Edit tour

Windows Analysis Report
Quarantined Messages (15).zip

Overview

General Information

Sample name:	Quarantined Messages (15).zip
Analysis ID:	1432349
MD5:	8d89059c7721fe1d5f8be57c644ee433
SHA1:	223dad869ea21d219747eb768cbc2b5e83560ec8
SHA256:	9baaecb8ade1197ee32e2ace07d2c43b323d143481a5fd237ca9edefde888163
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Outlook Security Settings Updated - Registry

Stores files to the Windows start menu directory

Stores large binary data to the registry

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Process Tree

System is w10x64_ra

rundll32.exe (PID: 6988 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

OUTLOOK.EXE (PID: 6156 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Temp\Temp1_Quarantined Messages (15).zip\cbfd3c9f-d4f0-468b-2a4c-08dc65fad5fc\74ea26d1-39d0-8d32-e448-abf8b3cecd35.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6168 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "8E1E02F5-D584-44D8-B881-CF50172A0833" "69E38C55-4508-4C08-9E86-88C924D6568A" "6156" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

Acrobat.exe (PID: 6520 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\42M0QSM7\Library Document Station.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6976 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5320 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1616,i,649523003280726296,778177480113434692,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7340 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://myomniview.omnicare.com/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7588 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1956,i,4999386548928164533,8151585639739316025,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6156, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\42M0QSM7\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6156, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://myomniview.omnicare.com/

HTTP Parser: <input type="password" .../> found

Source: https://myomniview.omnicare.com/	HTTP Parser: No <meta name="author".. found
Source: https://myomniview.omnicare.com/	HTTP Parser: No <meta name="author".. found

Source: https://myomniview.omnicare.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://myomniview.omnicare.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.14
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.14
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.14
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.14
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.14
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: myomniview.omnicare.com
Source: global traffic	DNS traffic detected: DNS query: se.monetate.net
Source: global traffic	DNS traffic detected: DNS query: tags.tiqcdn.com
Source: global traffic	DNS traffic detected: DNS query: f.monetate.net
Source: global traffic	DNS traffic detected: DNS query: sb.monetate.net
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: metrics-sentry.cvshealth.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: clean2.winZIP@35/73@22/13

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240426T2222340839-6156.etl

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Temp\Temp1_Quarantined Messages (15).zip\cbfd3c9f-d4f0-468b-2a4c-08dc65fad5fc\74ea26d1-39d0-8d32-e448-abf8b3cecd35.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "8E1E02F5-D584-44D8-B881-CF50172A0833" "69E38C55-4508-4C08-9E86-88C924D6568A" "6156" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\42M0QSM7\Library Document Station.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1616,i,649523003280726296,778177480113434692,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://myomniview.omnicare.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1956,i,4999386548928164533,8151585639739316025,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 2F5288615B3ED7224DC07CA512AF2BFD
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "8E1E02F5-D584-44D8-B881-CF50172A0833" "69E38C55-4508-4C08-9E86-88C924D6568A" "6156" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\42M0QSM7\Library Document Station.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1616,i,649523003280726296,778177480113434692,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1956,i,4999386548928164533,8151585639739316025,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Rundll32	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	107.23.121.179	true	false	high
f.monetate-prod.zone	3.86.126.62	true	false	unknown
www.google.com	142.250.64.196	true	false	high
dzfq4ouujrxm8.cloudfront.net	108.156.83.120	true	false	high
myomniview.omnicare.com	unknown	unknown	false	high
se.monetate.net	unknown	unknown	false	high
metrics-sentry.cvshealth.com	unknown	unknown	false	high
tags.tiqcdn.com	unknown	unknown	false	high
dpm.demdex.net	unknown	unknown	false	high
sb.monetate.net	unknown	unknown	false	high
f.monetate.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://myomniview.omnicare.com/	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.86.126.62	f.monetate-prod.zone	United States	14618	AMAZON-AESUS	false
44.209.196.217	unknown	United States	14618	AMAZON-AESUS	false
104.94.108.142	unknown	United States	16625	AKAMAI-ASUS	false
52.109.8.36	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.212.210	unknown	United States	35994	AKAMAI-ASUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.156.83.120	dzfq4ouujrxm8.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.64.196	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.109.28.46	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.111.227.28	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
107.23.121.179	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432349
Start date and time:	2024-04-26 22:21:58 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Quarantined Messages (15).zip
Detection:	CLEAN
Classification:	clean2.winZIP@35/73@22/13
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46, 52.113.194.132, 52.109.8.36, 23.221.212.210, 23.221.212.218, 52.111.227.28
Excluded domains from analysis (whitelisted): omex.cdn.office.net, us1.odcsm1.live.com.akadns.net, odc.officeapps.live.com, slscr.update.microsoft.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-cus-buff-azsc-000.centralus.cloudapp.azure.com, login.live.com, officeclient.microsoft.com, osiprod-cus-bronze-azsc-000.centralus.cloudapp.azure.com, a1864.dscd.akamai.net, ecs.office.com, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, cus-azsc-000.odc.officeapps.live.com, cus-azsc-000.roaming.officeapps.live.com, fe3cr.delivery.mp.microsoft.com, us1.roaming1.live.com.akadns.net, s-0005.s-msedge.net, config.officeapps.live.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, prod.odcsm1.live.com.akadns.net, uks-azsc-config.officeapps.live.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetValueKey calls found.
VT rate limit hit for: Quarantined Messages (15).zip

