Edit tour

Windows Analysis Report
Visions Awards CustomerVendor Form.pdf

Overview

General Information

Sample name:	Visions Awards CustomerVendor Form.pdf
Analysis ID:	1636559
MD5:	d5d0dbc5a33994ec5028352ef66d82aa
SHA1:	f9b794cb9ead1fff5481299defc0fe85d1f1b8e4
SHA256:	7ce894322fd6f20cff578bfd29aab9038b0ba93aee388d29ee2f89c60b536229
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish54

AI detected suspicious Javascript

AI detected suspicious URL

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 6300 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Visions Awards CustomerVendor Form.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2072 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 740 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2244 --field-trial-handle=1552,i,2955086342793475940,7624475371599299111,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 5916 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://micros365.multitech.net.pk/muatro-redirect.php MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 512 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1840,i,14883656509648783644,15180515899642172921,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
4.88..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Source: https://login.office365-formsubmit.click/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=01ff36a9-118d-1256-2170-f97d73c45f79&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638674904025952032.42b185d8-e825-4e84-bdb2-3e505ea1e04a&state=DcuxDoIwEIDhou_iVjmOHrQDcdAYBlzURMPWozdIJBggGN_eDt-__YlSahttogRiVFnktiiNAwNIjhBy3BvkzFKwWiySNmKN5sCocyEg8ZmA8Ul8T-n49elhXvwiVbabJLwm6Zb7WPn6Cl19KZqfW8PzOjO6qRnc0A7vvr1RzwgrP84fPto_&sso_reload=true

Joe Sandbox AI: Score: 9 Reasons: The brand 'M' is not directly associated with the URL, but the URL suggests a connection to Microsoft Office 365., The legitimate domain for Microsoft Office 365 is 'office.com'., The URL 'login.office365-formsubmit.click' contains suspicious elements such as the hyphen and unusual domain extension '.click'., The presence of 'formsubmit' in the URL is suspicious and not typical for legitimate Microsoft Office 365 login pages., The URL does not match the legitimate domain name for Microsoft Office 365, indicating a high likelihood of phishing. DOM: 4.8.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 4.88..script.csv, type: HTML
Source: Yara match	File source: 4.6.pages.csv, type: HTML
Source: Yara match	File source: 4.7.pages.csv, type: HTML
Source: Yara match	File source: 4.8.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.0..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://micros365.multitech.net.pk/muatro-redirect... The script attempts to redirect the user to a suspicious domain 'login.office365-formsubmit.click', which is likely a phishing attempt to steal user credentials. This behavior is considered high-risk and indicative of malicious intent.
Source: 1.1..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.office365-formsubmit.click/MhOJHMGZ... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated code/URLs. The script appears to be interacting with suspicious domains and engaging in activities inconsistent with its apparent purpose, indicating a high likelihood of malicious intent.
Source: 2.5..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: blob:https://login.office365-formsubmit.click/15c9... This script demonstrates high-risk behavior by using the `eval()` function to execute dynamic code received from an untrusted source. The use of `eval()` allows for the execution of arbitrary JavaScript, which poses a significant security risk. Additionally, the lack of origin verification and the absence of a message source indicate that this script is vulnerable to cross-origin attacks and could be used to execute malicious code on the client-side.
Source: 2.44.d.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. It appears to be a malicious script that collects user information and potentially redirects to a suspicious domain. The combination of these behaviors indicates a high risk of malicious intent.
Source: 4.88..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.office365-formsubmit.click/common/oa... This script exhibits several high-risk behaviors that indicate potential malicious intent:1. Dynamic Code Execution: The script uses the `$Config` object, which could be used to execute remote or dynamic code.2. Data Exfiltration: The script contains URLs that appear to be sending user data to external domains, such as `outlook.office365-formsubmit.click` and `live.office365-formsubmit.click`.3. Obfuscated Code/URLs: The script contains a large amount of obfuscated or encoded data, making it difficult to analyze the full extent of its functionality.Additionally, the script interacts with domains that are not known to be trusted, which further increases the risk. Overall, the combination of these high-risk behaviors and the use of suspicious domains suggests that this script is likely malicious and should be treated with caution.

AI detected suspicious URL

Source: https://login.office365-formsubmit.click

Joe Sandbox AI: The URL 'https://login.office365-formsubmit.click' appears to target users of Microsoft Office 365, a well-known brand. The legitimate URL for Office 365 login is 'https://login.microsoftonline.com'. The analyzed URL uses 'office365' in the subdomain, which is a direct reference to the brand. The domain 'formsubmit.click' is not associated with Microsoft and could be misleading, as it suggests a form submission process, potentially tricking users into entering credentials. The use of 'login' in the subdomain further increases the likelihood of user confusion, as it mimics the structure of legitimate login URLs. The '.click' TLD is not typical for Microsoft services, adding to the suspicion of typosquatting. Overall, the URL's structure and choice of words suggest a high likelihood of being a typosquatting attempt.

HTTP Parser: Number of links: 0

Source: https://login.office365-formsubmit.click/MhOJHMGZ#

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....

HTTP Parser: Title: Sign in to Outlook does not match URL

Source: https://login.office365-formsubmit.click/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=01ff36a9-118d-1256-2170-f97d73c45f79&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638674904025952032.42b185d8-e825-4e84-bdb2-3e505ea1e04a&state=DcuxDoIwEIDhou_iVjmOHrQDcdAYBlzURMPWozdIJBggGN_eDt-__YlSahttogRiVFnktiiNAwNIjhBy3BvkzFKwWiySNmKN5sCocyEg8ZmA8Ul8T-n49elhXvwiVbabJLwm6Zb7WPn6Cl19KZqfW8PzOjO6qRnc0A7vvr1RzwgrP84fPto_&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365-formsubmit.click/owa/prefetch.aspx
Source: https://login.office365-formsubmit.click/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=01ff36a9-118d-1256-2170-f97d73c45f79&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638674904025952032.42b185d8-e825-4e84-bdb2-3e505ea1e04a&state=DcuxDoIwEIDhou_iVjmOHrQDcdAYBlzURMPWozdIJBggGN_eDt-__YlSahttogRiVFnktiiNAwNIjhBy3BvkzFKwWiySNmKN5sCocyEg8ZmA8Ul8T-n49elhXvwiVbabJLwm6Zb7WPn6Cl19KZqfW8PzOjO6qRnc0A7vvr1RzwgrP84fPto_&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365-formsubmit.click/owa/prefetch.aspx

HTTP Parser: <input type="password" .../> found

Source: https://login.office365-formsubmit.click/MhOJHMGZ#	HTTP Parser: No favicon
Source: https://login.office365-formsubmit.click/MhOJHMGZ#	HTTP Parser: No favicon
Source: https://login.office365-formsubmit.click/MhOJHMGZ#	HTTP Parser: No favicon

