Play interactive tour

Edit tour

Analysis Report Tribeca Investment Partners - Funds.pdf

Overview

General Information

Sample Name:	Tribeca Investment Partners - Funds.pdf
Analysis ID:	433116
MD5:	1f514a862d7eb6e2c4952b67a97a4e56
SHA1:	4a4d5f759793397ebdc72679895ef62f6a74fed3
SHA256:	6c796e1a57333bc61e0a45a6398da2393ce0529304b57abc8d22125862a02211
Infos:
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found potential malicious PDF (bad image similarity)

Yara detected HtmlPhish29

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Classification

Process Tree

System is w10x64

AcroRd32.exe (PID: 5092 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\Tribeca Investment Partners - Funds.pdf' MD5: B969CF0C7B2C443A99034881E8C8740A)

AcroRd32.exe (PID: 5960 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\Tribeca Investment Partners - Funds.pdf' MD5: B969CF0C7B2C443A99034881E8C8740A)

RdrCEF.exe (PID: 3340 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043 MD5: 9AEBA3BACD721484391D15478A4080C7)

RdrCEF.exe (PID: 4952 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=18176514141952179124 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=18176514141952179124 --renderer-client-id=2 --mojo-platform-channel-handle=1664 --allow-no-sandbox-job /prefetch:1 MD5: 9AEBA3BACD721484391D15478A4080C7)

RdrCEF.exe (PID: 4944 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=14323790637429607960 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2 MD5: 9AEBA3BACD721484391D15478A4080C7)

RdrCEF.exe (PID: 3260 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=15500690304138507742 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=15500690304138507742 --renderer-client-id=4 --mojo-platform-channel-handle=1868 --allow-no-sandbox-job /prefetch:1 MD5: 9AEBA3BACD721484391D15478A4080C7)

RdrCEF.exe (PID: 6328 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4408287619177528861 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4408287619177528861 --renderer-client-id=5 --mojo-platform-channel-handle=1872 --allow-no-sandbox-job /prefetch:1 MD5: 9AEBA3BACD721484391D15478A4080C7)

RdrCEF.exe (PID: 6492 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4271642722203936314 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4271642722203936314 --renderer-client-id=6 --mojo-platform-channel-handle=2204 --allow-no-sandbox-job /prefetch:1 MD5: 9AEBA3BACD721484391D15478A4080C7)

iexplore.exe (PID: 1968 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' https://spark.adobe.com/page/GG8mUEsjQvSUh/ MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5624 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1968 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\GG8mUEsjQvSUh[1].htm	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\GG8mUEsjQvSUh[1].htm	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: https://spark.adobe.com/page/GG8mUEsjQvSUh/?page-mode=static	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://xinviaoafinabatizx.us-south.cf.appdomain.cloud/?bbre=zoxsazx	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://spark.adobe.com/page/GG8mUEsjQvSUh/	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Yara detected HtmlPhish29

Show sources

Source: Yara match	File source: 642294.0.links.csv, type: HTML
Source: Yara match	File source: 642294.2.links.csv, type: HTML
Source: Yara match	File source: 642294.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\GG8mUEsjQvSUh[1].htm, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\GG8mUEsjQvSUh[1].htm, type: DROPPED

Source: https://spark.adobe.com/page/GG8mUEsjQvSUh/	HTTP Parser: Title: Auric Partners does not match URL
Source: https://spark.adobe.com/page/GG8mUEsjQvSUh/	HTTP Parser: Title: Auric Partners does not match URL
Source: https://spark.adobe.com/page/GG8mUEsjQvSUh/	HTTP Parser: Title: Auric Partners does not match URL
Source: https://spark.adobe.com/page/GG8mUEsjQvSUh/	HTTP Parser: Title: Auric Partners does not match URL

Source: https://spark.adobe.com/page/GG8mUEsjQvSUh/	HTTP Parser: No <meta name="author".. found
Source: https://spark.adobe.com/page/GG8mUEsjQvSUh/	HTTP Parser: No <meta name="author".. found
Source: https://spark.adobe.com/page/GG8mUEsjQvSUh/	HTTP Parser: No <meta name="author".. found
Source: https://spark.adobe.com/page/GG8mUEsjQvSUh/	HTTP Parser: No <meta name="author".. found