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.162829736206868
Encrypted:	false
SSDEEP:
MD5:	7845D1E2A1743143C0FE38F8D719918A
SHA1:	BB4174645CBC907AC14FC12CB75224D60F7542F5
SHA-256:	18D3D1DE75FD77B289CD948246D13FFF0ED3A49A3910E23AADB8E44FE1800464
SHA-512:	768675727D5F155E2EAB6F2D2D35D71E19B1A23588451E51B43C350CA7F8E38D1EAE39F596832669240B7A84A4159592CF777EF035E85AE169D7C1C73E2C81E8
Malicious:	false
Reputation:	unknown
Preview:	2024/04/26-22:22:42.964 1828 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/26-22:22:42.965 1828 Recovering log #3.2024/04/26-22:22:42.965 1828 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.076741095887516
Encrypted:	false
SSDEEP:
MD5:	6C5D77F468DC5614E1064EC683855211
SHA1:	F60D9F4D378E3008A8BDD37CB5897EE53267F651
SHA-256:	DE4966C12938E24E7DCDD2F845C351576A51D6F4A1B69F8EEF44F16924C088CA
SHA-512:	9FD9CF0710A3453AE5157998BE45D5207A6E541845DD4F7F64BF5F6624149F6E7D631AAF83E8862BE65316D67A35DFFFDD4021DF9641E055D8EBC66F79BFBC01
Malicious:	false
Reputation:	unknown
Preview:	2024/04/26-22:22:42.850 ea4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/26-22:22:42.854 ea4 Recovering log #3.2024/04/26-22:22:42.854 ea4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.233129504797848
Encrypted:	false
SSDEEP:
MD5:	5847527886A5B342807541C87F92ABEA
SHA1:	22873CE12249E28872959E4516C9519621406390
SHA-256:	D87A9227E6EC59ECD25094E92407E0782092DD347B4C0A718A095FE2F2011B01
SHA-512:	25400012D5DDBADE4E48E352474776F921CEF0126F13BD05F0A0D94D176FAA1748F8B53669DB4798543174C310DA624D6CB4D49D3536ABD57E19C216704DEC2D
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.087882625900376
Encrypted:	false
SSDEEP:
MD5:	C2C4CEB7A16440D4D957E6FC3481B5DE
SHA1:	741FA5FF0860C9ABE5FB00ACE8EDA2E631FDEFC4
SHA-256:	1C33181CE81ECD2F3F6933FB2F0306AF7184BA88B8057D1CB8EF61D7B53A1F83
SHA-512:	5EB80CBAB640E875AC5D316B70201B8AB408CB09A83069D06798720E14EED4BCF6E1B5B00D5F9DA56C86E78560D5D62B103BBA0FCC614CD5956401CEB3799B99
Malicious:	false
Reputation:	unknown
Preview:	2024/04/26-22:22:43.010 ea4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/26-22:22:43.016 ea4 Recovering log #3.2024/04/26-22:22:43.018 ea4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240426202247Z-173.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 116 x -152 x 32, cbSize 70582, bits offset 54
Category:	dropped
Size (bytes):	70582
Entropy (8bit):	2.9453175604362745
Encrypted:	false
SSDEEP:
MD5:	0FB8E4DB4DE4EB0880D40B3D838C1BD1
SHA1:	D385451DC3CBF5DE87E688080FABA73E0065BE79
SHA-256:	BBEC0ADE658DB02EA802532BAA098DA238E999F2C03F49DCDE3AE15ED63F6EF1
SHA-512:	C81299C36AFF4A4229C163E898EACD5012BDC8854915D5E50DA7F8455817A07E22CEE68542775099DE83790E54E5F47C16A7B8BA448C08AB2F93038C0EA96D4A
Malicious:	false
Reputation:	unknown
Preview:	BM........6...(...t...h..... .........................................................................))).....hhh.DDD.***.333.WWW.///.....ccc.>>>.))).!!!.........;;;.....HHH.DDD.FFF.<<<.............................................................................................................................................................................................................................................................................................................................................................................................................@@@.KKK.....111.........BBB.%%%.]]].'''.ccc.....&&&.BBB.{{{.....:::.^^^...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 1, database pages 9, cookie 0x5, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.6478669371782999
Encrypted:	false
SSDEEP:
MD5:	F447B2D9D27C6446C01B19F020040229
SHA1:	3A7A021F4428E2F696FF8FFC43A8CA90D72C2CA9
SHA-256:	C3617160CEB4F24C6A3CBDBF7D9D1A6B391F397BE299FD738DD35CFBD17E7FDD
SHA-512:	20A603861123F82CC173FDEB45885414CD986DB9B37DC89C6913F3185C831A3E87E24BBD38AA8717A21C71337CA0AEE82D082E0530A21F4BA6A8A5AA86001443
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:
MD5:	96E2CFFC0447159124D4FA018FB6B3CA
SHA1:	0AA9D60D932910732C456C9447F8875C9D9D2A9E
SHA-256:	452697DFF6A18ACE47CD0331D0C3987F5AF0BF91893364FECBE4F871161C6F34
SHA-512:	5B624E4A692BD47AF4F16252505ED3CAE66B73122FBB129EABD47B581AA60FDE82460E0FE715478A027C2E6A2AD8CCD9F673147A3FF46D3EA123A6FB6FD07722
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....A^..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.348149525104506
Encrypted:	false
SSDEEP:
MD5:	92AF18089A510A7B60473A8C81755D43
SHA1:	AEB730D4203DCF67A4284B5C100357EE26BD158C
SHA-256:	96B89C8498BC995CA6A4B22CB98155FAE1CBBCC14AEC9D8B3054302F73421A34
SHA-512:	4AEFA0A4DCB24289F0365701E48B800F2D58E88DA5E49EC4EF0A88C57FAA14C907C6BBCBF211F8A5C495717581ABB4DB6A94AEB525B8ABBD1ECFA7AB671E56AB
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.295543450796083
Encrypted:	false
SSDEEP:
MD5:	CFB45F3FA85A0179FC111736CF344D18
SHA1:	FD0DAD41F340C0FE6957D67DB74D2EBC5EDAE8FC
SHA-256:	E9C9DD329E3ABDC41D807B522732FD690414441529465E7C57D463BFFF916477
SHA-512:	1BE98A059FD6E0988358AB4CE258462AE17A3604F00DC5EE18402503AB90948C88A5C86A9A08545F580934FF630B0093D346698DB24F812D4BDFCFB072AA0EDD
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.273393544373152
Encrypted:	false
SSDEEP:
MD5:	C81CFB9C4D6C94CB33B7552CB8ABB40C
SHA1:	79779CD65F44A3DCA16568E8A1AD0E508FC679BD
SHA-256:	25EA7D5345D624999C2287A3AD6717DE424C528926302163A738C7D961EB238C
SHA-512:	054939BD8987A64994BF7AA3765C4BDAE978DD85E1141E3C0AE25793D5BDDA207C2CA268205FCDEC657559C8F335FA3645EF3ACD7C8C0F23282DB3A121888B51
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.335995894153828
Encrypted:	false
SSDEEP:
MD5:	C4CB35A56F92C7EC7DE67703C72AA0E5
SHA1:	438DEE375D299448BEBF7408A8AD33EA27852789
SHA-256:	843369C227993F33D5FAD1EE2BA442E3AA100BB04A3916A6130A2E85A99B82AB
SHA-512:	EEE23B1C0CBB6E61B56AA7FD02329E4B1C1331C836FC5B879D1B4EC6A3FDBA441C417F4E56E714BA20A2A523FDC22B74722504B4B1ED2ACE8216446B117A88AD
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.30066763679679
Encrypted:	false
SSDEEP:
MD5:	C2E304FA1BD8E9F1CB7766B9A368CECE
SHA1:	376B0E84D7B18A13F00D74205717A80DB57714C8
SHA-256:	7E3A7832CD5B728424946A6975D55CC8540C6F45B36D5F029BD5D4E96FEB6900
SHA-512:	7B67C1DE440BFAEB664F10FA9B13B561E902F849A60128086FC86FF1DE0BA3D0AE0595948B7CC72C13A7F05A9892938ABC5F5829D82D063DBB4D9424E4F8E97D
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286708919703955
Encrypted:	false
SSDEEP:
MD5:	CE1468807F047CBFA00CF91065310E1D
SHA1:	0AEF43AF0C3C35D9FDE472BD406F46E3DCFDB07F
SHA-256:	6F1B47C8020B88A534651370606B280018F3339938CE146BDDCB3688360D949D
SHA-512:	AD005EAE94F479FE06FD276B39E1A221785509E1265E553F9157946C7F91A36D446A77B1DDD332F8418EFEFCD7CA101E57E3F0F389923BDDCE4D8FE9BA542E73
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.289788523436981
Encrypted:	false
SSDEEP:
MD5:	80E5C64EEBCA97620B14EFE1E999B0BE
SHA1:	DB234720E11B7747E463EA405B7C2A042F20E69F
SHA-256:	7A34331A4CAE2EE3DFFF1A95A69537267EAC11F18BDAD2A275E47198D2466070
SHA-512:	F509061D5E38AA9FF257C7FE41BA2F989799D02D0F7FED43361A819890ADB2EBC05C11ED67D9BF921CDA23529E36B08B7A4C4701913080D3C874E86723CD2666
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298732963552232
Encrypted:	false
SSDEEP:
MD5:	AE0709F805ECCC4525C592038F3EC37F
SHA1:	3069980C60E94577CB1C584751F1025C3F4E13E1
SHA-256:	9300BF06C9931D83CFD3F1D7844DB54F9BB6AF88CE2F388D31D3E975B34EC97D
SHA-512:	117E6E0CB5C41F81E2CCB2061CEA2891EC47FAE5D3577B3DA3DA9DF421C4A5AAE4E8489DDC58FCB2EA11791733EB3A5C744AD52F9D0CFFAAB1310EFA297AE068
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.741272870121948
Encrypted:	false
SSDEEP:
MD5:	C2AC98157A38BE50E7EC48A7DCD6A450
SHA1:	D70D278031747BC5FCCB5B64F965C6370B6E57F9
SHA-256:	96AC2D0F9FA93A8D87459DD1D04CA2F09F8F1FD6D7CB324D0E4B7349AB8FADFD
SHA-512:	42866EB4D47C016BFBAED8EB0A7A63227898B2CD81955696125410D04CB0A880D5D7F270D7122152CD427952C6A138E2A5719F758A097248E965A27122114B33
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293747866221274
Encrypted:	false
SSDEEP:
MD5:	90EE57F51B613C0977662746CE7D508D
SHA1:	8896D73FEEB7862821841F2CA18A979C9F35960C
SHA-256:	2051E70BE22460897D8C684B85C51BCBD08922696B9E6DC0200FCD8AB3E8EF25
SHA-512:	28B33A75D4BDA2B75B47ED11FDC4ABB8AE76FA30B8D657CFDA0AAFE0B6AB9E3B04DD712E34A5B916EC1BDDB3C3B5A111CE9B376302C2A62A17E91271FF25DA4E
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.776132533269641
Encrypted:	false
SSDEEP:
MD5:	D4B638D69F22442AF856F4E5BB4BBE8C
SHA1:	83F22FC9ED50A19ED57DC23D37835C6911205C45
SHA-256:	334E40479545F7053D9746289DA1D6B2F1CF3F9B9546FC7554ED49C8AAAE1ADB
SHA-512:	FC0983A013D041E6DEE8BB0FAAC70B78A72894644D830A43661CD511B42B5E65281D065AF09F112F20A6B0744ACC26064A94CFA97AD2F57BF973D7C2E7D6B55A
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.277337933886744
Encrypted:	false
SSDEEP:
MD5:	A6845A2CF0F5097394DCDAAA0D7C9678
SHA1:	078846C40829F426DF55BE11DD5ABCA6E42B0154
SHA-256:	3E0CEB215B63DAAA73EB4A478EF85A3A18D93D08BC9268EA577ADB76E061155E
SHA-512:	FF5A1C7972BEC6D49505873E924A2013377387021F00A0863975801C0A9E9F5A806E8CAA843551B470CD86CBF3690CF31D2309DEC73A5503716E368A496F3661
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.280632715332207
Encrypted:	false
SSDEEP:
MD5:	5C49FA4DB8A24550275E6681D4CE2658
SHA1:	FBD6CA679A38455F056045AD7A6874BAA981FE85
SHA-256:	17D28CD2EC359D788DEEFD7DDCFFE02E1B4222A0F449C8885DF0230F3F98E7DB
SHA-512:	2AE27FA2050C7429185620A289EB9D1763A36B8C0C89DB5F13FE3371A2A4A32B46A4ED5CA428E8848D9D9FE78767F42AD33EDE67CFEC67CDCE554B6F7B1B341F
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3002891769052
Encrypted:	false
SSDEEP:
MD5:	187A1071769B3E260D08A126F92EA43F
SHA1:	45B3366BDF1FFA962478C7799CED440938834EEF
SHA-256:	74DD65B1E077473BE207D359F219F83F7432B9511A78CE93016DDEF1BE2C7EBD
SHA-512:	609A6BCB3CD3B109CE00FD18DE62888943C2D4A843777C08EFD5FDB67600500759F0B5828B2CD12F955B368AFF0BDB5E13E04191E54610E426093E7AA1C097F5
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.258240994087646
Encrypted:	false
SSDEEP:
MD5:	8C65064BA5D667C71FD99B4F429D35B4
SHA1:	5CD104EC542B266C3172638DD9369FFD5BB99B7E
SHA-256:	F70AE0D8E0312E15D7F47FF702F1140F3BC841487EDF5950BD8C2945171A1602
SHA-512:	5E73B6B1A87EAB2DD376BF8E9DD7AD816288A647828B80BD7B884AF67178429C2F54209081C2870884FAF346559A4CB142391E807EACFCF188D89FCB65AB6390
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.368690061906406
Encrypted:	false
SSDEEP:
MD5:	95A46322485F93F0125D1DF8ED8E527B
SHA1:	2D9AE63B477036E1B0D3DCDD0A0248D224C9FFF4
SHA-256:	CC5B249AEDE1981E325BDC6104F401545F53FB26F2CAF4596E0816CD77891E27
SHA-512:	D6239BF52CD15FC5C38BF520C06408B6230BD0A5F28D686BE646C3CE4F7249A1B695E8FC20FBBD7D3933FFB31AD6BD7467BAA561C3D94902396C1109544E0A68
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"61306acf-cf5e-4149-961a-43f3c303b747","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1714341544725,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1714162969760}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134571755735287
Encrypted:	false
SSDEEP:
MD5:	191AFD902E06FFE2C5E66A1F52181D37
SHA1:	27D76F8A4562B1AD903263B08647F9817999BCB6
SHA-256:	6C9A7ADAB418C333880F03FC300DA6C511A0694FDCB8D037F48B0C98BB3EB271
SHA-512:	73F9442C60F35C8BB1C7737CBF63F6C5D8F8199339DC87D4475D0202A227A990092339F5D17A4C567FA89B0266CEF81D98D4372F3390BC3B3D0AD68C651EFA71
Malicious:	false
Reputation:	unknown
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"13160c6dc0785a1b474cef3668967d09","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1714162969000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"a171da97ac389f612eb88748fede6483","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1714162969000},{"id":"Edit_InApp_Aug2020","info":{"dg":"23f8ee6188937d66e139688ccef16fcb","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1714162969000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"09828169445ba1d91e6d7a7192dcf1a3","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1714162969000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8741aebf00ec48b87cc1b5de8eda48ea","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1714162969000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"c2751c27b0e1e31af1bc160b284380ac","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1714162969000},