Source: https://login.office365-formsubmit.click/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=01ff36a9-118d-1256-2170-f97d73c45f79&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638674904025952032.42b185d8-e825-4e84-bdb2-3e505ea1e04a&state=DcuxDoIwEIDhou_iVjmOHrQDcdAYBlzURMPWozdIJBggGN_eDt-__YlSahttogRiVFnktiiNAwNIjhBy3BvkzFKwWiySNmKN5sCocyEg8ZmA8Ul8T-n49elhXvwiVbabJLwm6Zb7WPn6Cl19KZqfW8PzOjO6qRnc0A7vvr1RzwgrP84fPto_&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.office365-formsubmit.click/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=01ff36a9-118d-1256-2170-f97d73c45f79&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638674904025952032.42b185d8-e825-4e84-bdb2-3e505ea1e04a&state=DcuxDoIwEIDhou_iVjmOHrQDcdAYBlzURMPWozdIJBggGN_eDt-__YlSahttogRiVFnktiiNAwNIjhBy3BvkzFKwWiySNmKN5sCocyEg8ZmA8Ul8T-n49elhXvwiVbabJLwm6Zb7WPn6Cl19KZqfW8PzOjO6qRnc0A7vvr1RzwgrP84fPto_&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.office365-formsubmit.click/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=01ff36a9-118d-1256-2170-f97d73c45f79&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638674904025952032.42b185d8-e825-4e84-bdb2-3e505ea1e04a&state=DcuxDoIwEIDhou_iVjmOHrQDcdAYBlzURMPWozdIJBggGN_eDt-__YlSahttogRiVFnktiiNAwNIjhBy3BvkzFKwWiySNmKN5sCocyEg8ZmA8Ul8T-n49elhXvwiVbabJLwm6Zb7WPn6Cl19KZqfW8PzOjO6qRnc0A7vvr1RzwgrP84fPto_&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.office365-formsubmit.click/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=01ff36a9-118d-1256-2170-f97d73c45f79&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638674904025952032.42b185d8-e825-4e84-bdb2-3e505ea1e04a&state=DcuxDoIwEIDhou_iVjmOHrQDcdAYBlzURMPWozdIJBggGN_eDt-__YlSahttogRiVFnktiiNAwNIjhBy3BvkzFKwWiySNmKN5sCocyEg8ZmA8Ul8T-n49elhXvwiVbabJLwm6Zb7WPn6Cl19KZqfW8PzOjO6qRnc0A7vvr1RzwgrP84fPto_&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.office365-formsubmit.click/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=01ff36a9-118d-1256-2170-f97d73c45f79&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638674904025952032.42b185d8-e825-4e84-bdb2-3e505ea1e04a&state=DcuxDoIwEIDhou_iVjmOHrQDcdAYBlzURMPWozdIJBggGN_eDt-__YlSahttogRiVFnktiiNAwNIjhBy3BvkzFKwWiySNmKN5sCocyEg8ZmA8Ul8T-n49elhXvwiVbabJLwm6Zb7WPn6Cl19KZqfW8PzOjO6qRnc0A7vvr1RzwgrP84fPto_&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.office365-formsubmit.click/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=01ff36a9-118d-1256-2170-f97d73c45f79&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638674904025952032.42b185d8-e825-4e84-bdb2-3e505ea1e04a&state=DcuxDoIwEIDhou_iVjmOHrQDcdAYBlzURMPWozdIJBggGN_eDt-__YlSahttogRiVFnktiiNAwNIjhBy3BvkzFKwWiySNmKN5sCocyEg8ZmA8Ul8T-n49elhXvwiVbabJLwm6Zb7WPn6Cl19KZqfW8PzOjO6qRnc0A7vvr1RzwgrP84fPto_&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Source: global traffic	TCP traffic: 192.168.2.18:49822 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:49822 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:49822 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:49822 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:49822 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:49822 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 91.204.209.17
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.206.67
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 216.58.206.67
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /muatro-redirect.php HTTP/1.1Host: micros365.multitech.net.pkConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f3b948d8acb8/api.js?onload=EFpGI0&render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveOrigin: https://login.office365-formsubmit.clicksec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/4g64h/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=91f640d04b5f4d9a&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/4g64h/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/4g64h/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1691504427:1741812451:Ufvss0fngcd6MtEWPbZqeh6UFhlsGDbpvvXaxfwa35M/91f640d04b5f4d9a/9rVLDu.ex0d0LXkSzBiIctr7TXE4KAux36qoef8CYXM-1741813562-1.1.1.1-7hKfO7qWhr52NsWJgRXG_p1ihlFPP67GeIHd1wIlZBvoPkXvRD6.VFAo36rQHniN HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/91f640d04b5f4d9a/1741813568080/5e4d007304d502aff3e858f63bfffe36e3b72dd98ae86e18f8b04522c18ac9d5/WhL7OnYnzF8iQJY HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/4g64h/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/d/91f640d04b5f4d9a/1741813568084/ltd4-5XVZ3zO-zM HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/4g64h/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/d/91f640d04b5f4d9a/1741813568084/ltd4-5XVZ3zO-zM HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1691504427:1741812451:Ufvss0fngcd6MtEWPbZqeh6UFhlsGDbpvvXaxfwa35M/91f640d04b5f4d9a/9rVLDu.ex0d0LXkSzBiIctr7TXE4KAux36qoef8CYXM-1741813562-1.1.1.1-7hKfO7qWhr52NsWJgRXG_p1ihlFPP67GeIHd1wIlZBvoPkXvRD6.VFAo36rQHniN HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1691504427:1741812451:Ufvss0fngcd6MtEWPbZqeh6UFhlsGDbpvvXaxfwa35M/91f640d04b5f4d9a/9rVLDu.ex0d0LXkSzBiIctr7TXE4KAux36qoef8CYXM-1741813562-1.1.1.1-7hKfO7qWhr52NsWJgRXG_p1ihlFPP67GeIHd1wIlZBvoPkXvRD6.VFAo36rQHniN HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: login.office365-formsubmit.click
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: live.office365-formsubmit.click
Source: global traffic	DNS traffic detected: DNS query: outlook.office365-formsubmit.click

Source: unknown

HTTP traffic detected: POST /report/v4?s=U9gGjFs7aEAG26zpivX7DD9JV1ZB7I2b30eIVw2%2B2%2Bm%2BSHDzNbPxV0V7MudILqcXpQmj65%2BfhepiWYBZig%2FyeTJfd6D7YhP5BnEMl0jxUnM%2BDqBCBDFsXAqzgGabpF16F566N7Qd2Gm56dP5s98ccqNNuQ%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 438Content-Type: application/reports+jsonOrigin: https://login.office365-formsubmit.clickUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir5916_493133102

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir5916_493133102

Source: classification engine

Classification label: mal64.phis.winPDF@45/57@30/153

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6180

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91kw6p8a_1308qsi_4ro.tmp

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Visions Awards CustomerVendor Form.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2244 --field-trial-handle=1552,i,2955086342793475940,7624475371599299111,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2244 --field-trial-handle=1552,i,2955086342793475940,7624475371599299111,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://micros365.multitech.net.pk/muatro-redirect.php
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1840,i,14883656509648783644,15180515899642172921,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://micros365.multitech.net.pk/muatro-redirect.php
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1840,i,14883656509648783644,15180515899642172921,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Visions Awards CustomerVendor Form.pdf	Initial sample: PDF keyword /JS count = 0
Source: Visions Awards CustomerVendor Form.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Visions Awards CustomerVendor Form.pdf

Initial sample: PDF keyword stream count = 27

Source: Visions Awards CustomerVendor Form.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
Visions Awards CustomerVendor Form.pdf	3%	ReversingLabs	Document-PDF.Trojan.Heuristic

