Windows Analysis Report
Re_ Remittances needed (1).eml

Overview

General Information

Sample name:	Re_ Remittances needed (1).eml
Analysis ID:	1430571
MD5:	c307adf0c0d4db6a92d2977aa224c46b
SHA1:	80060d2ed5be1dfabff839fdba57230ed1817896
SHA256:	e20012cca0b8c7ba8fe00d901ecb021530a9e1b4ae0b0da89e491bdd7d3985fe
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143

Source: global traffic

Source: 56965894-3c7d-444a-a784-ac78ae7f64c1.tmp.14.dr, 16371014-b5ca-4efb-876c-dcae9763750a.tmp.14.dr

String found in binary or memory: https://chrome.cloudflare-dns.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: classification engine

Classification label: clean1.winEML@26/71@0/1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Re_ Remittances needed (1).eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "016F1EBA-115D-4877-9F9C-41459D6E8602" "7EAD5ED6-0459-4323-8199-461E7BAB052C" "6288" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD INVOICES 103823-103838.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD PACKING LISTS.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1744 --field-trial-handle=1592,i,13904569476606750348,1530364221901000283,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "016F1EBA-115D-4877-9F9C-41459D6E8602" "7EAD5ED6-0459-4323-8199-461E7BAB052C" "6288" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD INVOICES 103823-103838.pdf"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD PACKING LISTS.pdf"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1744 --field-trial-handle=1592,i,13904569476606750348,1530364221901000283,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Re_ Remittances needed (1).eml	Binary or memory string: lLqemuGE7pgI/W34Rm6KsVaRnxk5OFl9n0jCcP4gcfGiNO3ziSNHPLdUmNGerk69wMu5gRvoR/t/
Source: Re_ Remittances needed (1).eml	Binary or memory string: Jj01FHMVnoTuNcwPsqaN3t5g2Vzr/mLFFqieC0B6uMBVoiFjyfnElaF+u2l+HgFS4068vv7jCX//
Source: Re_ Remittances needed (1).eml	Binary or memory string: OU/XhLMtD9l5dqZXjy/4pDTQn6FPJ/2ZjFnKOmufFUgXutvMcIEw6xsbMmp1UQpneeIfp60lwZWl
Source: Re_ Remittances needed (1).eml	Binary or memory string: ad/wgWjfDzW47m/WLwr8MdQTwl4o8SeFv+Ems9S13RvER8P6TDcQeMuy8W+JPFNlpRi8D6R4L1vx
Source: Re_ Remittances needed (1).eml	Binary or memory string: We0D+uCRjjXf9m5XPg81/tGd7XWdcd0sGCd4gQfEvumoC/9miiWhIjweqlEzqkCyR2f0ug0vMCin
Source: Re_ Remittances needed (1).eml	Binary or memory string: AGdehBQEmUPHJM+e4FeEclLNrWhQwuPd75blZ5YuhHejXliNvXA2cMPhoGbI2AJapZHL26ZHLnwn
Source: Re_ Remittances needed (1).eml	Binary or memory string: k0bn7k1yEK0SZL83HHZTYokqLkTFJ6aavmCI1737JsigjY/VLfTH6frnluM8I+OPTc+CuXVZr35j
Source: Re_ Remittances needed (1).eml	Binary or memory string: cJIKbJROWVQfPIkOdhfrusLyPF0E4S1LqEmuZlNZ6131NBrq7p+eGqxE3C1EYtJJhx23oRvEj4Nx
Source: Re_ Remittances needed (1).eml	Binary or memory string: gWKiHGFsyeiSsEWtzK/Y8/Nkwwm7Zr8mz+V7b55ayN1LUvuaTC7Yt73Ns+iu+Fs0EiFxm7DzAb2W
Source: Re_ Remittances needed (1).eml	Binary or memory string: RPUx6/CpWqns2yjIiQ/BOiR3nV1QyzerPVmcI6J9Qeo7h87Nkp3r5vMTxSqT001HMe8uJ2nyniBt
Source: Re_ Remittances needed (1).eml	Binary or memory string: PzeM8KmpyzR58ImqemUd60OpqU2N8hPGxjcDh3nknOwSclnro+khrivNaTuLfeF9pdx0EOmlp8U2