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.3842671929985695
Encrypted:	false
SSDEEP:
MD5:	AE61267CEDFA4DC649A190FDEC65ED1B
SHA1:	64F0C93BCB42BB4C8CF9C9E80B3E30C9D5BD90EC
SHA-256:	25CCDBD4644CB1457874D990B31DE6B666DB6B3B10A4A15442B6A9EE92FF8B0C
SHA-512:	40B573AFD2DCDB15C50250E695BBB9EB25E5690CE9381AB62FD2A89F6B0EFABB6738C6E81472D702DB7DF151A0BB5F2516C33D020FB3D3DEA86581C44E848459
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ....l........SM01X...,....'.l............IPM.Activity...........h...............h............H..h\.............h........p/..H..h\cal ...pDat...h.2r.0..........h...............h........_`Rk...h....@...I.lw...h....H...8.Wk...0....T...............d.........2h...............k..............!h.............. h..F`.........#h....8.........$hp/......8....."h.a\.....h]\...'h..V...........1h....<.........0h....4....Wk../h....h.....WkH..hh..p...\.....-h .............+h-......P................... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	unknown
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.6464393446710157
Encrypted:	false
SSDEEP:
MD5:	1E12BEE62491350AC56052C27B3BB853
SHA1:	1F4E4D32900719DB10A70CFC5779F2C21C9467F0
SHA-256:	C9696724A4928FCBD11BA8C4AB8D6C06734DE2D92AA9BFEE01ED903A4B6442CB
SHA-512:	CC85AB0631764D0B9EE1A35CBA2CB6B68B0DAB3A74AE7E3D9678391CAAA8FA348F15CB8C0027BCAD9A1793EF7C5C9F6D40918ACF63BB85CA624BE1ACC42AF36D
Malicious:	false
Reputation:	unknown
Preview:	1714162959

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\884CA826-777F-463A-ABF5-B96E0ED847C5

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	166208
Entropy (8bit):	5.340912615383234
Encrypted:	false
SSDEEP:
MD5:	6EA03E7EDA2CC39A432ABD46FF50CE72
SHA1:	3853BB3D48AC5BC9C305E56B71F3C4B436EDCA49
SHA-256:	56E7FE60B817C4AE205B8C8366484D5AA1D8430436E01B8F5877EF86D008643E
SHA-512:	3F9130211DB4BE224A139398B731381C53E4EBD4F99785E889C05797E1BEB5C77C7F7592795D3A7918EE2704D905E27D709ABFDAA027B7531C997733EC346D90
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-04-26T20:22:36">.. Build: 16.0.17619.40127-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuth

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09216609452072291
Encrypted:	false
SSDEEP:
MD5:	F138A66469C10D5761C6CBB36F2163C3
SHA1:	EEA136206474280549586923B7A4A3C6D5DB1E25
SHA-256:	C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
SHA-512:	9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13760166725504608
Encrypted:	false
SSDEEP:
MD5:	8685BE1A07DFFE5FC203EBDBB82EA739
SHA1:	07974C17E64D0D1DA001DF267D4352AD9EACCDA8
SHA-256:	035D0A2CCBA92B13C0BB5347B3A4A9D709AFDC456BB778586B66ADE4BC45BB3B
SHA-512:	7A20804FD1C6F36EF0FDD9BF0A269523E7C61CCD9091A175FE1B39538643B23659D7C8A590F011629100740AE5193FAE8A2E957E05211B03FC07050E0FDA159A
Malicious:	false
Reputation:	unknown
Preview:	.... .c......unD....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04449162272699445
Encrypted:	false
SSDEEP:
MD5:	4449E9B983A7455C1B441D789AD320A4
SHA1:	B2864DF98C33FE73C06BF8CD96816F012119C78F
SHA-256:	AA8F54CF9BF85FA05D3B3C6F63D3A13085E67E19D71071FB259F006F0E8C06C6
SHA-512:	E8366BE5EBBCD5CD5C30979D92B4603533E9CB3379CAD9BC9E8E4875323E775E02E445B6A0B5A3359F3E71C6DB4A8E6BEAE150F715A32E8D6181E8B12A3BB505
Malicious:	false
Reputation:	unknown
Preview:	..-.........................gW.......y0..~;.....-.........................gW.......y0..~;...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	45352
Entropy (8bit):	0.39608896228603224
Encrypted:	false
SSDEEP:
MD5:	653E41264AA0D9EDF343EF78F0143DAA
SHA1:	D18024DC78058C3885D53BFCD021BA297D95B1FF
SHA-256:	CD531A9FB1F1F3E45A8657218B579F4F1D6F6FC4F43F8D782EEFCCB2F10C2F87
SHA-512:	9ABFF5B1E234F41100D0AA6435B2F373B18F19F76B2E843E9A8D15B5FFFEB2FFC6CF401E5AB82F2C857B3720B7106976752A259FE997ABC9837C02BE9A66AE1E
Malicious:	false
Reputation:	unknown
Preview:	7....-...............y.....7a4.............yK.e...<zSQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\42M0QSM7\Library Document Station (002).pdf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	251400
Entropy (8bit):	7.982817892604652
Encrypted:	false
SSDEEP:
MD5:	DDFA02EB2BB1BFD4E4938B769D33BAEA
SHA1:	A40650188910A61D25EFF706941C7B8D8A6CDC24
SHA-256:	D61E1E79F88C729F03B354B240A1B6C28DB71BD3C0B205D3406663B8D23D7EC9
SHA-512:	7E684DC98647816A4500E26E5839023A6D7EA0C3037A91137A2A5D4FB81D92B894E96C47C802DA052D5596197E82FDC9C434D53D0075A8B609EE6A9F572AE6FB
Malicious:	false
Reputation:	unknown
Preview:	%PDF-1.4.%.....1 0 obj.<<./Type /Page./Parent 2 0 R./LastModified (D:20240426101154-05'00')./MediaBox [ 0 0 604.8 788.16 ]./Resources .<<./XObject <<./Im0 3 0 R .>>./ProcSet [ /PDF /ImageB ].>>./Contents 4 0 R.>>.endobj.4 0 obj.<<./Length 41.>>stream..q.604.8012 0 0 788.1616 0 0 cm./Im0 Do.Q..endstream.endobj.3 0 obj.<<./Type /XObject./Subtype /Image./Interpolate false./Filter /FlateDecode./Width 2520./Height 3284./BitsPerComponent 1./Resolution [ 299.9994 299.9994 ]./ColorSpace /DeviceGray./Length 150259>>.stream..x...#Iv..Y.[Q..0.l.K.R.Z.....[...}.1z.0.O>....p..@.......V.Q.LN.:....?..:.e...~;.$\'.....4{.....n.=.Y...v.lgG...$.$..d..d....*2....."^..v....o.!.S..!.CB.s....../...$.+....~'...uD..E./.}...;.......}`...9t.L...F'.....ct>y.%t.......`..nED..)9.t6.:P;....C.3u...h..#.....V.#Vz.+x...\|r.O...S.u.t.u.......c.!.?...f+....}}-t.+K..:.h.N.G...........B....B?..x,....../..}Q^m~..x.^.P.2.;...t...a..5."...B..eVIp.O...Sr..../.:....)y..!..`.p..L.....t........`......59A..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\42M0QSM7\Library Document Station (002).pdf:Zone.Identifier (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	DDFA02EB2BB1BFD4E4938B769D33BAEA
SHA1:	A40650188910A61D25EFF706941C7B8D8A6CDC24
SHA-256:	D61E1E79F88C729F03B354B240A1B6C28DB71BD3C0B205D3406663B8D23D7EC9
SHA-512:	7E684DC98647816A4500E26E5839023A6D7EA0C3037A91137A2A5D4FB81D92B894E96C47C802DA052D5596197E82FDC9C434D53D0075A8B609EE6A9F572AE6FB
Malicious:	false
Reputation:	unknown
Preview:	%PDF-1.4.%.....1 0 obj.<<./Type /Page./Parent 2 0 R./LastModified (D:20240426101154-05'00')./MediaBox [ 0 0 604.8 788.16 ]./Resources .<<./XObject <<./Im0 3 0 R .>>./ProcSet [ /PDF /ImageB ].>>./Contents 4 0 R.>>.endobj.4 0 obj.<<./Length 41.>>stream..q.604.8012 0 0 788.1616 0 0 cm./Im0 Do.Q..endstream.endobj.3 0 obj.<<./Type /XObject./Subtype /Image./Interpolate false./Filter /FlateDecode./Width 2520./Height 3284./BitsPerComponent 1./Resolution [ 299.9994 299.9994 ]./ColorSpace /DeviceGray./Length 150259>>.stream..x...#Iv..Y.[Q..0.l.K.R.Z.....[...}.1z.0.O>....p..@.......V.Q.LN.:....?..:.e...~;.$\'.....4{.....n.=.Y...v.lgG...$.$..d..d....*2....."^..v....o.!.S..!.CB.s....../...$.+....~'...uD..E./.}...;.......}`...9t.L...F'.....ct>y.%t.......`..nED..)9.t6.:P;....C.3u...h..#.....V.#Vz.+x...\|r.O...S.u.t.u.......c.!.?...f+....}}-t.+K..:.h.N.G...........B....B?..x,....../..}Q^m~..x.^.P.2.;...t...a..5."...B..eVIp.O...Sr..../.:....)y..!..`.p..L.....t........`......59A..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\42M0QSM7\Library Document Station.pdf:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1714162955073201700_C8428DEB-B09D-4FC9-8AE5-D286EDAD2D41.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.00383374113762284
Encrypted:	false
SSDEEP:
MD5:	26B6930258E701A3F85CEE3AA5369467
SHA1:	2C2293A6818F788328AD6E66C4096F4A347231ED
SHA-256:	79F02F672DC967C19DA4210756745AE411280EFB859FDF5B5D05EEB66C336C3D
SHA-512:	E76AEDD1A1CED7BB5BC9674115802647BC0FF7844E637B9444357D7F690911937F3C4E5F1F7EC199475134F11BC77235E282BCACCC2237E5678C386FB3FFF102
Malicious:	false
Reputation:	unknown
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..04/26/2024 20:22:35.151.OUTLOOK (0x180C).0x1258.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":21,"Time":"2024-04-26T20:22:35.151Z","Contract":"Office.System.Activity","Activity.CV":"641CyJ2wyU+K5dKG7a0tQQ.10.1","Activity.Duration":204,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...04/26/2024 20:22:35.151.OUTLOOK (0x180C).0x1258.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":22,"Time":"2024-04-26T20:22:35.151Z","Contract":"Office.System.Activity","Activity.CV":"641CyJ2wyU+K5dKG7a0tQQ.10","Activity.Duration":704,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.F