Source	Detection	Scanner	Label
https://micros365.multitech.net.pk/muatro-redirect.php	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/91f640d04b5f4d9a/1741813568084/ltd4-5XVZ3zO-zM	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/91f640d04b5f4d9a/1741813568080/5e4d007304d502aff3e858f63bfffe36e3b72dd98ae86e18f8b04522c18ac9d5/WhL7OnYnzF8iQJY	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=91f640d04b5f4d9a&lang=auto	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/4g64h/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1691504427:1741812451:Ufvss0fngcd6MtEWPbZqeh6UFhlsGDbpvvXaxfwa35M/91f640d04b5f4d9a/9rVLDu.ex0d0LXkSzBiIctr7TXE4KAux36qoef8CYXM-1741813562-1.1.1.1-7hKfO7qWhr52NsWJgRXG_p1ihlFPP67GeIHd1wIlZBvoPkXvRD6.VFAo36rQHniN	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=scnUPw46iIwBZ%2F58%2FVH5q5kxzgcFf0KOXqf0MPjY7UtI1%2FLsqLBQPrNaqI2cKxU41pv45CCLh0pFdIICCEr%2B%2BHTmB%2BxB9pI8OY4pFm4vw6pQIeNoj%2BG%2FtxEolxSGNdY1AXMR1F5x2ghNbtkDzy4NfChD	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=pZBG0U%2BnjRgJPQb7GqTKTtWyT8idyIdb9vjAFDGnlGI%2BYgkumHpJHbMRsQ%2B2l6K2M8hTvfDwv3zYrsrHzrNqI4WizZBr1yUTBbNLe0lK9mKshKBmQLR2gDnF5ljwMaXLNFkU1NHK358M9r9kEgjGif9mVg%3D%3D	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=llZXLCNpckTmUXy%2FGTVopWmD2I8lXnHTYF6MXTQG%2FwrJ8uMhmvE61cvoQHACGfLOtCAkQvk%2BDz4BVvlauF3hhYsn89yXhXetzDQkPjabfWNPRETOUI2c8yRmas%2F%2BVF52t47iGl0tlN93z%2FDVCk8dMg8RYQ%3D%3D	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
e329293.dscd.akamaiedge.net	95.101.182.65	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
live.office365-formsubmit.click	104.21.64.1	true	true	unknown
www.google.com	216.58.206.36	true	false	high
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	high
login.office365-formsubmit.click	104.21.80.1	true	true	unknown
aadcdn.msftauth.net	unknown	unknown	false	high
outlook.office365-formsubmit.click	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://micros365.multitech.net.pk/muatro-redirect.php	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/4g64h/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/	false	Avira URL Cloud: safe	unknown
https://login.office365-formsubmit.click/MhOJHMGZ#	true		unknown
https://a.nel.cloudflare.com/report/v4?s=pZBG0U%2BnjRgJPQb7GqTKTtWyT8idyIdb9vjAFDGnlGI%2BYgkumHpJHbMRsQ%2B2l6K2M8hTvfDwv3zYrsrHzrNqI4WizZBr1yUTBbNLe0lK9mKshKBmQLR2gDnF5ljwMaXLNFkU1NHK358M9r9kEgjGif9mVg%3D%3D	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1691504427:1741812451:Ufvss0fngcd6MtEWPbZqeh6UFhlsGDbpvvXaxfwa35M/91f640d04b5f4d9a/9rVLDu.ex0d0LXkSzBiIctr7TXE4KAux36qoef8CYXM-1741813562-1.1.1.1-7hKfO7qWhr52NsWJgRXG_p1ihlFPP67GeIHd1wIlZBvoPkXvRD6.VFAo36rQHniN	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=91f640d04b5f4d9a&lang=auto	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/91f640d04b5f4d9a/1741813568084/ltd4-5XVZ3zO-zM	false	Avira URL Cloud: safe	unknown
https://login.office365-formsubmit.click/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=01ff36a9-118d-1256-2170-f97d73c45f79&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638674904025952032.42b185d8-e825-4e84-bdb2-3e505ea1e04a&state=DcuxDoIwEIDhou_iVjmOHrQDcdAYBlzURMPWozdIJBggGN_eDt-__YlSahttogRiVFnktiiNAwNIjhBy3BvkzFKwWiySNmKN5sCocyEg8ZmA8Ul8T-n49elhXvwiVbabJLwm6Zb7WPn6Cl19KZqfW8PzOjO6qRnc0A7vvr1RzwgrP84fPto_&sso_reload=true	true		unknown
https://a.nel.cloudflare.com/report/v4?s=llZXLCNpckTmUXy%2FGTVopWmD2I8lXnHTYF6MXTQG%2FwrJ8uMhmvE61cvoQHACGfLOtCAkQvk%2BDz4BVvlauF3hhYsn89yXhXetzDQkPjabfWNPRETOUI2c8yRmas%2F%2BVF52t47iGl0tlN93z%2FDVCk8dMg8RYQ%3D%3D	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/91f640d04b5f4d9a/1741813568080/5e4d007304d502aff3e858f63bfffe36e3b72dd98ae86e18f8b04522c18ac9d5/WhL7OnYnzF8iQJY	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=scnUPw46iIwBZ%2F58%2FVH5q5kxzgcFf0KOXqf0MPjY7UtI1%2FLsqLBQPrNaqI2cKxU41pv45CCLh0pFdIICCEr%2B%2BHTmB%2BxB9pI8OY4pFm4vw6pQIeNoj%2BG%2FtxEolxSGNdY1AXMR1F5x2ghNbtkDzy4NfChD	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.99	unknown	United States	15169	GOOGLEUS	false
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
13.107.246.40	s-part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
216.58.212.131	unknown	United States	15169	GOOGLEUS	false
172.217.16.206	unknown	United States	15169	GOOGLEUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
184.31.48.185	unknown	United States	16625	AKAMAI-ASUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.80.1	login.office365-formsubmit.click	United States	13335	CLOUDFLARENETUS	true
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
23.43.60.134	unknown	United States	20940	AKAMAI-ASN1EU	false
91.204.209.17	unknown	United Kingdom	52148	RACKSRVGB	false
52.6.155.20	unknown	United States	14618	AMAZON-AESUS	false
64.233.184.84	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.184.234	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.18

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1636559
Start date and time:	2025-03-12 22:04:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Visions Awards CustomerVendor Form.pdf
Detection:	MAL
Classification:	mal64.phis.winPDF@45/57@30/153
Cookbook Comments:	Found application associated with file extension: .pdf

Warnings

Exclude process from analysis (whitelisted): SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.199.214.10
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: login.office365-formsubmit.click