ID:	1430571
Product:	CloudBasic
Start time:	22:15:15
Start date:	23.04.2024
Sample:	Re_ Remittances needed (1).eml
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	c307adf0c0d4db6a92d2977aa224c46b
SHA1:	80060d2ed5be1dfabff839fdba57230ed1817896
SHA256:	e20012cca0b8c7ba8fe00d901ecb021530a9e1b4ae0b0da89e491bdd7d3985fe

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	E1135970F09E4C46C0E9D4BF4420D3D4	1918B778A9846745F924A576E55FB0AF1CF0A738	772087E1D3E6667B2C3506695DD3A1DDF4CD1A8E5D5F1F2FD54D8F636CE5C860
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	E1135970F09E4C46C0E9D4BF4420D3D4	1918B778A9846745F924A576E55FB0AF1CF0A738	772087E1D3E6667B2C3506695DD3A1DDF4CD1A8E5D5F1F2FD54D8F636CE5C860
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	E1A6D88F3874FE6F766C8F791B878082	9FDEB0A25E7E22355D1C7446B7E1561C045050C9	375E95C87CD6B2F082A1E10902703737F95E55CD0AE7BF325494021CD0A32B17
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	E1A6D88F3874FE6F766C8F791B878082	9FDEB0A25E7E22355D1C7446B7E1561C045050C9	375E95C87CD6B2F082A1E10902703737F95E55CD0AE7BF325494021CD0A32B17
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\16371014-b5ca-4efb-876c-dcae9763750a.tmp	JSON data	E1F57D1DFEB3E8AB7A0A7E9BE5DFDCF3	8C4DAF0F55DF85B20D92C9671DAC4D8A0ED72191	9B80B40CD39D417ABDDCF42DEE82F5084EC23894590B0E9D280906578FC62934
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\56965894-3c7d-444a-a784-ac78ae7f64c1.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF592eee.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	B841E7C76DEA78D327B228EC13A9CE19	9F178630A983B4415A413FF12954F887101B6F7F	6DBA1CBF5F8CBEAEF0F920336433F2FF6D07F3C7A917598EBBAA78E6A5426FD2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	843AD9F57CE97B7059289F7952AD87E2	D1B66703DC36C010AF24394D432AA82F6F572412	BA829660B2D5314E94F46CA75722311E315911EA06E9ABB9F5C88EE53A183D36
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	843AD9F57CE97B7059289F7952AD87E2	D1B66703DC36C010AF24394D432AA82F6F572412	BA829660B2D5314E94F46CA75722311E315911EA06E9ABB9F5C88EE53A183D36
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240423201613Z-205.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	CAB46CEDFCEF68415444F5F78C6A769B	85D94122115D658FD88FAB9A83915C7452F78F2E	30F43253422B409774C3186FD16C9DA67666C380B8DD23920463B92EF885DA48
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240423201708Z-1928.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	3D3AB6873167A39D7892BDA1B6967A1E	BBD9FCEF381AB7B96645ADBCE1F24BA137E9E1AE	B4BF8E3F1320ABE255156739A2F47F5739B6D9A7A97C17D70A18D00919264690
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	9D2D9F830339BE101DE4281032AA19E7	B191BE86275D57B185271E62B0D32116FBD273C5	D5E98299C2C0D8E88E1B383444A3D80C20D448A44FCC7C5076C45382845F983C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.876	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	B90665DC2D9A6D4CDAD6D49376E85D63	B99DCD31E542FE14D68FA4C2B153395A99678016	BC1EDAA5D93467C4AEE0C539CB4DA77D98A9BE5DE9B1298ACCB6BE03631153EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	9735BBBECCE9A6A4EC02DE4DB2A58AA0	671537BA1A300CE51C71D2E26AD00DD327ECD3A7	9143702EFD4D335C94C92D95CC1A13E6F97C93963A7B77A65759E9E9DACF4EAE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	772215DFE3BDD807F26B24C337E13252	D52375AB9A4D0F08FE741E1DAF9BAA8199575612	E1A374B34F1DFCE6D92C8B0EFF0288D7991B7540EF4D55AE45F89D8EA6C0448C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	2FE6D93064EB8F55C286FC22E0A7A744	D092C2CAA0CAFEAF6457AFCDA3DE4358EA0D1F44	BCD9CAB782BCA65ACDDD32928B148992542DE1B4EE1FA54D43D4945AA83F8FAE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	8FC32C9EBC82C53E9479170D28862A82	C0206908CD4C38FAD2A02FBA8FC5FFD461322E24	D3FFD323F1F20A73D535A4F32337F7B30481C99246FD3EEF66356EE8D722BA79
