Emails dating more than three years prior to malware execution have been included in the collected EmailStorage folder, meaning that there may not be a date limit for the email enumerator. Kroll has identified instances where specific email messages were deleted within the EmailStorage folder. In some instances, the entire EmailStorage folder is deleted once messages have all been exfiltrated. Based on observed cases, there was no evidence that attachments were included in the collected data. Kroll collaborators at the National Cyber Forensics Training Alliance (NCFTA) observed Qakbot samples sending SMTP traffic indicative of outbound spam thread hijackings