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.240568666042594
Encrypted:	false
SSDEEP:
MD5:	7996B047D0A532AF57A11B37735BA345
SHA1:	7DBFA5AD6C4E6B15A87B40AFCD0437250C875399
SHA-256:	9B0C168242010CE88BF6C60B92831D447EA83EF6DD380095EDCA24FE632487C1
SHA-512:	88537AE489BAFAE852E9986B4A20457DB1F01B904387A1FA6DB415266B60C37CC8ABE24F77B08A6DA61DF7521F90357957435C1930B0B4232E4A423ACE87BB23
Malicious:	false
Reputation:	unknown
Preview:	2025/03/12-17:05:19.399 8d8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/12-17:05:19.401 8d8 Recovering log #3.2025/03/12-17:05:19.402 8d8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.202120721399065
Encrypted:	false
SSDEEP:
MD5:	958EFB798F1BECD3936281BD8BD2C5A1
SHA1:	61E927D7DAE770BEEC9B0B54D163E80CA80670C7
SHA-256:	2FEC7C359DE81C1D540F4657CC51F647238094A84BABDB8B6CF36A56AC971F29
SHA-512:	838D2289C83DDCBC6A887D5787175C6E478FF004A211C22404D03FED5246CF4A16363ECA14E822B03FB97AEFBB4A10FAE981C68F89D74FE4A9B1C4B9DAE4C62C
Malicious:	false
Reputation:	unknown
Preview:	2025/03/12-17:05:19.196 b68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/03/12-17:05:19.200 b68 Recovering log #3.2025/03/12-17:05:19.200 b68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0744d919-ad5f-40b2-bc00-a877207dc9dd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962954078537318
Encrypted:	false
SSDEEP:
MD5:	352B2155D41B3AD69569178CFFD42A1F
SHA1:	9D98260544F89BD7760B77B43E9074EDC7444F8E
SHA-256:	6C3F593DA1203FBB01A63F6927B8E655403C0019D45206FC45A2C32F6C7AFFBA
SHA-512:	0830639193C3D790BAC82EC780444E9D661D8B92E49AA99037FB1BAC0F8B21E53787CE73FE1908076BFF6FA6700F2E2D6CACC2B16CAAE49267A121157C165B6B
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13386373532677101","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133552},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.18","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	09F0E60FB76A6CF6E38D64BE72F6AC81
SHA1:	0D394EC464ABD8B7027B76758CD1CD1FF53FB9EA
SHA-256:	60D0C8954D3073832F58ECEBA95F6FF35C6244FA4F7147259129E2C8E7982AA8
SHA-512:	5D9827657C8568AEBB80A7472E58483A1DDD33DA6AC75A3C2788B88ABE96F30E7C7FAEDACB442692252441D3F1BC784176BA06EBB9DB2FFCB47C2736F835C24D
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341148831376991","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":148280},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.18","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6ab6c9.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	09F0E60FB76A6CF6E38D64BE72F6AC81
SHA1:	0D394EC464ABD8B7027B76758CD1CD1FF53FB9EA
SHA-256:	60D0C8954D3073832F58ECEBA95F6FF35C6244FA4F7147259129E2C8E7982AA8
SHA-512:	5D9827657C8568AEBB80A7472E58483A1DDD33DA6AC75A3C2788B88ABE96F30E7C7FAEDACB442692252441D3F1BC784176BA06EBB9DB2FFCB47C2736F835C24D
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341148831376991","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":148280},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.18","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eed097d7-0b8f-43ca-bb34-a12e3fdad578.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.957552463005916
Encrypted:	false
SSDEEP:
MD5:	09F0E60FB76A6CF6E38D64BE72F6AC81
SHA1:	0D394EC464ABD8B7027B76758CD1CD1FF53FB9EA
SHA-256:	60D0C8954D3073832F58ECEBA95F6FF35C6244FA4F7147259129E2C8E7982AA8
SHA-512:	5D9827657C8568AEBB80A7472E58483A1DDD33DA6AC75A3C2788B88ABE96F30E7C7FAEDACB442692252441D3F1BC784176BA06EBB9DB2FFCB47C2736F835C24D
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341148831376991","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":148280},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.18","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	7996
Entropy (8bit):	5.244741278049624
Encrypted:	false
SSDEEP:
MD5:	4DFF2E690C0C4CD7626861C73ED81FFE
SHA1:	CD92B07818C05630A5B0611C9C4092287D0BC19B
SHA-256:	675244737E4979119C68657A4D0A0B1B526187AFCA4AD115758998F291862060
SHA-512:	E37D1921C28A388643AB80730AE1B6DB64F8F2FB43A4934E5E19BB3B2761747E91D50A8BAD12424F73EA6C42488BBED27B11CE5BFB379E516DD976C1913FAA7C
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-...o................next-map-id.1.Pnamespace-5767294d_7b9a_47c6_b1e0_955ef27d1acf-https://rna-resource.acrobat.com/.0=..Nr................next-map-id.2.Snamespace-0be79751_1d4a_40c3_9b57_40751dcd8802-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-90f7539d_81d9_41c2_b2e3_1ee7ed96c7c7-https://rna-v2-resource.acrobat.com/.2S.<.o................next-map-id.4.Pnamespace-1700ec5e_d769_43b7_97b8_3e6ca674d396-https://rna-resource.acrobat.com/.3...^...............Pnamespace-5767294d_7b9a_47c6_b1e0_955ef27d1acf-https://rna-resource.acrobat.com/D..#^...............Pnamespace-1700ec5e_d769_43b7_97b8_3e6ca674d396-https://rna-resource.acrobat.com/....a...............Snamespace-0be79751_1d4a_40c3_9b57_40751dcd8802-https://rna-v2-resource.acrobat.com/B[_.a...............Snamespace-90f7539d_81d9_41c2_b2e3_1ee7ed96c7c7-https://rna-v2-resource.acrobat.com/.^..r................next-map-id.5.Snamespace-cc1e5959_9927_4cd0_b606_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.257952245537353
Encrypted:	false
SSDEEP:
MD5:	68DC80342043CD52F057D5B344F73056
SHA1:	C62D1611962E09F2D14F88EC8CBBACB41C739A63
SHA-256:	941A6EEBF546C4DE18A4968DB880963E2DC156DB4B966F14C8275B24469D57A9
SHA-512:	C6A604F2054CA34DA71221DEC6C6C515BFF07F58084A8EBF80A4186337843F072B3695010B8D4F696DE799B4FFA8FAF7F313922CCC0D729FA8B728830CF92445
Malicious:	false
Reputation:	unknown
Preview:	2025/03/12-17:05:19.433 b68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/03/12-17:05:19.435 b68 Recovering log #3.2025/03/12-17:05:19.439 b68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250312210521Z-292.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	0.5498389669737626
Encrypted:	false
SSDEEP:
MD5:	323FC96E06391674B5F9E9D470B6CCF9
SHA1:	144AAE14B241570639973EBFC5FDEC6D0E25E968
SHA-256:	17404FCD1AFCE312822676B4F2B0CD0115650637418430BCCDADFB0003033D4A
SHA-512:	696CFC4B689A775C9FEB2088C842ED95846D8D15B7FBFAE32D2A0243B5DA99709864C4CEB60867AFBC0F954FBD83F50C01E1A243A1D8B441F44506C032D839F8
Malicious:	false
Reputation:	unknown
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445037925200809
Encrypted:	false
SSDEEP:
MD5:	27B2D0DD7F835C4E138A604FFBB53446
SHA1:	B5463F3AADCE8FBD8B5CAD728DED014B0CEB3FBE
SHA-256:	262001C70D3014ECAFB2282A256614CA9768A77408A2D41B2573EA91C4050057
SHA-512:	2C473696C11B35D5811056093437712D257FB2DE9B6E608262B3870F55F6A38AAD5D8DBAE9F674137B5D9FCB6A14940857B729F1052C4DD131C4E3E948580280
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7762618144963866
Encrypted:	false
SSDEEP:
MD5:	814AD655BE6102E699430756F54087C1
SHA1:	8CC08F4E0F8CF9AD0CDB8E72D01BE2E765F41917
SHA-256:	E1E32675C8C0E3386C1D7531C5010C914D64771EE7E2644E1C264C501AE2129A
SHA-512:	F51DADA6724C7FFE5765B0F3D68F3D9DE7D8621BF3F02DCBDF827D5BF4155A80DBB616D1E6E8B190D1BB7AEEB20FE5A168CDC4275FE321043B7CC231928AEF3F
Malicious:	false
Reputation:	unknown
Preview:	.... .c........7...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6180

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Reputation:	unknown
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Reputation:	unknown
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.364401610311066
Encrypted:	false
SSDEEP:
MD5:	C803C74563507F46D20618DFECDA17CD
SHA1:	C3D36372417CDE2C5E8728241C69A77861B00860
SHA-256:	D55FA7E73F1BC160487B986CADF0A0C2CF88B37C6AB2E9224D7502652B7070DD
SHA-512:	379098623756A4B13DA7533B15631B73DEB1EC270B86A5D6128D8A95C6408F833C88C2A33710822647E66ACEEAEE4725BDCDDB8AEC381A724496119D7A27B8DC
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.314253129782675
Encrypted:	false
SSDEEP:
MD5:	C8999445114885012AE7D521DB06F91A
SHA1:	1FE2E5DE1B44876382641E38CF5BB928134A2A89
SHA-256:	D8AB6BA93A36E04AE8DB44345883A5C011451E2C4F1137D29710231F4F645F3F
SHA-512:	B1DC93D9BA79A5ED32017F3040EF236AEAF0AF1665F127C91472AD2D5748344A0D299589C4AEFAAC979F8C947D3D4AB79B8BB218B7B9D9FC1821EF54D5622D7D
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.293739698920077
Encrypted:	false
SSDEEP:
MD5:	10314CA51DAA10CA5EBA7B3A67EF3B35
SHA1:	7532A23A2BBFF8D6440D85E41AA6D008D02EA826
SHA-256:	D74A6BC1798E28F0144957D7252A0F49BB47305281A8251344343F6B0C080D66
SHA-512:	AAEB6A95665DFF54ADC794EBB509D243ACD589D1C5C15805F6B9A91D97C7035AE89803B19066A02AEAFAC2D23794918E6EF7BFCA623F1029A7CD81D21DAE2A15
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.354827697141045
Encrypted:	false
SSDEEP:
MD5:	B4BBE68B5F8ED4F7DD8F89AAB3D12E26
SHA1:	8913E0738258CBCDD06FB5AAADC06522E0E9A0A0
SHA-256:	F9FB01EC16A949D51A6219556B4A14BB93DCA92A4C04C559BB90150BAC4F5F72
SHA-512:	E33075BDFABA42354058FF74E8A323387083A339DC01C9877049D74616A9E75E273AAEB0DE0D6586FF2D157CFF707ED5C0B74347D6D7AAB308A83ADD12225F11
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2135
Entropy (8bit):	5.849577124363819
Encrypted:	false
SSDEEP:
MD5:	10A0AEFD004EAE14CEC020F9AF3B53AB
SHA1:	980AF34ED7D72F71050628F0E285176364B81AC3
SHA-256:	CD5A0A0F810823D90ADECC9CFAF8CBF8A1791D83EB221AE9FADFA7281EF96FAB
SHA-512:	51F4E10C535123D0A0A0204819E385CE92962C641C69CA7C237E7EB85A56F8756ABF7C88CF3FBC19EBCD2BD2F2856A81385734D635033231B243B7A8F4534C20
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"98856_305507ActionBlock_1","campaignId":98856,"containerId":"1","controlGroupId":"","treatmentId":"c5f7d329-61e3-4065-87ed-fed4efd54ddb","variationId":"305507"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2NvbnZlcnQiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRXhwb3J0IFBERnMgdG8gTWljcm9zb2Z0IFdvcmQgYW5kIEV4Y2VsLiIsImN0YUxhYmVsIjpudWxsLCJjdGFCZWhhdmlvciI6bnVsbCwiY3RhVXJsIjpudWxsLCJjdGFVcmxUeXBlIjpudWxsLCJ0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.303325794842211
Encrypted:	false
SSDEEP:
MD5:	37C361D193661C6A0A22C84C8C9BE504
SHA1:	FF2528DFA2A12AAE946681936A0FC0BE6C36F40B
SHA-256:	22E0C12D493AC70378D9E806403A13336222E69F7724289C57D148F6C71F7CE1
SHA-512:	F18B1A0CB5FC91314E51D039F5BB6EF6EFC086FA385F4C541DA688221020C0D0643C5D9CD982E92D796FE37EEF89929B9954DDF9C3A0FC93EC7EA876297E340C
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.305634880478497
Encrypted:	false
SSDEEP:
MD5:	572C6EF3E2BB85152FCEA06174E15D9C
SHA1:	03A1F20163427481BC4717B5468F79A290A0DE62
SHA-256:	3B9A6F0CADBBACBD2272F6CA342D9530DFB668E20AD29B3DD2769E12394977E4
SHA-512:	D30F6F12A60239C6D14FFDFE889D445D6C9BAC3F6EE4277BB1E3BCD481CAB4E7D1160FC6216713E8E864010053068557B7EEC05F8681915283B983C1B4597ADE
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2082
Entropy (8bit):	5.844574046461787
Encrypted:	false
SSDEEP:
MD5:	BB12FE76FDE2719808B71E492CD5497A
SHA1:	3B6522B423577C93B7081E5FD7C7306C2859E971
SHA-256:	50AF61B7503537C17ABA3C3881DE1FA7CA5106C8C88665ED5CAFEFDF96813564
SHA-512:	AF27BB6324DD644A141D407D694C4EA7F6A2749FD56D2DB8655F0CD2114D46A3EFC6D90BB577E3DF3C40ADB33FFC3F4F8DED7F5F9502C50A6F78955A81536AA6
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"98856_305507ActionBlock_2","campaignId":98856,"containerId":"1","controlGroupId":"","treatmentId":"14c0f2e3-1443-4ebd-acdc-c9f63dcb7699","variationId":"305507"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2VkaXQiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjpudWxsLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnVsbCwiY3RhVXJsVHlwZSI6bnVsbCwidHJhY2tpbmdJZCI6IlJHUzAzNjEtRU5VLUNvbnRyb2wiLCJfbWV0YWRhdGEiOnsic

