFA7CA2B0388E9C0209F4CCD026EEB7A5A1C389CA87605056C95A208
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	A41AC0E2341F8913590F4D80FF4A620B	FA981410B9C759213734AB3B2DDB57C7ACB12A73	F58CB3BF73C6D680DDF2D0D354E28688A8B508161FAC0D33B494CDA0AB310E2C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6672	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	BE9BCC8BB2DB177C5D0157BDE4A1D3FE	31836566F2EBE2EB88519AA3771D24DB439D9457	19D825CC20881511801CAA8DD9107805442C3B7685AF39FF16944287482659AD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	0B1C1D7172FC454E08919171DD12AA48	AFCACB0E631F05430F058EF66538A181E4B12461	44D41B7FA5F9D4543367BAC2C5A3CE3FA466F822D89E2C3E2706E4A6B8CAAD96
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	E1721D84CE3220E3627C9E3EDEC53E07	6B310AC27BB657BA946CFF3049E6B759DF9CAAC7	234C72CC014B2D03E559B8589DA554EBEAD454A17196E36C8129E8C80F3858B5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	B86FDBD2786BBFB7608569E4D20F241D	480B66AD7FDB7C5F8FDD0335B1065781979A9092	1752B17450EC3F320034393862D4BC14BD0A75A6231351DD7D2058F24F65B930
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	675BF21BE5B370D718FBF1DD9DB779DD	F3D24D7C380C1EB120665AD187867FAA75282EF8	EF47D976583E45B46F83867172EA49ABFC68BB7327161F19F56D9BD398FF0384
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	985CDBD97ADCA22A0783B2CA5AFD7ADE	65713156B420AB6F2F6116B27F09C48B4E0A58E6	89B83479BF978DACB87D1FD9F99C5EDB4BAEE8420F897DFBD2F81CE0E3193569
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	3CAE2361EDCA57C422E95C2234FBE02E	1C0BC31B4D55F201D787A2AD875070AF92C1F987	EB191E22C9AAF827177BB36576D407603E01843103AB4D024B5720BD1BC1756F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	329F786BC70CE7F4F66C54CC78E30849	F971D5CD1FF3E7BBE3941F9936940B13CC83CF2D	EE4B05735D0D19D320E1A723A385D25FFCFB02DF583FF2233F5F72EBADEA4523
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	E603C4D87DA09DF807CCB76E84268BEF	374394D3A1B34A99B82D523D5E58B2A67BA2605F	734B8419044A100375E593138BC376320652A678962123B5A4A16F0726FD37BE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	F8D6F97850F94029D219744C23CA3306	9FCA27DC7019A8F07921B3B5AD6DF9AE97528148	32E21F17A9D4948681F52621A256A0925D618E98D2648E1926B1C9B7F662CF8C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	C3A1DD229AC32D4AAB07F9DEBC4CF589	9AF949D5EE95B511423F0143EE78D8B4A434DEE9	3604B119A96E20E786A65E29B245AACCD15BDB839ADDC9D466D0492B8107CF83
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	DD3060C34AF99A2D62DA385E9ACDB822	D17C8D0B961714749FE6F58148C607687DABFC9B	D80A0C39412F1C4B741F7354267F03CF1AD44C54796193C4A737E422F749599E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	7BB35E996CF8C97A9723D260ED8312E8	999FF47FCA909607A7377431BAA471AC7AC39A92	A83764126EDAFA0D81CC5A6BFA5EB47901209BA5E3BB6DF686182A76751333C9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	9F111279F197DF97122AC4A966B731DA	75C148F17C8656FE31698D3B50477BB2A6D3D704	538F10FAB5F0814A183EC5EEAC84D7AAC04E9F12F4D69727B29AEA22ED24B877
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	BA083E63B8D9ED6C66C96A7403D87A18	73B2A0B3C5D236AACD342771B38B9C466DCB0028	43283D4199BEB1EE407E14026CE815B3231A6F107BF841270F364A3F7ADA5459
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	981CE180B15894364DD9FA32D9DD0639	A9186A2C842CABC0F5AEB99B9CB744C42B1526A1	61E32C7CA23C3F6E806D6DA3E0E6046DB868FCF156D9FC07030A46C0845F59FC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	623DC81EF6EEB0C9E38D59A0A6A794F4	A72ADD43E03B61D7EDA27504BB71BBA1BF62E8D1	A3B4908E34259F3C64E9BDA7463EE695A0334A8CD9A507CB8BAA06BE44DFCD14
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	95BC96F299FB65A427813AEBA3B3F43A	A4C4FA28081B91E53C888EB49CFC550D712EC68B	FF13A5D4145E0A24E1144FF3E635F3F58295ED9B1D244C90380E98B17FBFBAEB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 23, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 23	15A4F466D80E8B4EEB7720589AAC5E45	7EBD7E6FC3152DB474AA27879EB5B9CFF01F5D52	8D2E94783E360B136D09B860F0BA83ADD52492E302E84AF985C4FCE1EAEF698A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	664745C3AF69683415EC9CBF1B4B2B6C	710AC1DA766F49F4159DEBF59C2540AC95D951FC	E258ADB4DED5328472985D306EEE9C40FD1DB9C4937545D210B4355CED642218