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1714162955074008300_C8428DEB-B09D-4FC9-8AE5-D286EDAD2D41.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI5cbbe.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.498421423848992
Encrypted:	false
SSDEEP:
MD5:	2978E517DA0A278257E04568561A2098
SHA1:	75BD47ADB567B043C55ADBC43944EF78AACAFFC8
SHA-256:	DB3E226E7C3D8046203CAC8F10196CB34524B20BDC3A4695D58EAF1CC6EE953A
SHA-512:	58202375EF1F26B389D33C9C2BFC2A2FE28C592E0010BC3D94F986CFD8F9499F2543D160048473D17BC13ACBA3655F2010AD926228EC3F80E65EB5FAD1960C6E
Malicious:	false
Reputation:	unknown
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.6./.0.4./.2.0.2.4. . .2.2.:.2.2.:.5.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240426T2222340839-6156.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	4.689941823006525
Encrypted:	false
SSDEEP:
MD5:	000BB92314396F51E9A873FCBCE162BB
SHA1:	07E10F1CB59950C3AED19AFBE64F69B5D2F193FA
SHA-256:	39B53328BB8DA3B0249EC2C79CE6D58FAD78DC1497058D20D2E9D8223055B7B2
SHA-512:	DCADC69AFA8EAF392D132A3EFBE28A7C19A84D84CCA8BD77898E0FC7BF7EBCF6D8BF0E613E9796AFE7F6591B5A030CF63BECC78DCC2C61019F1980172D227657
Malicious:	false
Reputation:	unknown
Preview:	............................................................................`...........5.Yy....................eJ..............Zb..2.......................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1...........................................................PU...Y..........5.Yy............v.2._.O.U.T.L.O.O.K.:.1.8.0.c.:.8.8.a.4.6.9.a.c.f.8.a.f.4.d.d.4.9.6.7.5.6.2.1.d.b.3.4.2.4.e.6.0...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.0.4.2.6.T.2.2.2.2.3.4.0.8.3.9.-.6.1.5.6...e.t.l.......P.P..........y[y............................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.382706767516861
Encrypted:	false
SSDEEP:
MD5:	F8ADA0A58DC4E3DC76F5458156EE86CB
SHA1:	C786A0E05267A3C5B53A3FF9E164A10C641EFC5C
SHA-256:	4DB3354661C07A06C99B21C9E789EFFF10C37945A1E6F70EEA45FF831EF9F32F
SHA-512:	6B1EAF4205965EDEB06EA8051DC01C2189C5CE784ED88A22D3450DEEF8F555A860B5B331AFA7FD5B64B7905B3EB9EF2BD60D04111A2839EC6ACE07EFCA82539E
Malicious:	false
Reputation:	unknown
Preview:	SessionID=1be471bd-cfd1-4bc7-a689-0cbbb55003fa.1714162965558 Timestamp=2024-04-26T22:22:45:558+0200 ThreadID=7360 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=1be471bd-cfd1-4bc7-a689-0cbbb55003fa.1714162965558 Timestamp=2024-04-26T22:22:45:560+0200 ThreadID=7360 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=1be471bd-cfd1-4bc7-a689-0cbbb55003fa.1714162965558 Timestamp=2024-04-26T22:22:45:560+0200 ThreadID=7360 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=1be471bd-cfd1-4bc7-a689-0cbbb55003fa.1714162965558 Timestamp=2024-04-26T22:22:45:560+0200 ThreadID=7360 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=1be471bd-cfd1-4bc7-a689-0cbbb55003fa.1714162965558 Timestamp=2024-04-26T22:22:45:561+0200 ThreadID=7360 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrocef_low\1dcbf057-d739-4d2c-b201-0a244ace7080.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	684206
Entropy (8bit):	7.978753154520273
Encrypted:	false
SSDEEP:
MD5:	4CD45314B5979CCC18F322DABBCCF27D
SHA1:	4EAC60942CFFFB0A4CF1A4F0341517E8962829A0
SHA-256:	3451C21E9CF3ACED03C6BD24DF4B41EE5180315FF660E47998222B715EF4A7FA
SHA-512:	F07A0F597D825F78D05097FE50F00E25391D764462056D2C704947504C2AF47A42CB921F220DC0DB7A5003DB9B84715EE64EA7F4B5D23DDC838D42C46BAC1A81
Malicious:	false
Reputation:	unknown
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b8c45683-cc50-4dce-ba9c-72381504f145.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Reputation:	unknown
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b9c65fe5-c44c-4a49-9c79-84e3ce14a89a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Reputation:	unknown
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ff866f5e-6801-4d17-a4e8-6851a194449d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Reputation:	unknown
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\olkD731.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	120328
Entropy (8bit):	7.972613762606817
Encrypted:	false
SSDEEP:
MD5:	6F1B52CFFB33E9F66EE341740026EA30
SHA1:	6F8CF6F47C80CF94D8BE23C1343D5A981971F23D
SHA-256:	1FFCA3245B8CBA805C819E9D5036C0B3FB7FE9177ECEE1DD1CC5DA61E77F6587
SHA-512:	1616605EFA3DEBF059A3E883881B7B76816A5FA5451CE00F72A483B13A10B8F42879E0963C9DA5E333E2C74BB0AF143CDF4FEAB489C232515FEBDF6D8DE76DB4
Malicious:	false
Reputation:	unknown
Preview:	@.......G.'.S.?..C.v".-.6.n...:...1..7..!r..u?CI..[.=V..$..A>:lW.C.U.9']...B'..$..L...?o....nU..u..n..N....~...F....M..'....] .py<....a..r...uM.....Z'..zN.B..r...u.~... .+...+!..U.Suj.P..a.o.j..a...@..S....]..n...aD7.F.u...z=..yF.N.a.c.@........b.Bw...O.4..~\g.:.b.....mIyu...../.=U.T..&.l...C.....)...mv.]......._"..P.0DGov".......!.&.~8.a.......~x..ZK......Z........ ...8E.5..!:.u.Mxh_Z.s...C..e.G....X.a.J..>...}....tz..r.>..g.1H......9..G7..$...k..:Y..[..&..k....$..'Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+Pv..+p...,.....O....4.i...N.i...-.v.Rf.Z.L.\|.f.....i1.cV......i.9.......e.1.Y......]........'y..{....6.M.:....&....-......S....,.......b..(.O\....Q2....3..-..M....GTH.?.4glS.l..W....[..Cwl..<']...tH..........&..nU2..g.]....:9..p.A..x5...Q w....?.O.zy.:..s..!t.>)K....B._!.L..R.G.....e....^..N.=i5.u.....&..J...A..5\|m..]..h;.\|2.K..bO..SS