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.329188181411706
Encrypted:	false
SSDEEP:
MD5:	F93B92C0BE1D73A7A2EB6EF70953BFF4
SHA1:	2B25536525FCC2C843DF9594ACCC41D168F61789
SHA-256:	EA28E93373D3E13B11584A32DDB463A47A470FE7AE8B4EE5083F8A8D5ECE7B4C
SHA-512:	19F3546CF005C2D80036EE9AD56CDF2663BDEACCF25DB4A3DB81A140388F0CD265FA576655A728B96C887BF413C4C8A315AE46969C4FCA81B922066B3DCDAE44
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.309742076225215
Encrypted:	false
SSDEEP:
MD5:	22C394500DCD09971FC35E48CC7D5BC8
SHA1:	686FA556570BDA3DB9F06F6DB598223E8F8DF6A3
SHA-256:	2984D9ED084BFF68FEDE7430C2F09830BDAAC5FF4F59E198F3F090EFE0490386
SHA-512:	07831C05CB2235B0BDB3DEB70574DFC1DECDDBDEF7350FE9F9869C2BF79F013F703F600C3B59F2F9C030996A856E11ABACE19A301FAC83B36F5C8DB7FF3E5B7F
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.296262955402231
Encrypted:	false
SSDEEP:
MD5:	27F0019ED721FAC72AFC7EBE673919CE
SHA1:	C33093E332D6B8246222009D07946B82DD9365B0
SHA-256:	2D3A5C7A29C9F01DC3869CAE3EC60F07FA063E63D8DE6BB86DC0CDA8846A86DA
SHA-512:	8638DC369984CF61EE824A2B3E4BED075042930A4E8D04B2E66A6A681D2D4BDE509CEC0D5641DC330E558426AA107BD7F0246C80A8E31FF9316C061EA3988039
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.293222218048735
Encrypted:	false
SSDEEP:
MD5:	E04D7016A30FC2326F4F3C4E185A11D7
SHA1:	5A64FCBF7333A21435C792A946A6F0D0C661A5DF
SHA-256:	CAF79E92F1CF257B81CA23FFD4727A20DB0E6054E3FED0E3EA4D61F23A1DCB36
SHA-512:	8F6692D6A3496CB5ACFB7379D9D835428418EB0802967CAE9116A22A2F3759D3687B17489EEE308A89F2AE762AD1269D30DD1C416A425231C982616307608AB0
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.29642400263449
Encrypted:	false
SSDEEP:
MD5:	E0AEE045247E8FAAD6925CCE22DAABE9
SHA1:	1C81395830D45F4C2D6E8B37ADF6082BDAEECC85
SHA-256:	E71A61A1D01A293F2FECFCDD85ACADE0D393B0BC20329D2D1411D04492253192
SHA-512:	F5C41DAC66BD924D8EB937FD778C8C61A98E54869BD84842ADB87296DE5B844FD7DBE61CDEF3A8B6791850D6CE436E828DBF9691CF475F0D99A2D64D7F1FD484
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2034
Entropy (8bit):	5.848440221971215
Encrypted:	false
SSDEEP:
MD5:	479F8465163E8E3C6DDEC0902F5FFB95
SHA1:	ABF27C3B847732C9C844955F65291AE19D866DD2
SHA-256:	A804D5721EFC0AE11D078DE648D4E1537CED566BAD1D6A3318EE65316C65144F
SHA-512:	C9831F8FCB22D428EC71DE0E8AFAA2138C60DF76BA14DBC372E842E8E3B44EC05EAD7A589CC91658F0424BFCB0B2563920DE3D11BE1B441C8AC1DC8CF220A5C9
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"98856_305507ActionBlock_0","campaignId":98856,"containerId":"1","controlGroupId":"","treatmentId":"e62f3b57-7a94-481f-9907-c3665f96acef","variationId":"305507"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL3NpZ24iLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRWFzaWx5IGZpbGwgYW5kIHNpZ24gUERGcy4iLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnVsbCwiY3RhVXJsVHlwZSI6bnVsbCwidHJhY2tpbmdJZCI6IlJHUzAzNjEtRU5VL

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.273425302262433
Encrypted:	false
SSDEEP:
MD5:	6F1CF5E2D99A6A9DD0780734FF95E984
SHA1:	5DC2BFC4392913C4027FAC7E829481011BDF5614
SHA-256:	AE7E0F8EC8BA267F19981215FE86A194CC8AC7DA107C8F567C59D6BCF7F730BF
SHA-512:	375221C454ED3C80ADE82A25AE6BD8A2EADE2B0DD78D4C186FB398CB0520A94D59A7ED5683DEB414B2A315A2ADEE07C1B6C199015D17A73416312F2180357D9D
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.285344644191382
Encrypted:	false
SSDEEP:
MD5:	0B5CED461028E31F6971D44559DF7E4E
SHA1:	1809E14714A868628AF328FE23943995C6176CC5
SHA-256:	D416C77067023A695880A4AB1A9893D785E02FB85EC4BBF2862A3F56FA39A765
SHA-512:	541E02573573567090EE82E6AE48B4D0863AD6C75C26DC232C9633CB4636279E02E2EE51B2447325C3AB32DEFE5DA49E5F865B3C587A08798465809C00CB3D2E
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"0e7d8b9a-4514-4605-b859-24726ef0726b","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1741992877584,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Reputation:	unknown
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2815
Entropy (8bit):	5.136898254859373
Encrypted:	false
SSDEEP:
MD5:	C2EB89FC669B74BA923E7BE9A3287387
SHA1:	1CADF5C052F20128885579747D5CE08DEB2C42EB
SHA-256:	EECD2F3380B23EB07E7F55ABB654054394C7ECD822AC80D4E004F56EE21C1937
SHA-512:	78E83C4562A40C3A54BBDC95931C9007E49A2C529E25DF7815726A6A2CB55B29D07E1D78A83D58D1F1C92E3A8716A2EDC6F00D78D6FCD802C59D14763900F72C
Malicious:	false
Reputation:	unknown
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"437230b6d00f708eca4f3af4cff313ff","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1741813537000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5895284b31b8cfd244be29c3f38929fa","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":2034,"ts":1741813537000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e022d5aa5d74c440c73c8f6418ffe1b5","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":2135,"ts":1741813537000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"c32ed696419e4af403f13b09e003275f","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2082,"ts":1741813537000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"36b0a2dac2cbde3a474fbfa9395b5db3","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1741813537000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"dee9858e1e8b70fbf5349806fd403fc1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file",