C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT	data	6950EF3F6C0402377C65605FFD0A07E0	E501BC81B9E3E4B0FADE9476FE1F1D2D8C7B0A4E	DC91BCB1133DD7017FD4AC55225286DEE735A12EC525EB55C514A3814CF087FA
C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators	477EB63D238FF3869B90C6A940AFA751	E83A611FC31A05B37FD5D6FAEF00043B829D9A4F	A4D635D032A67405EFFDC0B18D4DD7D32EF7BBAE079DE2001C617D9F327C791C
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin	ASCII text, with very long lines (65536), with no line terminators	CC90D669144261B198DEAD45AA266572	EF164048A8BC8BD3A015CF63E78BDAC720071305	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin	ASCII text, with no line terminators	7102C1A6B38129EF4596CB09E558F5FA	7FF09E3CE929745D9A228BB74210BD6136222CB1	1CDEE5F333EFF6A11C75D9171AB1143565601A1D93A18120954469CFC8315A23
C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.CampaignStates.json	JSON data	6DCD85A563AD7A7EA859B072042F5BF0	CF91B51294992D4CB7A3048F7D326AEFA1FB27AB	7381B8D5E46AFF8B30091E6D2A7D538163C774AC51812895C1A919800882D050
C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.GovernedChannelStates.json	JSON data	439A34DE8DA5C04AF25AADB84A2120D4	F12F9FF6E03A5762BD03061557029446680B1DAE	32B560C75C25C6F56C0439F67A3FA7D4F271F07B435EE41575A3D82C6C612880
C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.Settings.json	JSON data	E4E83F8123E9740B8AA3C3DFA77C1C04	5281EAE96EFDE7B0E16A1D977F005F0D3BD7AAD0	6034F27B0823B2A6A76FE296E851939FD05324D0AF9D55F249C79AF118B0EB31
C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.SurveyEventActivityStats.json	JSON data	6CA4960355E4951C72AA5F6364E459D5	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
C:\Users\user\AppData\Local\Microsoft\Office\16.0\Floodgate\Outlook.SurveyHistoryStats.json	JSON data	6CA4960355E4951C72AA5F6364E459D5	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db	SQLite 3.x database, last written using SQLite version 3034001, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2	D0DE7DB24F7B0C0FE636B34E253F1562	6EF2957FDEDDC3EB84974F136C22E39553287B80	B6DC74E4A39FFA38ED8C93D58AADEB7E7A0674DAC1152AF413E9DA7313ADE6ED
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal	SQLite Rollback Journal	5A1E66119D44DB2985A1D88EF20FF1F6	E6F4795985C1A49272993A4923BE10D9260E0ACD	701F63B69F643D367BD3EC864C5D10ABF7E9CF5421E6E9E13183CD8BDCBE6A49
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm	data	5556550C971BA1CB8D39FFD95220AF67	B10FB93F4766FF049C0B823AD7C4384667EDEEBA	F64CF94A0A6993BE63C767D284D78443585813F64EB76AD301D7FB9414E9C423
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal	SQLite Write-Ahead Log, version 3007000	943F0144C794E3F67092CD331C9A95E4	3CB62DFC89A05744AD7756ECE5ED0904871EE710	3F16D004A0ED3049F251CF62F238D5DC10CF114504601BB9D97066D047DDFCDC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7FZ81S7F\Stonhard Statement (002).pdf	PDF document, version 1.4, 2 pages	231287CBA9188EC72222002959222CCC	05AA059DF1812B05DDF413FC28094F731515300F	71F5082C2E61F077DE8EBDF51868970C81F67D29A0DC20CD9D13357D1893D833
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7FZ81S7F\Stonhard Statement (002).pdf:Zone.Identifier	ASCII text, with CRLF line terminators	FBCCF14D504B7B2DBCB5A5BDA75BD93B	D59FC84CDD5217C6CF74785703655F78DA6B582B	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7FZ81S7F\Stonhard Statement.pdf	PDF document, version 1.4, 2 pages	231287CBA9188EC72222002959222CCC	05AA059DF1812B05DDF413FC28094F731515300F	71F5082C2E61F077DE8EBDF51868970C81F67D29A0DC20CD9D13357D1893D833
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\7FZ81S7F\Stonhard Statement.pdf:Zone.Identifier	ASCII text, with CRLF line terminators	FBCCF14D504B7B2DBCB5A5BDA75BD93B	D59FC84CDD5217C6CF74785703655F78DA6B582B	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{2D10EC27-559C-4B30-B109-C468D51DCA48}.tmp	data	DC899C81E5290ECB2712CDF20A62820C	263FF45796A469CF7F8D619A3A4EF04BDCCB6FC2	70576D57253B077AAC432AE079803F10129D7ADC91447E07E70C787C39688961