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:
MD5:	5B8808F920C57126BDDAC89F91A4BA12
SHA1:	EDC771C59BE569E7913F690AF38DB30FB41C1B19
SHA-256:	C4130A6C886F7F08645F3F3B5BF78C2B19BCED6779543D0E80219397DB5A4C7F
SHA-512:	E22A8D62B51DA0015E1FF419A0BC25B155646E88B544B00D0F1D8F40865E26AEFB8A0D310088B33080BE1BA38192BCA697A09154725DA098D020EA3B0F778883
Malicious:	false
Reputation:	unknown
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.6697123323466243
Encrypted:	false
SSDEEP:
MD5:	789E454E0AC77F0E8B9D8C5B2ADB98B8
SHA1:	FD6A1C60552E781E1CD6EF7F44508B0421182C84
SHA-256:	E8D6D233426632317B833137FA2A553041A922819E2E1E2F258601EA1656F8DE
SHA-512:	675B4ACF6E186D8F7D386948F32138A71F1AB4461D1F43D5F4E3AC1A05F82175C65223302970601193A39044A34C7F8DB2886ABAB2C7A3566CABEE2566EB1E89
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 19:22:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9930505986882356
Encrypted:	false
SSDEEP:
MD5:	053F69BB7C7C9E853C5E661DB0B529B8
SHA1:	FA0C36D2529C326242F7DE44FCB996F635773DAF
SHA-256:	ADEBFA2A3C96DE92D7AFFC1AF6D933BD67B585ECD47A3E85789EC5B758E54B5A
SHA-512:	C0557F884BCB864455FA87E318FEBFD02DEBE8C46CC382083B34F45A8B2E796224975A111004F4554EF7B62A5DE89C6B692C02E967FA980D497F9ADC925A350B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....Q[......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........).j9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 19:22:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.007350204207101
Encrypted:	false
SSDEEP:
MD5:	CAF24A9799E161A97BEFCBAC3B5DACF5
SHA1:	48FC7EAF3D233D88855E6FBD784660696770CF46
SHA-256:	B0E8C193C434164BA6D39F437BBEA7EA3F71B2ABFDEC81CDC3ABA840D6C88FFF
SHA-512:	2DC87DA8E08ECC824EFF436C8FE42DC0D2250A385A322A03F9DE7EA9675EBDBBF39EB9BF974843A1CCF53A961FF72F8AF74497840D844F92B750E8D94F6355D7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........).j9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.013529933219424
Encrypted:	false
SSDEEP:
MD5:	648F45A299FACD7D87C10EAAC81EF2E2
SHA1:	86CC13DB21772CEF748B49211EF83B121B593309
SHA-256:	661ED932F3550CFF48E71A0E6CB5B20ADB32E7DF8BCA252B66E1E0BC43C4E141
SHA-512:	75E66D740AE3AE44F1BD1C26F406C35FEA968538D48AACAA0738CCE7A9CC0EB61F19F04A396364C7175346EDE14AAB573B3994DBCF3867A1C74FE3761BD0E2C4
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........).j9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 19:22:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.006380552687417
Encrypted:	false
SSDEEP:
MD5:	E1645AF3962B524ADCD56639CFE24146
SHA1:	93C3E9E437EEB94B280165008F2495E14C151640
SHA-256:	DE020034C5543C1FF51415A47462A40A9EFD80AA2E47A7FD31C8A6CB8A48C69F
SHA-512:	CD8D1078AC7B27945E56ECA65369475F7BE156A8F6A88FD649D87DAFEED511C91F6ACA45D65B501F9101347D1492AB0C238363B4A2FCC78D8EB0F2F7B18DEE4F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........).j9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 19:22:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.993052863483718
Encrypted:	false
SSDEEP:
MD5:	E4AB9137602FB6425958CF0996B1A56B
SHA1:	8664F9E04DABC5EE7814CCA0C8968D33203BC227
SHA-256:	4DB028BB177CF6DAE19F9FAD82731ED0A6F9887B9FD8C5FC694AC9D6DAC2F639
SHA-512:	5EEEFA65913210524A6DB78FCEBD89ECD8B3239ACF5E80CEE6856632A5C9469C3A1AD8ECC0F9D3EA8CFB44E501FDA519E1ECB641E1DC07B4A819D220B7439A1C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....D......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........).j9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 19:22:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.006671065477087
Encrypted:	false
SSDEEP:
MD5:	57EA039C03100CBE51A75D2D41312293
SHA1:	23581487DD4B15CD1AC374594604A144C6B24820
SHA-256:	630B322C9F0395F2377CFA16EF1638AE577C353F5A57C09EB42489CA773C36FA
SHA-512:	05FB568E9A91280D9BDA17B52CACE7FDB65D6CB34357B2CD972B29F2C7F92E043924ABD2EA270D21FEDE35FFD20DA52C8FDFE721B0E88F6AA6FAE04C9DB7BDC6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....#......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........).j9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	2302976
Entropy (8bit):	0.12468240503965256
Encrypted:	false
SSDEEP:
MD5:	C079306F83475516D7C4994035F1844D
SHA1:	011ED7F01E4F7BE53564EDCB0B58F9DECBADBA79
SHA-256:	67B89F076B8551171A59C1A7A20A67D766578DF35E70CA167B39FB1F7686C019
SHA-512:	15EE60211CEA8292887F86ACE2B8C002510AC77A6DC02BF162B0BD23212D8DBBA92FD94AB56625F2DD8068CEBB8BCED63486BC0DD90D2F829AF1B7956A49073F
Malicious:	false
Reputation:	unknown
Preview:	!BDN.=..SM......\...............].......G................@...........@...@...................................@...........................................................................$.......D......................U...............\....................................................................................................................................................................................................................................................................................................H``N.!.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.0339668080944283
Encrypted:	false
SSDEEP:
MD5:	7D6C7409904BCA1068173717F4D2BE3A
SHA1:	975838804EDBC60A3C38B13B18FF68115D0DB738
SHA-256:	4A2D15AF4802D2AF367DC5C919949C7FE2BB4F423F8FE4A5589CA5279B7C59C1
SHA-512:	03DF81D8A071A3983612DE94653D5D0CA1B86F0B3086FFCA66F060152A4874CE1300D7A5114DFBD4DA6CDAA0B1B2C4C55560AD79BD43C9F6BEE52AE6B9265048
Malicious:	false
Reputation:	unknown
Preview:	...J0.................2y.........$#...........#.!BDN.=..SM......\...............].......G................@...........@...@...................................@...........................................................................$.......D......................U...............\....................................................................................................................................................................................................................................................................................................H``N.!.....................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	48
Entropy (8bit):	4.4051876989901
Encrypted:	false
SSDEEP:
MD5:	F154A82EB331B2ADF918265C14F5DCE6
SHA1:	FE1F3E158208104339ED0FE699B5413E827E9E6A
SHA-256:	E3CC46063A7341BCC55180A246577376B49AB6C244B259CF2AF669FCD98BEBC3
SHA-512:	5700C8FD34ECB351658192FDCCB970FB694210D3B545A3A69A8E333344D898CED03BF636324893284F53BAD9AC94B571859E343D9401F7D8FFDC9190B1D355A9
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwkXfhQ2evGbJhIFDQ-obAwSBQ1lIZnq?alt=proto
Preview:	CiAKEQ0PqGwMGgQICRgBGgQIVhgCCgsNZSGZ6hoECEsYAg==

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	7BC0EE636B3B83484FC3B9348863BD22
SHA1:	EBBFFB7D7EA5362A22BFA1BAB0BFDEB1617CD610
SHA-256:	A2C2339691FC48FBD14FB307292DFF3E21222712D9240810742D7DF0C6D74DFB
SHA-512:	4D094B64124366530E7E327B1AD5D06C0FD1CEB96387D6A143E9F561C2F9FF7CA9D68E7C23B8B14AAB5309C202A8DCED9A38D950662A50984D2841577293CD64
Malicious:	false
Reputation:	unknown
URL:	https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cvs/myomniview/202206141346&cb=1714162970918
Preview:	//

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1431)
Category:	downloaded
Size (bytes):	184872
Entropy (8bit):	5.473586403646922
Encrypted:	false
SSDEEP:
MD5:	B4D3060481DA517AFE4C66039565A659
SHA1:	E2E0908EAF721C254CF2D1222E398192018E2F3E
SHA-256:	844AF959F449140256FC13ED6B25A7C605EB3400AC7841F2A3D8A1A7059D12FA
SHA-512:	42F25C6BE51E995D55BB50DF8F55AC6DA2D4DBD9E9EA3BB3FAE656EDF93324BF4F8EF8A5039A406A7B3A99F77BE29F11C8CA22C616A339023A0EE802D187EE11
Malicious:	false
Reputation:	unknown
URL:	https://se.monetate.net/js/3/a-815a421c/p/omnicare.com/t1600161759/09636bb602258921/custom.js
Preview:	// Copyright 2008-2020 Monetate, Inc..// 2020-09-15T09:40:26Z t1600161759 omnicare.js v1.27.19.(function(){var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){a!=Array.prototype&&a!=Object.prototype&&(a[b]=c.value)},ba="undefined"!=typeof window&&window===this?this:"undefined"!=typeof global&&null!=global?global:this;function da(){da=function(){};ba.Symbol\|\|(ba.Symbol=ea)}var ea=function(){var a=0;return function(b){return"jscomp_symbol_"+(b\|\|"")+a++}}();.function ha(){da();var a=ba.Symbol.iterator;a\|\|(a=ba.Symbol.iterator=ba.Symbol("iterator"));"function"!=typeof Array.prototype[a]&&aa(Array.prototype,a,{configurable:!0,writable:!0,value:function(){return ia(this)}});ha=function(){}}function ia(a){var b=0;return ja(function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}})}function ja(a){ha();a={next:a};a[ba.Symbol.iterator]=function(){return this};return a}function ka(a){ha();var b=a[Symbol.iterator];return b?b.call(a):ia(a)}.function la(a){if

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1647
Entropy (8bit):	5.449135058222093
Encrypted:	false
SSDEEP:
MD5:	1E6A73C5BF8B596A8DADE98453BCB21A
SHA1:	8E2DA6F8DF1D7CB6D3CF5472CBFDE4A9AB71CCEC
SHA-256:	BDC7F9070D2087234AE55230C0BC10BAEBF5247FFC57693F39AC55500C29A549
SHA-512:	FA0B15ED0DCB1AD05326FB9A144DC9E7F2844D262FBEBAF69A47FFD049DA4D5D82773E7C1F7AB96D916754F14C12BAA4C3F53612C640BEF64388CB7BBA28B33C
Malicious:	false
Reputation:	unknown
URL:	https://myomniview.omnicare.com/UX/images/please-wait.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" [...<!ENTITY st0 "fill:#CC0000;">...<!ENTITY st1 "display:inline;">...<!ENTITY st2 "display:none;">..]>..<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="62px"... height="62px" viewBox="0 0 62 62" style="enable-background:new 0 0 62 62;" xml:space="preserve">..<g id="circle_guide" style="&st2;">...<circle style="&st1;" cx="31" cy="31" r="30.6"/>..</g>..<g id="Layer_1">...<circle style="&st0;" cx="8.797" cy="43.546" r="0.617"/>...<circle style="&st0;" cx="18.204" cy="53.062" r="2.007"/>...<path style="&st0;" d="M34.6,56.483c0,2.013-1.635,3.647-3.646,3.647c-2.013,0-3.647-1.635-3.647-3.647....c0-2.012,1.635-3.646,3.647-3.646C32.965,52.836,34.6,54.471,34.6,56.483z"/>...<path style="&st0;" d