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4587752902335491
Encrypted:	false
SSDEEP:
MD5:	0F74A99AEC6DF1721941C1676CC41C05
SHA1:	A1AF274AFDABB84CF49EE516453C2BA44D20E30D
SHA-256:	65F5436741CDAEE83A1FACB8D69A28FC514185EF795D9F8986177DFAEF31BC7A
SHA-512:	F116C1B58CEE95B949DC658FBA6C2C836A730B91A94C0B2F32B1E80951D271625A12DC7E8CFC062546ACB761CD6A6F92FFB33261D8B1D0DF0D44A44556EF33A3
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9618926288736718
Encrypted:	false
SSDEEP:
MD5:	2FE1950735244AB8A719726BDC672830
SHA1:	ADA07EF8FC739ED295C3579BC2E735E0F82AF6B0
SHA-256:	1B6A405159570973AB77CE1DA7476DC4336561F4AA5F5194A80F85056E11270B
SHA-512:	B50B093E26993F61C8A48A53B742AD20721AE7FDF346E0759F3E5C5C6BE5542C00AE0F510764BF99F52B15C0DD1C291550D5BAE3DE3E7E97CCE19CB1DAD05ED2
Malicious:	false
Reputation:	unknown
Preview:	.... .c......w5o..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI9d012.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.522811667751431
Encrypted:	false
SSDEEP:
MD5:	478AFD2BC2C52BB032E842EDE1007FD9
SHA1:	8C26CCC875F6D530C08732BDBB7F6F03182475AB
SHA-256:	B3302A203BA756F0703554C2C9273C914FB5869EDDEC4DA608F7C2EA10689D8D
SHA-512:	855A6D5615BF7AEC157A61D187B866613426385BAA15ED347C081A53BB0C6DD5BA53C3010DF7817521CA309BBA8B959CF50D6FC1773C07C25CFBF5824CD2358E
Malicious:	false
Reputation:	unknown
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.2./.0.3./.2.0.2.5. . .1.7.:.0.5.:.3.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91kw6p8a_1308qsi_4ro.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PDF document, version 1.6, 0 pages
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.024329009627658
Encrypted:	false
SSDEEP:
MD5:	E2CF9408DCE4F8583A389E9BA585ED0A
SHA1:	834489857332403B955C71D34BA50216232F05CC
SHA-256:	1A946A426E62B89A3A7C7C13A56F098254350F187E3481BC812D520144F59C31
SHA-512:	234FAC88D4F48B995308B843FE8E61D1CB7276CF6C724C1353B8E773D770639428138B58D7A88440B0AE72AEEB933EE785C372C77EF369523921C31E7993A97D
Malicious:	false
Reputation:	unknown
Preview:	%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<0C1949334E58514DBC7B493639B14670><0C1949334E58514DBC7B493639B14670>]>>..startxref..127..%%EOF..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-03-12 17-05-18-897.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.352085917943317
Encrypted:	false
SSDEEP:
MD5:	E89CDF7025B70E5A72FFC801BADFB345
SHA1:	2C55C26FD5231BEBD6531BDB7962D12BE288A1BB
SHA-256:	2A90DFB97133E5C0219784D1C4A94C0DC45AE4787C40CFE6894A59D94C4FB88C
SHA-512:	22621DFF9C688C4B0BB3237350959B4357C65D1796834FC23E6636B4975BE942A969F7DB05E8FC10102DEBF93ED662BE28FC649B2456EB4B659EC84BF8E93621
Malicious:	false
Reputation:	unknown
Preview:	SessionID=47371133-08fd-4d2c-bf7b-052dd86a3818.1696588820356 Timestamp=2023-10-06T12:40:20:356+0200 ThreadID=1312 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=47371133-08fd-4d2c-bf7b-052dd86a3818.1696588820356 Timestamp=2023-10-06T12:40:20:356+0200 ThreadID=1312 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=47371133-08fd-4d2c-bf7b-052dd86a3818.1696588820356 Timestamp=2023-10-06T12:40:20:356+0200 ThreadID=1312 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=47371133-08fd-4d2c-bf7b-052dd86a3818.1696588820356 Timestamp=2023-10-06T12:40:20:356+0200 ThreadID=1312 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=47371133-08fd-4d2c-bf7b-052dd86a3818.1696588820356 Timestamp=2023-10-06T12:40:20:356+0200 ThreadID=1312 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.410229118252378
Encrypted:	false
SSDEEP:
MD5:	32E9768642A3B90654F0BC27BCA2FB14
SHA1:	3A3D216982BDB4C1A7549D508D00D0E1B631EFFA
SHA-256:	1D647A5E2C5643C6D615C24386306DAA1229D37A6206B677DB78F24470CCB00F
SHA-512:	0057444ACD990DBC600BEDC783D203653F8FC78C423130380527078636968FBB5D320967FB0CC4DFF2D390EC693264C31121945E862F4501D4D0FA988F8AD380
Malicious:	false
Reputation:	unknown
Preview:	06-10-2023 12:14:34:.---2---..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 12:14:34:.Closing File..06-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\17319b50-265c-42d0-9eef-ac31b655d7ea.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:
MD5:	5BFAA5CF043BA460E7547C3ED450D3D1
SHA1:	D09AC680134369994125ECE1E965B14A584CDE9F
SHA-256:	B45CAE9F6D7D6F958627F578E04E5AEECDBB1F01619C5E83B5988C12343E22B6
SHA-512:	E1767DDB6839B53B3BA1F46772177874B47EB9B2D21A0F57587F6943854AA1C468D1C4129D996CC9C2279B9A985899754E9915870294FD34673A1C9CF96AB1C4
Malicious:	false
Reputation:	unknown
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\24fc3835-efa0-4c1f-9c40-ef4dbe02a2bc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:
MD5:	97CCA34742D18B8A24F905F18A39F7B6
SHA1:	58C41D0D742783691D2BF3FA5C5CD28A8433892C
SHA-256:	EE6AA1F8AD25A1DAB72BBF0EA49FE21EE68B3510C319B54427616315C4BFDFFE
SHA-512:	1C6A01D6C8D11319CDB354FC1A4701ABBE7A495BCB3C3F8FED7C5F4C402B149BC26783ED69BF4993A0ADC1280CB7791131556384351DD8283B14A54EC3AAE28D
Malicious:	false
Reputation:	unknown
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\366ff5c7-f70e-4026-a303-70253aa2a2c6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 160932
Category:	dropped
Size (bytes):	204841
Entropy (8bit):	7.976434019251077
Encrypted:	false
SSDEEP:
MD5:	B334EBB4B5CBD445BB64253424750B2A
SHA1:	78DFB0B7271DEC0F3D645A2C8638877C1CA50A0B
SHA-256:	5EB307683C2430F67130F8CB5FA898DB4E28A9D500B5A40C35A1D073EB81364B
SHA-512:	ACF6AD2B5CB06CF935804CEE014F3A24A36CD7751391651C05EDDC3498C95680564AE1BBBB46D81552917B4829FEE52E1BF0AE89513DE7C695295B8A51BCD646
Malicious:	false
Reputation:	unknown
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\52ef9c80-2c0e-488e-bfc6-da52d0cf3d38.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 921996
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:
MD5:	C14EBC9A03804BAB863F67F539F142C6
SHA1:	FD44F63771819778149B24DD4B073940F5D95BFA
SHA-256:	A495629FA5E71EE50BB96F9C4CAEAC46E8B44BFC3F910A073348258F63DFAFCE
SHA-512:	8ED832A54A3925914E3BCFC96A3ABFF63A511ADAC79A869AD1569BB175CC1AF84E6C2BD20FA2187A5C3B733625EDE5D95C2172B24ED2F252835689F6D4A0F5A2
Malicious:	false
Reputation:	unknown
Preview:	...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..\|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..\|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

C:\Users\user\AppData\Local\Temp\acrocef_low\77e7c23d-2ea7-4c20-9947-11c9c01d003f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Reputation:	unknown
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
Category:	downloaded
Size (bytes):	35169
Entropy (8bit):	7.993210932978764
Encrypted:	true
SSDEEP:
MD5:	57EADECAC2A031883A702F6B12A14502
SHA1:	3C1E4F5ABE11775DD678085EAC97029DF618A9F7
SHA-256:	C76276A58DFB0E4D68D277526E5F05EE357E13957B4C91BE2C74BE7CD20B065E
SHA-512:	D98AC263512C6CDB0A522C8B550F4CA8B901F620A1ED416C49163B28E0D5D08EA9605BF681F9F0C5567EB244BBD319D6596C6B46E860F48AD5CE31154DD2CA5A
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_c4928fb5cff147a39780.js
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v...:{...r..._........,...A........:..x.>.y..u.....N..f...).......<?._.f..C.....%..@..~....`P../.Q4..IQ.' ...e)'.q..Y:...%.z..x..k.z.../....@.D.r?......GP....`..o.'..~1.....&.HJ.`.@.}mV../8.b.m..guo.H_.7Qv.....dQ.....-.NE......G:.U'.....~.1.....H.k...O..dk.d.\|.7..x\/..i^.Y..Q_/.`..i.&...-.......P...yEv....,....'.^...X.......YK.".....l.r.ax.....<...1!..4GQ.M_.....L..F..51.!.....].....y...(...=O5?.nT...~