Source: https://spark.adobe.com/page/GG8mUEsjQvSUh/	HTTP Parser: No <meta name="copyright".. found
Source: https://spark.adobe.com/page/GG8mUEsjQvSUh/	HTTP Parser: No <meta name="copyright".. found
Source: https://spark.adobe.com/page/GG8mUEsjQvSUh/	HTTP Parser: No <meta name="copyright".. found
Source: https://spark.adobe.com/page/GG8mUEsjQvSUh/	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Source: unknown	HTTPS traffic detected: 13.225.74.123:443 -> 192.168.2.3:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.74.123:443 -> 192.168.2.3:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.195.109:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.195.109:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.195.109:443 -> 192.168.2.3:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.195.109:443 -> 192.168.2.3:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.195.109:443 -> 192.168.2.3:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.105.77:443 -> 192.168.2.3:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.105.77:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.47.124.25:443 -> 192.168.2.3:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.47.124.25:443 -> 192.168.2.3:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.59:443 -> 192.168.2.3:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.59:443 -> 192.168.2.3:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.3:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.3:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.175:443 -> 192.168.2.3:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.175:443 -> 192.168.2.3:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.187.69:443 -> 192.168.2.3:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.187.69:443 -> 192.168.2.3:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.64:443 -> 192.168.2.3:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.64:443 -> 192.168.2.3:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.3:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.3:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 63.33.31.50:443 -> 192.168.2.3:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 63.33.31.50:443 -> 192.168.2.3:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.236.176.210:443 -> 192.168.2.3:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.236.176.210:443 -> 192.168.2.3:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.74.37:443 -> 192.168.2.3:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.74.37:443 -> 192.168.2.3:49783 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 169.47.124.25 169.47.124.25
Source: Joe Sandbox View	IP Address: 151.101.1.195 151.101.1.195
Source: Joe Sandbox View	IP Address: 151.101.1.195 151.101.1.195

Source: Joe Sandbox View	JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
Source: Joe Sandbox View	JA3 fingerprint: 3faf2df7ab96c36419c31725cb1fa7d6

Source: unsupported[1].htm.24.dr	String found in binary or memory: <a href="https://www.facebook.com/AdobeSpark" target="_blank" data-analytics-context="footer" data-type="facebook" equals www.facebook.com (Facebook)
Source: scripts[1].js0.24.dr	String found in binary or memory: if ($a.href.startsWith('https://www.facebook.')) { equals www.facebook.com (Facebook)
Source: scripts[1].js0.24.dr	String found in binary or memory: if ($a.href.startsWith('https://www.linkedin.com')) { equals www.linkedin.com (Linkedin)
Source: scripts[1].js0.24.dr	String found in binary or memory: if ($a.href.startsWith('https://www.youtube.com')) { equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: page.adobespark-assets.com

Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AcroRd32.exe, 00000002.00000002.373908461.0000000009350000.00000004.00000001.sdmp	String found in binary or memory: http://cipa.jp/exif/1.0/
Source: AcroRd32.exe, 00000002.00000002.373908461.0000000009350000.00000004.00000001.sdmp	String found in binary or memory: http://cipa.jp/exif/1.0/%
Source: AcroRd32.exe, 00000002.00000002.373908461.0000000009350000.00000004.00000001.sdmp	String found in binary or memory: http://cipa.jp/exif/1.0/(15)
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: m-web-77674361[1].js.24.dr	String found in binary or memory: http://feross.org
Source: chrome[1].js.24.dr	String found in binary or memory: http://github.com/janl/mustache.js
Source: AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/v
Source: AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/d
Source: publish.combined.fp-67aad4c89568b23c662905b8b4fd16bd[1].js.24.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chrome[1].js.24.dr	String found in binary or memory: http://mathiasbynens.be/demo/url-regex
Source: m-unsupported-88cd3215[1].js.24.dr	String found in binary or memory: http://medialize.github.io/URI.js/
Source: AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	String found in binary or memory: http://ns.a
Source: AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/K$F
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000000000ffd9
Source: vtg4qoo[1].js0.24.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000132df
Source: vtg4qoo[1].js0.24.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000132e1
Source: vtg4qoo[1].js0.24.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000132e3
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000158d3
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000158d4
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000158d6
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000158d7
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000158d8
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000158d9
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000000001705b
Source: vtg4qoo[1].js0.24.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000176ff
Source: vtg4qoo[1].js0.24.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017701
Source: vtg4qoo[1].js0.24.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017703
Source: vtg4qoo[1].js0.24.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017706
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017709
Source: pps7abe[1].css.24.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000003b9aee45
Source: pps7abe[1].css.24.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000003b9aee47
Source: onz5gap[1].js0.24.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000003b9b3068
Source: onz5gap[1].js0.24.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000003b9b3f83
Source: pps7abe[1].css.24.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000003b9b3f84
Source: onz5gap[1].js0.24.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000003b9b3f85
Source: pps7abe[1].css.24.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000003b9b3f86
Source: onz5gap[1].js0.24.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000003b9b3f88
Source: onz5gap[1].js0.24.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000003b9b3f8a
Source: pps7abe[1].css.24.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000003b9b3f8c
Source: marvelcommon-51100480[1].js.24.dr	String found in binary or memory: http://underscorejs.org/LICENSE
Source: AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/
Source: AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#
Source: AcroRd32.exe, 00000002.00000002.384083181.000000000B423000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#
Source: AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/schema#
Source: AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#
Source: AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfe/ns/id/
Source: AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfe/ns/id/F
Source: AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfe/ns/id/y
Source: scripts[1].js0.24.dr, marvelcommon-51100480[1].js.24.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: chrome[1].js.24.dr	String found in binary or memory: http://www.iport.it)
Source: AcroRd32.exe, 00000002.00000002.384083181.000000000B423000.00000004.00000001.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/
Source: AcroRd32.exe, 00000002.00000002.384083181.000000000B423000.00000004.00000001.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/D
Source: AcroRd32.exe, 00000002.00000002.384083181.000000000B423000.00000004.00000001.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/_