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	A867B3FA40DEA40D8BC5BF42F84F0261	41B30C3DDF12416461D551BF706DB8A29093CFC1	E73CADAC9FBBB89B65883D2F14E3D038C36AE16AC8AF0DE3660B7E2D03604686
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	DD356164BE59C3A0FBF08AD3CCCBF1CB	2C4EEE81B4A0347CE858ECC7D436AE374FC32DC0	3993EE62CEA2054706719628401BB641E223719612D6676A4841C1867CAD6B4F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	5A6D78A2ECEB24EB4829154EA20D9C5C	2CD0149B3CA931C877A792715209A301B64F6DE8	3D76DF739E1A67FF550EE7D98F0807B76B9BA67AF38FE7B4283747044F9BF589
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	44344A30945F9F2A6FB4F40DA25DFA62	86C1D9E5E52C520C9F9B4CE1DD5FE24A6D42FD1D	EA6079729D84020B3BB296F83E1683B2D837FBE43089C96FDF67725438B4DA0B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	D4E707C4878AF456A822FECC9C3D5FA0	F7BBBBD7F624F470C2A25499AF8D6C51416CC58C	CFBE8E5C4B81C074E3F41EC57EEB28DE73AF02E984FDAE1587EB4574A0B706D6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	5FDFD943E74FCFCBF78A0C90114CB0B5	1421A2D7FC7A15ACCEB97B90EFD9F6BEEA033039	E9ECE9C6E045DC6AAC7559E341EBB4DCE3380D04E4AC7895B3AB1CD1B6B9918B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	22CB729C2C0BE8D91ADEAD8C30C3AD5A	F5465FDF1BB6DCDD83ACB7C93ABD8F9A612FEAD4	B9C44E3FF9346FBBA948DC856A05A29FC2B36D411731FA9B383CEFFE8E70D3BA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	54D1A517A4A3E4A4267F4F73B988BEE9	58797E72ECD424410BB38DB95CFF95226786D995	F34B02C0A52A823A395AF993D5F230AD7FF01EA08724E63D358322AE92764163
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	9CA32F8B82D2738179B9D0DC612860C3	177078301FD27EB7A2417C673F1B91120E67F3DF	E6A1EE81ECC884889BEE0B76C60C348C0B702BB995E434BC49EE444C0C763C6E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	1F173949B1FABD38B5EB5E64FA3AEC0C	874A00B059279DC0E8750F6F65761CE472C37ED0	4A8BAD184CD36DB4518DB3D013C511E2CE8024BF901CB8BDFA7DC689648B636C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	5B453411077AB85643BD7C551320BAC4	F62D8153B755FA7CB194A209683457E669DDC6BB	2750A867ACAA4B090F34600D2B92F53F03F2A61E9C3475F0ABAE721B63A0791C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	250C151AEE3757A8A3061E05AD0F97B4	F0E394E85E7481F4CB41EF29C560D42EE8528C49	6DE0F39DE11D7BD22DAE5E68E3BBE6A9D523413D9B2366CADF792F036ABFBA63
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	540BFBD1D6D2F5CA7634C35A608BF633	9620B10A7A00083E07C1177723C583E24E167191	520CEF90E189F966788821D6FCC7B910023A6753E291E9AF18A168C83A95707D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	12E1E2F369F0E17C55AEB61C04C96BF2	1BAB51F991B6DBC5BA645145137BDB5119ECA9AD	5C3318BD934AC4CB8845C7824F4E6EE4099F2F42404DAC63617582D08D8098CC
C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT	data	D78983013EF21B91BFF13A02DC4B3431	D8BE52B1774AB8CEC7A9C8A702E4CA8103365FBA	BE397CA5255AC18997F162C547C157524BEF79CEFABBB398C3A2336AA832A9EE