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	unknown
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 40 x 67, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.068159130770307
Encrypted:	false
SSDEEP:
MD5:	AF048E822042405AF712CE991B57A942
SHA1:	28413FF4525D862E7A0BF66C044E44AB9738A523
SHA-256:	B788DB62229D00578F9896034B61EF9AE63152F1EE6C8C9CC833E1CAF4BF4B67
SHA-512:	E5CD244D167D172665B84651C0450033F3C4127E0162C0046CA6F1C84F3C86AC72CA8DB0F85C6F4E5B3D4887939798621C6E061BEAAA624B4CC68A57DA0DD36C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...C.....a......IDAT.....$.....IEND.B`.

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zstandard compressed data (v0.8+), Dictionary ID: None
Category:	downloaded
Size (bytes):	4035
Entropy (8bit):	7.933972877545046
Encrypted:	false
SSDEEP:
MD5:	2F5825E1EE39361BCE9D8ADDAFF28632
SHA1:	A79A90E5BC2169BE23D48CF4BE323801282BF703
SHA-256:	D71BEDE51855FCB5183320788E04BD88D50DCDC21A881637D67C5B9BD52FD0CB
SHA-512:	455E581995470EBFFD51E49BBC408AD03B0802301A272BDB1D92CF6C2FF97A2FF74C634CB3610A02A65B5E6F3FC0822078D5748C11DCF7325A714756642F0AF2
Malicious:	false
Reputation:	unknown
URL:	https://login.office365-formsubmit.click/cdn-cgi/challenge-platform/h/g/scripts/jsd/f3b948d8acb8/main.js?
Preview:	(./..X.}.......dm..-...^4[.}.....Zy..w}O.F...&../...r........[co`..O.}Q....E....F.. .`../.....-..a....^....=.=\f.......>..y_...~..}.g...5~..x....\4.%..x..D".D....,.tdJ.....(.U.D...g[V..F#tn.....F..c.V.l4>Z.1D...h"...1DmY......{.2p....1D+.]..Q\..Qd3...n4>......=..F.....0$......a....k+.;..\...^......"......e.H..3..n42.h.(}=.A.CocY._....?Vpq...@.. .]..."....6.7..U...fXhp...Zl....].4t......j...B0gv...........v.^.B0g1P.W..C~=./..^...=^....?U..S..J..fY..~....j.3..+x.A....x.9.q.g...../Y~...z;..T.\G.J5.....q.-92.*a...-..e.T..6.U.a.$....>...L...<./....t.../..jU.&.M...]YuLOU[..3qwvS..M.#SS.B9.".a..p&I....a.n.......F...-.l#...$....0K..$5{t........r.....$......%.Q....TM.fo.[,...g'}.J...?.^.=..#U.x./}t.A7...#hvb..`;..E......M. 4u....#b.D0".'>.t....h@...I.... /.....MfI.S.7v.(.4...y...0.b...J5.y..@.....\|.\..#.N.D.....(.[+&...F..$..\... ZD"q\..b\|...;25.....t2.N).G..F..(..Xz....e...3)..A@8.Q...s.tx... ..><bD..=<vL1...I ...1.d..Y..S........S\|v.MoK$..

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 58435
Category:	downloaded
Size (bytes):	16556
Entropy (8bit):	7.986602570292376
Encrypted:	false
SSDEEP:
MD5:	209FD70F9BDA807BF117210BBCF03522
SHA1:	FD4A15809E2953DDDEE045F440DA62F9A11680ED
SHA-256:	58AC139774D14AACA1F5C7FE2F2B7DF96CD208AC5B1D03FFCB732552C4C05E54
SHA-512:	76AD5E7641A4F30E5662F48D3DB05F2D3EE2024F6E801EAF9D1F48DC4F8CAACFFF41448FC4E68FB21F69E5527D5119D75A3411DB1285A3BBD0E5C84B7A9C6342
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_0lh3lajrog_lmhvtw2rbbq2.js
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo.....].YYYY.Y.Y....I......T..............C..C...K......G7,..\|.x....oZ..E.N.....W.....w...U.N.$..}x.j.?..........J.p......F...{...{?&.p.............>.9.wb.s...4.C.G...s..3u"x.\,.{1.L..{.'...J..K..{Q,.a..'b...a.1.$t....p4.....^]z...._.7b1..Oq.......[..&a.....N&......o./Bo.n...f.......;O..>....5....d.......8..ET...~..&..Lo..Ox.f.z..G^.....].s.O..h..V...\|1..@.........KA._..S.^......... .t.;...D.........vZ......R+W.k.../..e..tP...U+..].....O.7.Y....x..]w......fg..3YN.KCz]...$.b........V..+.%h[.&,.p..{^...$..{/...=a..Aw..I..............O...1.]....W>..?N..(.4.K.t../&1....\G..`./[z......u..[,.7....)P..[....T\|..*.a!.!.t....h......d"......w.......y..!T.......)..a0..5....oF-.....S......>...A.....t$G..r.;....\|.....m../..i.....V...i.....-..7_.o.V..)...u.. ..`.n]._..(. d!...........e&d.....Ra(....g..N........> d.C.....^.H.-.e.ck./~...9>..]...`.%4b/b.@O...9n.Y.2.._B.Yzy.

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	downloaded
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 455713
Category:	downloaded
Size (bytes):	122939
Entropy (8bit):	7.997746253803481
Encrypted:	true
SSDEEP:
MD5:	20CE87477D6D15DA34A741E403DE3FEC
SHA1:	39506B05FE4C40DF151748CE7D815DA94F484C5C
SHA-256:	25E14EF7716B473D159874C370A076CD21AFCFF5E466AAD0CBFD863EFBA9A084
SHA-512:	F116ACDE307C652A84B3ACC963365353FF348C729BE3E242F9707DFB3A78E3B160A6DF4240E34E64841D80EE44986936A384337A75D57F2CAFF546B336CEA921
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_Z-97xch0omzdvdz9EEve6A2.js
Preview:	...........{w.8.8.....fn..(..o+.....I.....Merd.v.%.$.1.......([NU....s.Q.H... .....w.......Oit....OJ.O..J..............F....^\.x>+...3....0y..F.0....f.o..~i...R..J.(..9I\.8.Bc..2T...K;J^K.....6o..P.....!).a.9.d.....G..."pYTz~...Da.N.R...=A#....M.%;b..%.I.%......!E.15.[...:..P.........8_...L...U..ie..\|.JIXz.....x.`Z...bj......I..a.,z...~)..D...%.2....-M#;@...`..i......cTt.Z.fs...L/.8..s...R..^...J.?.0.W..K.z.h..Z.5....d...>L..a1.:.......C.G.....G..?c^....,]....Q8..@.u.b.4..K..!`_.....q\|q.?]..<>.L....+..R........d..uO...v.G...c..;...A.KX.Y0M....g...>....'a.:g..;.>...9.b.:0.e[.....w...T......JE..V..;....wU...TYf....?.....ua8...i....$)W.....\..7... EC.h.&e.6..D,YDA..W.Na!..T..$k..;..2..ju .1,D}LdY=..a.>\|k....ND/.A...}{+'V?..W%#..o)a.S....c!P8..UI.".n.{.]C.q...-u..a.....$z%...[*.CX......l.}.U.Q.......\.nT..........Z...LK.~.\|."...D;U{>._....T$.C..^\|)..'e..!.k2=...)Y! )..+.Y.#%........C..>0.r_oo..%.>....=..g..!.V....<%J.D......