Source: m-unsupported-88cd3215[1].js.24.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license
Source: marvelcommon-51100480[1].js.24.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.html
Source: AcroRd32.exe, 00000002.00000002.366941342.0000000007B70000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default
Source: AcroRd32.exe, 00000002.00000002.366941342.0000000007B70000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/drm/default
Source: AcroRd32.exe, 00000002.00000002.366941342.0000000007B70000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/elementId%http://www.osmf.org/temporal/embedded$http://www.osmf.org/temporal/dyn
Source: AcroRd32.exe, 00000002.00000002.366941342.0000000007B70000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/layout/anchor
Source: AcroRd32.exe, 00000002.00000002.366941342.0000000007B70000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/layout/padding%http://www.osmf.org/layout/attributes
Source: AcroRd32.exe, 00000002.00000002.366941342.0000000007B70000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/region/target#http://www.osmf.org/layout/renderer#http://www.osmf.org/layout/abs
Source: AcroRd32.exe, 00000002.00000002.366941342.0000000007B70000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/subclip/1.0
Source: AcroRd32.exe, 00000002.00000002.366941342.0000000007B70000.00000002.00000001.sdmp	String found in binary or memory: http://www.quicktime.com.Acrobat
Source: AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	String found in binary or memory: https://.OKCancelEdit
Source: AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/
Source: AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/TY
Source: AcroRd32.exe, 00000002.00000002.384922126.000000000B633000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/
Source: AcroRd32.exe, 00000002.00000002.384922126.000000000B633000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/4
Source: AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/pY
Source: AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/y
Source: AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/yY
Source: RC881683c91a4d4caaa3e05264c5d96242-file.min[1].js.24.dr	String found in binary or memory: https://ade0164.d41.co/sync/
Source: {135EBDC5-CADC-11EB-90E4-ECF4BB862DED}.dat.23.dr	String found in binary or memory: https://adobe.demdex.net/dest5.html?d_nsid=0
Source: unsupported[1].htm.24.dr	String found in binary or memory: https://adobespark.uservoice.com
Source: en-US_bundle-6a358124[1].js.24.dr	String found in binary or memory: https://adobespark.zendesk.com/hc/en-us/articles/218956027
Source: en-US_bundle-6a358124[1].js.24.dr	String found in binary or memory: https://adobespark.zendesk.com/hc/en-us/articles/219243657
Source: en-US_bundle-6a358124[1].js.24.dr	String found in binary or memory: https://adobespark.zendesk.com/hc/en-us/articles/219243657-Can-students-use-Adobe-Spark-
Source: login[2].htm.24.dr, unsupported[1].htm.24.dr	String found in binary or memory: https://adobespark.zendesk.com/hc/en-us/categories/202688167-Adobe-Spark
Source: unsupported[1].htm.24.dr	String found in binary or memory: https://adobespark.zendesk.com/hc/en-us/requests/new
Source: resume[1].htm.24.dr	String found in binary or memory: https://adobesparkpost.app.link/8n80l2HauZ
Source: invoice[1].htm.24.dr	String found in binary or memory: https://adobesparkpost.app.link/Wm9lz3B4tZ
Source: logo[1].htm.24.dr	String found in binary or memory: https://adobesparkpost.app.link/g8sk4xb8AV
Source: express[1].htm.24.dr	String found in binary or memory: https://adobesparkpost.app.link/jsoIbkwCVeb
Source: express[1].htm.24.dr	String found in binary or memory: https://adobesparkpost.app.link/nfQW2NoCVeb
Source: AcroRd32.exe, 00000002.00000002.387234083.000000000D30C000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.com
Source: AcroRd32.exe, 00000002.00000002.387234083.000000000D30C000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.com3252:1m
Source: AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.comRL
Source: express[1].htm.24.dr	String found in binary or memory: https://apps.apple.com/us/app/adobe-spark-post-create-stunning/id1051937863
Source: login[2].htm.24.dr	String found in binary or memory: https://assets.adobedtm.com
Source: RC036830be72f242959c7b9ca66cef0c85-file.min[1].js.24.dr	String found in binary or memory: https://assets.adobedtm.com/d4d114c60e50/f3fbfbe0e7ca/f496fb7b47d7/RC036830be72f242959c7b9ca66cef0c8
Source: RC5e5d1b9fe0a942c38190dc2199529941-file.min[1].js.24.dr	String found in binary or memory: https://assets.adobedtm.com/d4d114c60e50/f3fbfbe0e7ca/f496fb7b47d7/RC5e5d1b9fe0a942c38190dc219952994