C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators	6A7C7FFFC11D9D7A1DD1AACFAFDF57B1	8C3FEA75ECDCF90FFDD64505B4B7D163A565D3C8	445F335A51E0D006D0F36B01D066C93F90E31AD515B05DD9627B73F651F76553
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm	data	6A69246CCE78119729279CD6ABBA7EBA	A9D3FB2C29EFC1D284AEFA04FA591663BE3624F7	C7734266635AE6DCF6E72866A59B0ED579EE31897AF0A68CD0506A141CB1F502
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal	SQLite Write-Ahead Log, version 3007000	6407288D6791DB3EE6CD86BF6CC76D23	D3C8E7626FCE15F302AE22634781D749D9D4BDAE	D73E0010A132C343A4CD1E113436D333663BA44BBBCC16C596EDE8A058C756D1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\63A44B16.dat	PNG image data, 588 x 165, 8-bit/color RGBA, non-interlaced	F2D413429DB255480AF2E63F8E23EFF4	0339A2A3F323464D57C87D31E7ECEFB0ACBE3B6E	243553E111B099A6612B9DA4DAADAB8CFA65D5A6006D94CED26DC51AE6B6362C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD INVOICES 103823-103838 (002).pdf	PDF document, version 1.4	90DB2523EF6470FCF8A1FFE2ABDEF1A6	4F9D4602940B7860AA37282072E3284E6B14241D	0B64CF73AEBA582064E7629793E90A435BF36A91E31B449592C1D3321FBC0435
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD INVOICES 103823-103838 (002).pdf:Zone.Identifier	ASCII text, with CRLF line terminators	FBCCF14D504B7B2DBCB5A5BDA75BD93B	D59FC84CDD5217C6CF74785703655F78DA6B582B	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD INVOICES 103823-103838.pdf	PDF document, version 1.4	90DB2523EF6470FCF8A1FFE2ABDEF1A6	4F9D4602940B7860AA37282072E3284E6B14241D	0B64CF73AEBA582064E7629793E90A435BF36A91E31B449592C1D3321FBC0435
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD INVOICES 103823-103838.pdf:Zone.Identifier	ASCII text, with CRLF line terminators	FBCCF14D504B7B2DBCB5A5BDA75BD93B	D59FC84CDD5217C6CF74785703655F78DA6B582B	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD PACKING LISTS (002).pdf	PDF document, version 1.4	DD5FB475BBF951210204ABEB13A2B6E0	39449A474B649DF072E7D013EC8862E3E3620B3A	322006B7030CAA316A551662DCA66D3F18AAE7242E2E4D55C01F7CD55722DF55
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD PACKING LISTS (002).pdf:Zone.Identifier	ASCII text, with CRLF line terminators	FBCCF14D504B7B2DBCB5A5BDA75BD93B	D59FC84CDD5217C6CF74785703655F78DA6B582B	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD PACKING LISTS.pdf	PDF document, version 1.4	DD5FB475BBF951210204ABEB13A2B6E0	39449A474B649DF072E7D013EC8862E3E3620B3A	322006B7030CAA316A551662DCA66D3F18AAE7242E2E4D55C01F7CD55722DF55
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD PACKING LISTS.pdf:Zone.Identifier	ASCII text, with CRLF line terminators	FBCCF14D504B7B2DBCB5A5BDA75BD93B	D59FC84CDD5217C6CF74785703655F78DA6B582B	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{A766A7B4-631B-4928-947D-92346C08496C}.tmp	data	6880A2C89790305EA54A96AD2FBBBB0B	1E26B81ADA2852A6431E563922209076D13D2918	89102ED1F0C72B19C1006DD7B16A28C92A3434C279F1A643314D0EE488D32E19
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1713903351719678800_13200C97-F1C9-49C1-9B43-6D3DD6F3E870.log	ASCII text, with very long lines (28782), with CRLF line terminators	665CB387CD93B89FB3F45A8F0DA36E58	D5E8F60F1AB084D87B07E46701C25E56FC73FFCE	F47331B7915707B391407C9FE5C51E6EB5469774C37301D38FAD70E8A4118329