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1713902950781800600_44575359-FDB7-45EF-866E-CDDC28E74C03.log	ASCII text, with very long lines (28758), with CRLF line terminators	3749E13BEC74C5BF8DA2773552209869	0385148CF1C2E1D68B78F2841D696AE843AE8F57	8F7CB7C8D47A5866FE8DD5F4EF806A4A774727DC5E03DD674C6F3F778F816BE1
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1713902950782687500_44575359-FDB7-45EF-866E-CDDC28E74C03.log	data	8F4E33F3DC3E414FF94E5FB6905CBA8C	9674344C90C2F0646F0B78026E127C9B86E3AD77	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
C:\Users\user\AppData\Local\Temp\MSIb572b.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	BB94A84BECF3B9C064E98DDD911D41B0	4D102E2599AB0E7449932091A797E6E4799D841A	276689B38FEF504600F4EB984AD8B5E11658FAD27C0DB2F9FC452A04377221F6
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240423T2209100542-684.etl	data	DDA56945EE4B16780C5CB981825C518C	D1965FCBA10408A2362D99CCF5AD22303EE34801	2F7D84871CC6AC833328F26174BBED5E94A9F9CD91042E835A03747E2DB5575D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-23 22-09-31-195.log	ASCII text, with very long lines (393)	06DEAEDB81D09FD8FB5FF668D8E09CB2	28A02BCBD5975117B97A08AFB049F2C94F334726	D98DE785425112A2D7A41B16073812FA4FA4955F2D5139AE87C9A5FBC4717D64
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	0812B710CE71FD4ED285F70A040EFF1F	009309BA69065DA28EF73F2FFD6776BDEFC03B63	004604BDED9EE7F9E4433B536E9DE264306492380B4CCFA22B9D0EC7846C71DC
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	8D3AB2E5226BCB8E47574676163229F0	F68F5CF49BD60C4B7B5C065AFDBB64F0DA4F9A62	97F0F10669EA5661FC8C225EE6D7C5B4F0E984625EAD2739AF5178FAB6687551
C:\Users\user\AppData\Local\Temp\acrocef_low\13e15bdc-a0e9-401e-9842-ac1c6a609321.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
C:\Users\user\AppData\Local\Temp\acrocef_low\23b14d4f-0514-4728-b579-21fc874cc43c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\28e3c4ec-5d37-474e-ad8e-b2484508a762.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\5f855b67-7cea-4883-bee7-c4ac47c35284.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	F8E38D361460D70B6AB5A6CB587265F4	19A1A38B61D271B8EB9CA17C7CF919A905C32840	4D77E5B93BCCA8F4E350DFE56D78F0D288778217EE1DB5836D3D3F39ACCD37F6
C:\Users\user\AppData\Local\Temp\olk8A1A.tmp	data	3B2A9B68ACF1FCDEF0F0002BD75F0C0A	BEB7E8882AD8F1F0396876C18DD4776FD790122E	BC2A0469BD4CD9416B4C46F5FD85FBC07150D5A6184BBB056A55618F6FD532AE
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl	data	189734E1E0B608C810B06D72A9AC96C6	B6C6419E863F6CF8A409C60906698A27C8F9A717	4655080E35E37A85B40A7B898146878B146A9690A4573B97F968E212014F2D58
C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs	Composite Document File V2 Document, Cannot read section info	EF28C8DCE0E4637922CD585034982D6C	79D5984EF3779860874EC794CE7C002ED1C5C72C	BDAE3FBE2EB5F1AFBACE4E34DEF55AF96201D1BA2C64770F6FB4A874E7E5A7BF
C:\Users\user\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm (copy)	Microsoft Word 2007+	C9788C1C22C024459E0F311109E29495	44C755E337E34A89C080932045C33AAB73C0C845	9628BDA8908A0BCB6C93DF6DC475498143ECADAE1470E88019DE524BDA24FFB5
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm	data	40116E142F0763358C37CF04F622F4EF	D0AB98C5847EB94017AC35487F3D7E47DA671D93	38948AD79C2F03FF8F3EB05B7862661B886D79F4FD374782BE03A1F19B3E50C4
C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp	Microsoft Word 2007+	C9788C1C22C024459E0F311109E29495	44C755E337E34A89C080932045C33AAB73C0C845	9628BDA8908A0BCB6C93DF6DC475498143ECADAE1470E88019DE524BDA24FFB5
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst	Microsoft Outlook email folder (>=2003)	39E7E1B50A8D4078F079544B3799F33B	C20EBA52B212D6E03895470C35C7B518FF98F04E	6D629283FB55D4A97F860025DA19B262C4641BB5FCE021A8E9ED37075DB2881F
C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp	data	75BE49D273590B72F1B3D448F8A77E87	DD04CB1D8D83603A20B380B0176DE1B2036C0EDD	941F621A5770EA8A14E71B0D5BF210D99205717891339B919CFC1C33594D9C1B

Windows Analysis Report Re_ Remittances needed.eml

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
Re_ Remittances needed.eml