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2463
Entropy (8bit):	4.321221490243576
Encrypted:	false
SSDEEP:
MD5:	634EB503377437F12124F8A24B3ED8DB
SHA1:	EFA74CB5FDF7459978AB030C1BA1AA25BC72143D
SHA-256:	1669FDC70A3CEC7CBEC0C145C40FB6EFC69A93BA109F52D67389A31466475FA8
SHA-512:	338210FE50C395A3ED4116890F22F4B6AF95FDC708E09484EA5B852F0A05238144F6DAAF543C09F3091A3F44B57BD8A15BA82BA72F16CB25BAE15B677614335F
Malicious:	false
Reputation:	unknown
URL:	https://myomniview.omnicare.com/Scripts/monetate.myomniview.js
Preview:	./.. Supports Monetate API interactions for MyOmniview.. */..function getMonetatePageType() {.. var urlPath = location.pathname.toLowerCase();.... // find page type with simple pattern matching.. var pageType = getPageType(urlPath);.. if (pageType) {.. return pageType;.. }.... // if we still do not find page type, check for some more special cases.. // case 1: resident can be added via organic registration or via Profile screen.. if (urlPath === "/residentaccess/lookup") {.. // lookup is part of organic registration process.. if (window.location.search.toLowerCase().indexOf("register=success") > -1) {.. return "registerStep2";.. }.. // lookup is accessed via Profile screen.. else {.. return "requestAccess";.. }.. }.. // case 2: checking prescriptions page when user has just one resident associated.. // for multiple associated residents, refer ResidentPrescription/Index.cshtml fo

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	3715
Entropy (8bit):	4.459421678263943
Encrypted:	false
SSDEEP:
MD5:	60AB9F9B46C346161AFCE3820647BAC3
SHA1:	B91DC5FDB0F1F401D20F08174BA635F400DE1431
SHA-256:	52C4667C1148FD6BA1E5B9E93D4B512C9C63175443367ED85BF598B7D43EB004
SHA-512:	53179A4E1007CFEE703DC673D6574AC838521DD175A1896A82238C77DD30F1BC02C51F8D8D24B3A4F772BABBD491DBFF3DE743682AF88EBAFF6032D36D37DF28
Malicious:	false
Reputation:	unknown
URL:	https://myomniview.omnicare.com/Scripts/politespace.js
Preview:	/! politespace - v0.1.1 - 2014-04-24..Politely add spaces to input values to increase readability (credit card numbers, phone numbers, etc)... https://github.com/filamentgroup/politespace..* Copyright (c) 2014 Filament Group (@filamentgroup)..* MIT License */....(function (w) {.. "use strict";.... var Politespace = function (element) {.. if (!element) {.. throw new Error("Politespace requires an element argument.");.. }.... if (!element.getAttribute) {.. // Cut the mustard.. return;.. }.... var groupRegMatch;.... this.element = element;.... this.groupLength = this.element.getAttribute("data-grouplength") \|\| 3;.. groupRegMatch = this._buildRegexArr(this.groupLength);.... this.groupRegNonUniform = groupRegMatch.length > 1;.. this.groupReg = new RegExp(groupRegMatch.join(''), !this.groupRegNonUniform ? 'g' : '');.. };.... Politespace.prototype._buildRegexArr = function (gro

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1838)
Category:	downloaded
Size (bytes):	6144
Entropy (8bit):	5.506936786468304
Encrypted:	false
SSDEEP:
MD5:	08831872D11F324837CEDB8793F6B9EE
SHA1:	0B8134BE45400C81F8229A8FB0353EE44529AC59
SHA-256:	6042AC3315B850ACD5A8B56D06724DD5C18722939C3B26C0D7515E43DA94FDD4
SHA-512:	4DDB7049DF42249E24183AA0F136ACF153F7932137D59B5C21A561652A11998A4970F42B2D2E86A7A0FD94359228A53DB179F317DBBEB54139A6E79D3F4195E0
Malicious:	false
Reputation:	unknown
URL:	https://se.monetate.net/js/2/a-815a421c/p/omnicare.com/entry.js
Preview:	// Copyright 2008-2017 Monetate, Inc..// 2017-01-18T14:14:03Z t1484745711 entry_base.js.(function(){var g=!0,h=null,i=this;function j(b){for(var b=b.split("."),a=i,c;b.length&&(c=b.shift());)if(a[c]!=h)a=a[c];else return h;return a}function k(b,a){var c=b.split("."),d=i;!(c[0]in d)&&d.execScript&&d.execScript("var "+c[0]);for(var e;c.length&&(e=c.shift());)!c.length&&void 0!==a?d[e]=a:d=d[e]?d[e]:d[e]={}};var l=[];function m(b,a){var c=n(b,a);k("monetate."+b,c);return c}function n(b,a){var c=j("monetate."+b)\|\|a;"undefined"==typeof c&&(c={});return c};var o="0",q="myomniview.omnicare.com",r="!!!",s="myomniview.omnicare.com!!!omnicare.com".split(r),o=o+"",q=q+"",r=r+"";var t={"~":g,"!":g,"":g,"(":g,")":g,"-":g,_:g,".":g,",":g,":":g,"@":g,$:g,"'":g,"/":g};function u(b){if(/^[A-Za-z0-9_\-]$/.test(b))return b;b=b.replace(/([^A-Za-z0-9_\-])/g,function(a,b){return t[b]?b:encodeURIComponent(b)});return b.replace(/%20/g,"+")};function v(b){for(var a=(document.cookie\|\|"").split(/\s;\s/),c=0,

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (27508)
Category:	downloaded
Size (bytes):	27646
Entropy (8bit):	5.094039476118332
Encrypted:	false
SSDEEP:
MD5:	FC522F4A3907F86584A1D7FD5EAC84B7
SHA1:	5A238F1F944515DBD4B6051B89D1717D38065551
SHA-256:	15903F67C7D3656CB593E5FE3637EF1EAA55616EC869468CFE0AB4DF3A3F425B
SHA-512:	3C0D8D0A5285BFD6C5B4537B0E470E3207986C5F11D8F24881A4D2A201FB73C976C19F3FA570B5869E176BFFB86C0A631A661E068CABFEEE8599B8475CA4C58E
Malicious:	false
Reputation:	unknown
URL:	https://myomniview.omnicare.com/Scripts/jQueryValidate/jquery.validate.min.js
Preview:	/! jQuery Validation Plugin - v1.19.5 - 7/1/2022. https://jqueryvalidation.org/. * Copyright (c) 2022 J.rn Zaefferer; Licensed MIT */.!function (a) { "function" == typeof define && define.amd ? define(["jquery"], a) : "object" == typeof module && module.exports ? module.exports = a(require("jquery")) : a(jQuery) }(function (a) { a.extend(a.fn, { validate: function (b) { if (!this.length) return void (b && b.debug && window.console && console.warn("Nothing selected, can't validate, returning nothing.")); var c = a.data(this[0], "validator"); return c ? c : (this.attr("novalidate", "novalidate"), c = new a.validator(b, this[0]), a.data(this[0], "validator", c), c.settings.onsubmit && (this.on("click.validate", ":submit", function (b) { c.submitButton = b.currentTarget, a(this).hasClass("cancel") && (c.cancelSubmit = !0), void 0 !== a(this).attr("formnovalidate") && (c.cancelSubmit = !0) }), this.on("submit.validate", function (b) { function d() { var d, e; return c.submitButton && (c

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6056), with CRLF line terminators
Category:	downloaded
Size (bytes):	7005
Entropy (8bit):	5.035699294972107
Encrypted:	false
SSDEEP:
MD5:	13FD85F33E87DDC8D2D378F9E22B98B8
SHA1:	B788FA34BA4CF0061F902F67A88E632822C10D8D
SHA-256:	712427866F7F031D95C66E52E7583EF57AD9C1AE5CC92736C7B7246CB87B1F81
SHA-512:	979FA9103FDA51C80B237080D6A53381E0F4BD04E9BA68A6B27F2BE0C9A0F526B2B5D8468031526E1AF5B75AD88656575A156C13749598EEE7EC22F4CAF5C429
Malicious:	false
Reputation:	unknown
URL:	https://myomniview.omnicare.com/Scripts/jQueryValidate/jquery.validate.unobtrusive.min.js
Preview:	/* NUGET: BEGIN LICENSE TEXT.. .. Microsoft grants you the right to use these script files for the sole.. * purpose of either: (i) interacting through your browser with the Microsoft.. * website or online service, subject to the applicable licensing or use.. * terms; or (ii) using the files as included with a Microsoft product subject.. * to that product's license terms. Microsoft reserves all other rights to the.. * files not expressly granted by Microsoft, whether by implication, estoppel.. * or otherwise. Insofar as a script file is dual licensed under GPL,.. * Microsoft neither took the code under GPL nor distributes it thereunder but.. * under the terms set out in this paragraph. All notices and licenses.. * below are for informational purposes only... .. NUGET: END LICENSE TEXT /../.. Unobtrusive validation support library for jQuery and jQuery Validate.. Copyright (C) Microsoft Corporation. All rights reserved...*/..(function (a) { var d = a.validator, b, e = "unobtr

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1420
Entropy (8bit):	6.917223502961527
Encrypted:	false
SSDEEP:
MD5:	2F8F6798AA474DD325B24E6681ECCAE7
SHA1:	85B8B60A1B4E552C36383FF9D08141BF2593F8D8
SHA-256:	6CB230657AEEA919E13049E8C1919F7F2D83CBEA834CBF5ED3EE2F7CC2EDF0E1
SHA-512:	4B8BBAA203436D7928190894824C3F95DCAC0F8111E5FF31D86A41B589C2723A0BF22C3732D64CA933DF4CF7A945EC2BEC09A5EEB2E303D1B9B1791DD63A7BA3
Malicious:	false
Reputation:	unknown
URL:	https://myomniview.omnicare.com/Images/favicon.ico
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:F1FD68FCF96B11E8B084DFA223C29216" xmpMM:DocumentID="xmp.did:F1FD68FDF96B11E8B084DFA223C29216"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F1FD68FAF96B11E8B084DFA223C29216" stRef:documentID="xmp.did:F1FD68FBF96B11E8B084DFA223C29216"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.Q?....IDATx...+Dq......6.....Dy7^..)Y..bgK&IYH6.PC.A.XX0&I...x...3..S..t....w....4........{~..".H....d.Y.@..f..