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1713903351720435600_13200C97-F1C9-49C1-9B43-6D3DD6F3E870.log	data	8F4E33F3DC3E414FF94E5FB6905CBA8C	9674344C90C2F0646F0B78026E127C9B86E3AD77	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
C:\Users\user\AppData\Local\Temp\MSI81699.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	D112CBFDD0CD25AE677CB43032355FC9	A5C1986019F655146B04488D553AB9EF6A3CAF8B	5693306308CCD9A20CBA9806D6E0085F4479284EA3716226C14EA0BC208DC110
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240423T2215510482-6288.etl	data	8EE3D798580F17C3710BA365DAE197FE	087F591285E3920E1945F0CCDA29B3C72C61BF08	08C63BA0FE66C8CA14C1381638505BB44CDC55A51441BBAE08905822925A12A1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-23 22-16-10-634.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	8D8E5E18383C6DED3D05A970BB594047	339912260FB7256B6AB71A4C94BE81D1DEAA1637	84AC7D45353686DAAD8F3EB0E6A868109938A01CFD86653790D6D6FBE0F7C4CB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	EDCE71C0A1BAB76AA9C88E867DA7C705	7A077334E681BD65634C1A09D0669EF3A00709E4	FFB9B95CB9639464EDC7F732E7CF46438DCA946F3FD8CF0399A74923D2CC7CC9
C:\Users\user\AppData\Local\Temp\acrocef_low\63d3b85c-a46c-4a9f-b353-1ef74f0b38f3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\656a6fe2-7dee-4884-862d-06f22b9c90ee.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\7f45f924-3d6e-4cf4-8780-bde968f4d1bc.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\9a15e1b2-26d2-4758-90e1-5b1b0d4c1d4d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\b0d6745e-efbe-40f1-adcb-95dbdc4f6b3c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\ba65eb62-47da-495f-b152-9dfbfd4794d0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\cc55db8c-e207-4543-8774-d282e7d6f0c5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290	DEF321E04EC4FBB953CBC6F27CD0FBDC	97D56ACC0F395E6252B92C6DAB0B301F25473FDA	A78C038B2D62BFD7BA229DAEA891991187779DD7B2963F272BE8FE3EE866266A
C:\Users\user\AppData\Local\Temp\acrocef_low\fb75dd53-d7cb-4669-9b2a-fa09f677141b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290	C12D53CA8B8A9B6D6E32D0AF9F588219	27E44493733E3B80A2B71774CC8CBADC9E113D52	B9E3D41AE701C771D95E113F54207D431E379F4A013DDF98D9D69F49961C486F
C:\Users\user\AppData\Local\Temp\olkE9DE.tmp	data	DB04B5749B278BD722909FA92E7F6456	A35BBE53E494F542A539314648C528B8B3440964	4A27E3E5A84F3E47842ABB9A08334E045F794F4EFA330A2F97FC0977B70AFA70
C:\Users\user\AppData\Local\Temp\olkEA6B.tmp	data	E11212B8A068DAE73A41B45FC33AF805	DAE14A37A5BA7BDE6F5BC9995D17C6442149A58B	AAA43951132CD82E6224E869159AB84F80D6CD016A3F4B16CDF6C3A91CB07626
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl	data	E065ED9E0BA27CE9AA01B2E6DCE176D6	8EC18FEC23AC624BEA7E64A6701E8E796134E0F9	DA8972E0ED195C72876583AF6A2366689942472ECEB405D435431A90FD0C7869
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst	Microsoft Outlook email folder (>=2003)	AB1FA0D247E7D50064F90EBFC0EFE740	D01F380A84AE883F9FAAE866FBACE3774940D52C	BB9452F3B3C6EA1293C13A29BF6BEDE2633CB7BD750EC02A477940534CE8E0AE
C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp	data	7CEC575E72E9D177EDA26F0A8178A6A6	9787EBE3EB2861B4D230CC1C334E1E670115CD45	E039898240D0AB57E05D0A2BA616A7EABCE8FE4B410175AC217A9C53F50DEB6A

Windows Analysis Report Re_ Remittances needed (1).eml

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
Re_ Remittances needed (1).eml