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057605
Encrypted:	false
SSDEEP:
MD5:	9F9FA94F28FE0DE82BC8FD039A7BDB24
SHA1:	6FE91F82974BD5B101782941064BCB2AFDEB17D8
SHA-256:	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
SHA-512:	34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIgCQOrJK__ID4tEgUN0VtRUhIFDVd69_0h0KxF49NTAQc=?alt=proto
Preview:	ChIKBw3RW1FSGgAKBw1Xevf9GgA=

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	downloaded
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
Category:	downloaded
Size (bytes):	116362
Entropy (8bit):	7.997473195483862
Encrypted:	true
SSDEEP:
MD5:	81C7B985343C317ADEEA2C28F5C6FF4D
SHA1:	7A04D6215D0B79EEDE6823C4B3621795AD552534
SHA-256:	6BDBA6F0D2271DD20E6E6AEA2B459A1A23050EDE1B3BBADE4C913A1716F6E491
SHA-512:	DDF40137ED7F870C5E7475685BA9006F9C99C7C0632A9E7738DCF9BD081C105ABA5B94B3302BBD26DFF413DC065FC442D3CDDA33684709D6185B409F08158085
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_72a1051aa2aa2943d8c1.js
Preview:	...........k{.H.(.}.......c....8=.Ib......#Ca.....K..o..ZU%...q..9...ct).....S..?U.6..rqyt~Y9}W..........Z.xzy..x.z.Q.w9......^...U.........<..G....=wZ.....Oxe.._.0.S/..k>..&T..gn.?TN....6.....a0...I\......)....$......7.T>x.0..q\...{..H...\|.....2..x"..\`IYkD..#....FP....a.^.].'0h.&.....ie..\|.qPy....l<..S.y.E..>.....a...3..-vq:..P<..dE.....C.h.P..]..\5.......3.<N.^?T...:B#c....\|...T.........(...Q.l7[...V.e.W.8.G.....O...0.m...f.F...7..h.......F..b...Yr.=...f.....?......S.}U..g.......t..../...G.......~.+...)y.X\...<.&.........`.v.....`^....c4c.Yh=.a.wB.m.......i..~v-..O..nY....A....5...v...t..FSw...Q/n...c.9Y{.-..>a..7h..o..ec...O...)~..8...j-M..nD....9......f5..'Q#...L.'......fZW."Q[.<.nx..O...LU.;..a.m..&.k.$...;.=L...yv....,.f<Hb{.w.@.8...8F.D.>.04.[K6v.i..2.#?..&.;-.].....1.X0w.H6mZ..A...t..e-.\...MC6.xt`..cu...@_...v....;z'.mV.T/o.i....-...K......\..Sn>B......%x..%......W.\|......~.6.%...+.:..x5..s5P.-..!.G...ZT.i...;.&

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113424
Category:	downloaded
Size (bytes):	20410
Entropy (8bit):	7.980582012022051
Encrypted:	false
SSDEEP:
MD5:	3BA4D76A17ADD0A6C34EE696F28C8541
SHA1:	5E8A4B8334539A7EAB798A7799F6E232016CB263
SHA-256:	17D6FF63DD857A72F37292B5906B40DC087EA27D7B1DEFCFA6DD1BA82AEA0B59
SHA-512:	8DA16A9759BB68A6B408F9F274B882ABB3EE7BA19F888448E495B721094BDB2CE5664E9A26BAE306A00491235EB94C143E53F618CCD6D50307C3C7F2EF1B4455
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css
Preview:	...........}k..6..w...R..J.H=GSI..x.9...}T.....)Q..f<...~.F.h..x..{+.-.....h..n....</v.ev......W.,.bU..rW.I...0x...C..2...6]..W_......../x.........~.z.}.\|.#x......AgO.\|XgU...4 .^'U...mP.A.].Z.U.!..Y.......:.ve.?.!..d.N...xJ...mR......0.@p...lKr/...E.-. .....\|l.4.o.i.......L.iF..T{.n....2....VEY.y=..=..T+V./.b....\....7.sH.w{.h.....!.."F.k.!.......d...mS.rh.&G.../..h&..RE"!.A/.......A....L...8.q.M...t[...R...>.6;R..^.Vu..9.[F........>A.:HT}w]......2........p......'T.^]}.^..yJ>.<..pq..h.\|..j....j.x..-...c...f...=".)..U.X'.M..l.]ZVtl\.I..}.0.~B0Y'.N...E.4.Xd..e...a.........."..9+d.&..l.$E..R.u.g.Q..w&...~I. .y..D.4;..'.."-.....b...)k.n.M...,3J.z_..&2f.h;.&.R.y..P..X.....\P.....r...B.$........<....H5.M.."'#.6mQl..mQ5.=.\...O.....^..jM..u.F..Oh.lNI..j..T..u...I..._........{.\...{..._\|..={O..z..>......x..5Q.D7?{...^...^.......o.=.z......v......z.C...Gtw...0!..M@....^...^.x..G....W...{...)..y.<c3...^>{......7._..'d__...;R.

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48238)
Category:	downloaded
Size (bytes):	48239
Entropy (8bit):	5.343270713163753
Encrypted:	false
SSDEEP:
MD5:	184E29DE57C67BC329C650F294847C16
SHA1:	961208535893142386BA3EFE1444B4F8A90282C3
SHA-256:	DD03BA1DD6D73643A8ED55F4CEBC059D673046975D106D26D245326178C2EB9D
SHA-512:	AF3D62053148D139837CA895457BEEF7620AA52614B9A08FD0D5BEF8163F4C3B9E8D7B2A74D29079DB3DACC51D98AE4A5DC19C788928E5A854D7803EBB9DED9C
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js?onload=EFpGI0&render=explicit
Preview:	"use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function v(s){Ht(l,o,c,v,h,"next",s)}function h(s){Ht(l,o,c,v,h,"throw",s)}v(void 0)})}}function V(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):V(e,t)}function De(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function Ve(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){De(e,c,a[c])})}return e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	unknown
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Static File Info

General

File type:	PDF document, version 1.5
Entropy (8bit):	7.805047800145199
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Visions Awards CustomerVendor Form.pdf
File size:	19'833 bytes
MD5:	d5d0dbc5a33994ec5028352ef66d82aa
SHA1:	f9b794cb9ead1fff5481299defc0fe85d1f1b8e4
SHA256:	7ce894322fd6f20cff578bfd29aab9038b0ba93aee388d29ee2f89c60b536229
SHA512:	2ce8cbd1597ea520021c6c8a3798ac0410a71199c13cc489c688eea46e736d4be83bb19ac596b8033824f54c0958555594e2bad6c641c5859e87b6d585c624e7
SSDEEP:	384:cao/IyThiJYPw+t0lfjUp0k5vgZP8GyqUifS5:chIyTqX7CgZryqQ
TLSH:	D1927EE9E536489DC48D8AD1A52822C2C1DDC1F36A19253B302CC6873E58E67FD169FE
File Content Preview:	%PDF-1.5.%.....2 0 obj.<<./Type /Catalog./Pages 4 0 R./Version /1#2E5./AcroForm 5 0 R.>>.endobj.22 0 obj.<<./Filter /FlateDecode./Length 10.>>.stream..x.+......\|..endstream.endobj.23 0 obj.<<./Filter /FlateDecode./Length 10.>>.stream..x.+......\|..endstrea

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.5
Total Entropy:	7.805048
Total Bytes:	19833
Stream Entropy:	7.966291
Stream Bytes:	16079
Entropy outside Streams:	5.093597
Bytes outside Streams:	3754
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	30
endobj	30
stream	27
endstream	27
xref	0
trailer	0
startxref	1
/Page	0
/Encrypt	0
/ObjStm	2
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	1
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5
102	0000000000000000	73acd0b4a2391d4bbd9765aca5db19dc
103	2b43c4caeafa5986	970a88aa2a083750a4f6aa6c568f06d0
127	0000000000000000	17b3e19593efeb4c09a755092de9d245
129	0000000000000000	2524414a7a3da57b1d3656227f4fc326

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Visions Awards CustomerVendor Form.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0744d919-ad5f-40b2-bc00-a877207dc9dd.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6ab6c9.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eed097d7-0b8f-43ca-bb34-a12e3fdad578.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250312210521Z-292.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6180

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

C:\Users\user\AppData\Local\Temp\MSI9d012.LOG

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91kw6p8a_1308qsi_4ro.tmp

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-03-12 17-05-18-897.log

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

C:\Users\user\AppData\Local\Temp\acrocef_low\17319b50-265c-42d0-9eef-ac31b655d7ea.tmp

Windows Analysis Report
Visions Awards CustomerVendor Form.pdf