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6008)
Category:	downloaded
Size (bytes):	55809
Entropy (8bit):	5.477121901102866
Encrypted:	false
SSDEEP:
MD5:	4D7EB1C5F9F66BAB8FEA7141762E06C0
SHA1:	73299AC99BF752BABAD313723FFCF23074891C06
SHA-256:	AC66EFD45E24FF34F43C5CF96A4E2857D849525011A107B60F64BE7788EB0E15
SHA-512:	3BED4FFD17361979F739BFCBCFB9A187F788BCE40E925D07339EF031349CF3DCF3AADF117DC03DCBB7107A04B1686B06B441E9C5957D88F72E1333306AC1DC47
Malicious:	false
Reputation:	unknown
URL:	https://tags.tiqcdn.com/utag/cvs/myomniview/prod/utag.3.js?utv=ut4.42.202206141346
Preview:	//tealium universal tag - utag.3 ut4.0.202206141346, Copyright 2022 Tealium.com Inc. All Rights Reserved..var s=s_gi("cvshealthmyomniviewprod").s.account="cvshealthmyomniviewprod";s.trackDownloadLinks=false;s.trackExternalLinks=false;s.trackInlineStats=true;s.linkInternalFilters="javascript:,cvscaremark.com,omnicare.com";s.linkLeaveQueryString=false;s.linkTrackVars="";s.linkTrackEvents="";s.usePlugins=true;s.currencyCode="USD";s.visitorNamespace="cvshealth";s.trackingServer="metrics.cvshealth.com";s.trackingServerSecure="";s.charSet="UTF-8";s.expectSupplementalData=true;s.debugTracking=utag.cfg.utagdb;function AppMeasurement(r){var a=this;a.version="2.12.0";var k=window;k.s_c_in\|\|(k.s_c_il=[],k.s_c_in=0);a._il=k.s_c_il;a._in=k.s_c_in;a._il[a._in]=a;k.s_c_in++;a._c="s_c";var q=k.AppMeasurement.ac;q\|\|(q=null);var p=k,m,s;try{for(m=p.parent,s=p.location;m&&m.location&&s&&""+m.location!=""+s&&p.location&&""+m.location!=""+p.location&&m.location.host==s.host;)p=m,m=p.parent}catch(u){}a.D=fu

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (317)
Category:	downloaded
Size (bytes):	193038
Entropy (8bit):	4.89258540085952
Encrypted:	false
SSDEEP:
MD5:	D3F12DA78EB4A2964B1336A633A98DAF
SHA1:	2575AF69FBE2921E47B0B870720CE91332BD8792
SHA-256:	6756CC0BFEB7E3D0F1D128EBB3C754FC3C5648B39566E35C6691F5C6A396C133
SHA-512:	E42EF6594464DC8E4B43D95DF5EE84AB6722594B9531D14A57B64166E9CF3769467C130504CA4E0D5F46D07A9EC71059CBA56F43C576A83F3B41E2E54E47C772
Malicious:	false
Reputation:	unknown
URL:	https://myomniview.omnicare.com/UX/css/style.css
Preview:	/*. ,, ,, ,,. .M"""bgd mm db `7MM mm mm `7MM OO OO OO.,MI "Y MM MM MM MM MM 88 88 88.`MMb. mmMMmm ,pW"Wq.`7MMpdMAo. `7Mb,od8 `7MM .P"Ybmmm MMpMMMb.mmMMmm mmMMmm MMpMMMb. .gP"Ya `7Mb,od8 .gP"Ya \|\| \|\| \|\|. `YMMNq. MM 6W' `Wb MM `Wb MM' "' MM :MI I8 MM MM MM MM MM MM ,M' Yb MM' "',M' Yb \|\| \|\| \|\|.. `MM MM 8M M8 MM M8 MM MM WmmmP" MM MM MM MM MM MM 8M"""""" MM 8M"""""" `' `' `'.Mb dM MM YA. ,A9 MM ,AP MM MM 8M MM MM MM MM MM MM YM. , MM YM. , ,, ,, ,,.P"Ybmmd" `Mbmo`Ybmd9' MMbmmd' .JMML. .JMML.YMMMMMb .JMML JMML.`Mbmo

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	14399
Entropy (8bit):	4.625260899936668
Encrypted:	false
SSDEEP:
MD5:	E052C32F57E837E9B8EFEEDD246216FF
SHA1:	29EF35EA2D102FF5CA5867DDD522D5BD61DB102F
SHA-256:	69318343A46C1847976E96DF2A05921BCD7BE159FEEC447B1611BF654E274A7B
SHA-512:	C16FFD4A041AD84041E93EDDC9800F803B8E4506F919328878379F59F9821C0F536D73F0AEF814C26321EC6CEC10F7DA17CAC93F1A69CFC344F8B634559A18D0
Malicious:	false
Reputation:	unknown
URL:	https://myomniview.omnicare.com/UX/scripts/modal.js
Preview:	/* global NodeList, Element, define /..../ Usage ....dialog.on('show', function (dialogEl, triggerEl) {.. ... do something..});....To manually control the dialog:..dialog.show()..dialog.hide()..dialog.destroy()....$("[data-a11y-dialog-show]").each(function (index, elem) {.. new window.A11yDialog(document.getElementById($(elem).data("a11y-dialog-show")), null);..});....or....var dialog = new window.A11yDialog(document.getElementById("...."), null);..../....(function (global) {.. 'use strict';.... var FOCUSABLE_ELEMENTS = ['a[href]', 'area[href]', 'input:not([disabled])', 'select:not([disabled])', 'textarea:not([disabled])', 'button:not([disabled])', 'iframe', 'object', 'embed', '[contenteditable]', '[tabindex]:not([tabindex^="-"])'];.. var TAB_KEY = 9;.. var ESCAPE_KEY = 27;.. var focusedBeforeDialog;.... /*.. Define the constructor to instantiate a dialog.. .. @constructor.. * @param {Element} node.. * @param {(NodeList \| Element \|

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2138
Entropy (8bit):	4.596952624250667
Encrypted:	false
SSDEEP:
MD5:	CEF2D89ACDE693DAE37201D257EEE394
SHA1:	D8B9AC5DA847029AB91FD9B9ED34CC74B38D28BC
SHA-256:	81FA85B353DD5ECFC2103DCB36ABFCDC0C797951AAD4BC5AF747690A31A9F0AF
SHA-512:	1770808FFB5AAD9B59BF2D36E5B1B7335371F139BACDE9CABFD476527D71844919671804C4A4E20677CA94CFCC4B075BB3E1480BD6A125C528B15A4EF9573680
Malicious:	false
Reputation:	unknown
URL:	https://myomniview.omnicare.com/UX/scripts/accordion.js
Preview:	/. Accordion. */..$(function () {.. function OV__accordion() {.. // Hide content containers by default.. var accordion = $('accordion-component'),. accordionPanels = $('accordion-component > div.item-content'). firstAccordionTitle = $('accordion-component a.item-title:first'),. firstAccordionContent = $('accordion-component div.item-content:first');.. // Make first item active by default.. firstAccordionTitle.addClass('active');. firstAccordionContent.slideDown('fast').addClass('active');.. // Show or hide content container based on title clicks.. var titleLink = $('div.accordion > a.item-title');.. $(titleLink).unbind('click');.. $(titleLink).click(function (e) {.. $this = $(this);. $target = $this.siblings('div.item-content');. $this.siblings('.item-title').removeClass('active');. $this.addClass('active');.. if (!$target.hasClass('ac

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65446), with CRLF line terminators
Category:	downloaded
Size (bytes):	105215
Entropy (8bit):	4.965381230554915
Encrypted:	false
SSDEEP:
MD5:	0CA370E63FD5E30321D97A4D0A391B72
SHA1:	BA98EE81169334E9FDE02330CE4D6D022459E272
SHA-256:	62E310886359DDDF8BDFC29AF3CC50C6EF49DA8E89A7FF98ADE68800CE638FF1
SHA-512:	74515783BBC4C0130B94F3A3DA1916F9028C60AF6D5470DAECF2533C3EA1BBBE0A454BA14BE1E0B73A9E25E107BA5AE41F5DCFE3CDA96379A1A43B68CCC23C95
Malicious:	false
Reputation:	unknown
URL:	https://myomniview.omnicare.com/UX/scripts/jQuery/jquery.min.js
Preview:	/! jQuery v3.7.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /..!function (e, t) { "use strict"; "object" == typeof module && "object" == typeof module.exports ? module.exports = e.document ? t(e, !0) : function (e) { if (!e.document) throw new Error("jQuery requires a window with a document"); return t(e) } : t(e) }("undefined" != typeof window ? window : this, function (ie, e) { "use strict"; var oe = [], r = Object.getPrototypeOf, ae = oe.slice, g = oe.flat ? function (e) { return oe.flat.call(e) } : function (e) { return oe.concat.apply([], e) }, s = oe.push, se = oe.indexOf, n = {}, i = n.toString, ue = n.hasOwnProperty, o = ue.toString, a = o.call(Object), le = {}, v = function (e) { return "function" == typeof e && "number" != typeof e.nodeType && "function" != typeof e.item }, y = function (e) { return null != e && e === e.window }, C = ie.document, u = { type: !0, src: !0, nonce: !0, noModule: !0 }; function m(e, t, n) { var r, i, o = (n = n \|\| C).cre

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1566
Entropy (8bit):	4.790114254160758
Encrypted:	false
SSDEEP:
MD5:	ED58649F598093A0D839B014402D9605
SHA1:	906D26E12BFDCA368D159B9E8D3C24A467F31C19
SHA-256:	4620DA53543562C482FE7DD2A86667198BACE3C4E6EE434849E69EFA167EBC63
SHA-512:	9F14488C645E434F10F338009158BFE3CC7C75E193169482D26190BEF710412334C3B1F791713EAE03122D69700AA1C307A6BE93F73A3B424AA1A9CC8615C8B3
Malicious:	false
Reputation:	unknown
URL:	https://myomniview.omnicare.com/UX/css/style.custom.css
Preview:	.../Styles for System down notification for login page --start/...notification-block {.. zoom: 1;.. background: #e58d25;.. padding: 1em 1em 0;.. margin: 0 auto 0.5em;.. text-align: center;..}.....notification-block:after, .notification-block:before {.. content: " ";.. display: table;..}.....notification-block .title {.. font-size: 1.5em;.. margin: 0 0 .5em;.. text-transform: uppercase;.. color: #333;..}.....notification-block .text {.. margin: 0 0 1em;.. color: #333;..}../--ends here/..../* Styles from Omniview team for overlay/...overlay {.. / Height & width depends on how you want to reveal the overlay (see JS below) /.. height: 100%;.. width: 0;.. position: fixed;.. / Stay in place /.. z-index: 1000;.. / Sit on top /.. left: 0;.. top: 0;.. background-color: white;.. / Black fallback color /.. background-color: rgba(255, 255, 255, 0.9);.. / White w/ 90% opacity */.. overflow-x: hidden;..

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	39769
Entropy (8bit):	4.958386719748297
Encrypted:	false
SSDEEP:
MD5:	1333434AA49B4F44BADFE538F1E6E075
SHA1:	A8D60940F19EFC9307E4F1053F5501F81158D4EA
SHA-256:	76D9190749EB7C3AAB7EFACDB26A5FD2D87D415D6CC8ED9D2FD7DADE3E9B2353
SHA-512:	847631D24035E59EF65FD42BE0D2B807EB83327651B4D9C27167F1CD36F92B8400DE35FD80B834275FD15D393C9422DD9A7E99FA388116656EAA2C491F1F59C7
Malicious:	false
Reputation:	unknown
Preview:	.function getUtagData(webAnalyticParameters, webAnalyticAdditionalDetail, urlPath, currentPageUrl) {.. var pageError = getErrorPage(urlPath);.. var subSections = getSubSections(urlPath);.. var previousPageName = getPreviousPageName();.. var pageName = getPageName(urlPath);.. setPreviousPageCookie(subSections.section4, pageName, webAnalyticParameters.webAnalyticPageRefreshDetected);.. resetQuickRegisterCookie(urlPath);.... // Create base traffic object that is common among all pages.. var baseTrafficObject;.. baseTrafficObject = getBaseTraffic(urlPath, subSections, pageName, previousPageName, pageError, webAnalyticParameters, currentPageUrl);.... // Check For additional page specific base traffic to add in..... // If page begins with QuickReg. Three pages QuickRegister, QuickRegisterAccountNumber, QuickRegisterError.. if (webAnalyticAdditionalDetail && webAnalyticAdditionalDetail.source.substring(0, 8).indexOf("QuickReg") > -1) {.. baseTraff

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	22448
Entropy (8bit):	4.261234455437515
Encrypted:	false
SSDEEP:
MD5:	2ECDF7BDC8CBC2DFFDDC7F61DC3ADD5A
SHA1:	98FBB466E7E9DE88AF442609467C93FB3100A9FA
SHA-256:	AE54A3931EB230FCF7D9B192DFF8DE5B6A0C7D4CAC76AA32F58BEB842D5BEB17
SHA-512:	FC49E652B1F9141E31F87E9D014260D8B1E343833EFDA31E18B3F319BA0A84038DB457F28911EE839693AA321C7C29E7E2389F17B8CC864CAE46EA149769A399
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg width="150px" height="40px" viewBox="0 0 150 40" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. Generator: Sketch 45.2 (43514) - http://www.bohemiancoding.com/sketch -->. <title>Header / Logo SVG 150x40</title>. <desc>Created with Sketch.</desc>. <defs>. <polygon id="path-1" points="0 39.7495739 147.680709 39.7495739 147.680709 0 0 0"></polygon>. </defs>. <g id="Symbols" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g id="Header-/-Logo-SVG-150x40">. <g id="Page-1">. <path d="M10.8922114,17.1510578 C12.5777037,17.1510578 15.1652906,16.0375177 15.1652906,11.2532148 C15.1652906,6.46946399 12.5777037,5.35592384 10.8922114,5.35592384 C9.2072711,5.35592384 6.62023633,6.46946399 6.62023633,11.2532148 C6.62023633,16.0375177 9.2072711,17.1510578 10.8922114,17.1510578 Z M10.8922114,0.000220830966 C17.422183,0

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (10119)
Category:	downloaded
Size (bytes):	48440
Entropy (8bit):	5.47269739957528
Encrypted:	false
SSDEEP:
MD5:	AD873574A46C44B12CD52AB950A501F0
SHA1:	1899056FBEFDC83E6B302610153F48E1A488AC89
SHA-256:	3591A83DF3A0629382D87AEB802444E258E017F8DF7956CE2A063A9F60557EA9
SHA-512:	55B441FFDDC3259A73AD77CE1D5419B3A8629C9BEAC7175050687FCFABE26E1E7DA91978D253B1732D3AD4804FC204EF15F54DABF9AC5269932773ECE71D0B29
Malicious:	false
Reputation:	unknown
URL:	https://tags.tiqcdn.com/utag/cvs/myomniview/prod/utag.js
Preview:	//tealium universal tag - utag.loader ut4.0.202206141346, Copyright 2022 Tealium.com Inc. All Rights Reserved..if(typeof utag_err=='undefined')var utag_err=[];window._tealium_old_error=window._tealium_old_error\|\|window.onerror\|\|function(){};window.onerror=function(m,u,l){if(typeof u!=='undefined'&&u.indexOf('/utag.')>0&&utag_err.length<5)utag_err.push({e:m,s:u,l:l,t:'js'});window._tealium_old_error(m,u,l)};var utag_condload=false;window.__tealium_twc_switch=false;if(typeof utag=="undefined"&&!utag_condload){var utag={id:"cvs.myomniview",o:{},sender:{},send:{},rpt:{ts:{a:new Date()}},dbi:[],db_log:[],loader:{q:[],lc:0,f:{},p:0,ol:0,wq:[],lq:[],bq:{},bk:{},rf:0,ri:0,rp:0,rq:[],ready_q:[],sendq:{"pending":0},run_ready_q:function(){for(var i=0;i<utag.loader.ready_q.length;i++){utag.DB("READY_Q:"+i);try{utag.loader.ready_q[i]()}catch(e){utag.DB(e)};}},lh:function(a,b,c){a=""+location.hostname;b=a.split(".");c=(/\.co\.\|\.com\.\|\.org\.\|\.edu\.\|\.net\.\|\.asn\./.test(a))?3:2;return b.splice(b.l

Static File Info

General

File type:	Zip archive data, at least v4.5 to extract, compression method=deflate
Entropy (8bit):	7.999296994366902
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	Quarantined Messages (15).zip
File size:	263'750 bytes
MD5:	8d89059c7721fe1d5f8be57c644ee433
SHA1:	223dad869ea21d219747eb768cbc2b5e83560ec8
SHA256:	9baaecb8ade1197ee32e2ace07d2c43b323d143481a5fd237ca9edefde888163
SHA512:	2d31612764c10d25e9935c6e2fa70428d809455c4db4ba3d4d6e6b1f61c7dce1860495f5384b45c0e7cdf2691d654240e0e1b70c46561418724f1d80d3b32fc2
SSDEEP:	6144:kHqYjrTF3cfnZ8K4ORSxIAoYDBxW7XwWzZV/XUrpFAVfu:kKYjPFkZ54LxIwOzzZV/XUrpiVG
TLSH:	F044239E1B9434762628C37C371E9F84A5EB085088E78E72FBE6AA5570B45B103F147E
File Content Preview:	PK..-........X.-..........M...cbfd3c9f-d4f0-468b-2a4c-08dc65fad5fc/74ea26d1-39d0-8d32-e448-abf8b3cecd35.eml.....f................h.....e.:].d..=.........6.mm.........I...f~*.M..B.?h..[....V:..Y.e&.&cdzA...rA.^.^4..M........J[Z.8.~%=[......3L..Yx......Z.{3

File Icon


Icon Hash:	1c1c1e4e4ececedc

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Quarantined Messages (15).zip

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240426202247Z-173.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\884CA826-777F-463A-ABF5-B96E0ED847C5

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\42M0QSM7\Library Document Station (002).pdf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\42M0QSM7\Library Document Station (002).pdf:Zone.Identifier (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\42M0QSM7\Library Document Station.pdf:Zone.Identifier

Windows Analysis Report
Quarantined Messages (15).zip