Source: RC6f46e43fa6d44dbeb45cc5801ffded0e-file.min[1].js.24.dr	String found in binary or memory: https://assets.adobedtm.com/d4d114c60e50/f3fbfbe0e7ca/f496fb7b47d7/RC6f46e43fa6d44dbeb45cc5801ffded0
Source: RC881683c91a4d4caaa3e05264c5d96242-file.min[1].js.24.dr	String found in binary or memory: https://assets.adobedtm.com/d4d114c60e50/f3fbfbe0e7ca/f496fb7b47d7/RC881683c91a4d4caaa3e05264c5d9624
Source: RC89c6d3bd15f043db95a5a0a4b5cc9da0-file.min[1].js.24.dr	String found in binary or memory: https://assets.adobedtm.com/d4d114c60e50/f3fbfbe0e7ca/f496fb7b47d7/RC89c6d3bd15f043db95a5a0a4b5cc9da
Source: RCa8534599c5d1425b9b1fceaf046699bf-source.min[1].js.24.dr	String found in binary or memory: https://assets.adobedtm.com/d4d114c60e50/f3fbfbe0e7ca/f496fb7b47d7/RCa8534599c5d1425b9b1fceaf046699b
Source: RCbb47518ad08d43699044c6ef46f39ebb-file.min[1].js.24.dr	String found in binary or memory: https://assets.adobedtm.com/d4d114c60e50/f3fbfbe0e7ca/f496fb7b47d7/RCbb47518ad08d43699044c6ef46f39eb
Source: launch-EN919758db9a654a17bac7d184b99c4820.min[1].js.24.dr	String found in binary or memory: https://assets.adobedtm.com/launch-EN919758db9a654a17bac7d184b99c4820.js
Source: scripts[1].js0.24.dr	String found in binary or memory: https://blog.adobespark.com/
Source: login[2].htm.24.dr	String found in binary or memory: https://cdn.cookielaw.org
Source: 7a5eb705-95ed-4cc4-a11d-0cc5760e93db[1].js.24.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/googleData.json
Source: 7a5eb705-95ed-4cc4-a11d-0cc5760e93db[1].js.24.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iab2Data.json
Source: 7a5eb705-95ed-4cc4-a11d-0cc5760e93db[1].js.24.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iabData.json
Source: en[1].js.24.dr	String found in binary or memory: https://developer.akamai.com/tools/boomerang#mpulse-session-information
Source: headIE.fp-f9e44dbeef5252f4d02c4ed9c4b6a618[1].js.24.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/NodeList/forEach
Source: publish.combined.fp-67aad4c89568b23c662905b8b4fd16bd[1].js.24.dr	String found in binary or memory: https://fb.me/react-polyfills
Source: m-unsupported-88cd3215[1].js.24.dr	String found in binary or memory: https://feross.org
Source: m-unsupported-88cd3215[1].js.24.dr	String found in binary or memory: https://feross.org/opensource
Source: 7a5eb705-95ed-4cc4-a11d-0cc5760e93db[1].js.24.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: head.fp-00a38324dab316803fdc74cba4ad7ab9[1].js.24.dr	String found in binary or memory: https://github.com/focus-trap/focus-trap/blob/master/LICENSE
Source: head.fp-00a38324dab316803fdc74cba4ad7ab9[1].js.24.dr	String found in binary or memory: https://github.com/focus-trap/tabbable/blob/master/LICENSE
Source: chrome[1].js.24.dr	String found in binary or memory: https://github.com/janl/mustache.js/issues/186
Source: chrome[1].js.24.dr	String found in binary or memory: https://github.com/janl/mustache.js/issues/189
Source: chrome[1].js.24.dr	String found in binary or memory: https://github.com/janl/mustache.js/issues/244
Source: marvelcommon-51100480[1].js.24.dr	String found in binary or memory: https://github.com/kriskowal/q/blob/v1/LICENSE
Source: AcroRd32.exe, 00000002.00000002.373908461.0000000009350000.00000004.00000001.sdmp	String found in binary or memory: https://ims-na1.adobelogin.com
Source: chrome[1].js.24.dr	String found in binary or memory: https://issues.apache.org/jira/browse/COUCHDB-577
Source: marvelcommon-51100480[1].js.24.dr	String found in binary or memory: https://lodash.com/
Source: marvelcommon-51100480[1].js.24.dr	String found in binary or memory: https://lodash.com/license
Source: marvelcommon-51100480[1].js.24.dr	String found in binary or memory: https://npms.io/search?q=ponyfill.
Source: marvelcommon-51100480[1].js.24.dr	String found in binary or memory: https://openjsf.org/
Source: en-US_bundle-6a358124[1].js.24.dr	String found in binary or memory: https://opsparc.gsfc.nasa.gov/?sdid=MC95SNMJ&mv=social
Source: rbi5aua[1].js1.24.dr, vtg4qoo[1].js0.24.dr, onz5gap[1].js0.24.dr	String found in binary or memory: https://p.typekit.net/p.gif
Source: RCbb47518ad08d43699044c6ef46f39ebb-file.min[1].js.24.dr	String found in binary or memory: https://p13n-stage.adobe.io/psdk/v2/content
Source: RCbb47518ad08d43699044c6ef46f39ebb-file.min[1].js.24.dr	String found in binary or memory: https://p13n.adobe.io/psdk/v2/content
Source: GG8mUEsjQvSUh[1].htm0.24.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/base-fonts.gz.js
Source: GG8mUEsjQvSUh[1].htm0.24.dr, imagestore.dat.24.dr, ~DF8227BB7BB94304CB.TMP.23.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/images/favicon.ico
Source: GG8mUEsjQvSUh[1].htm0.24.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/noscript.gz.css
Source: GG8mUEsjQvSUh[1].htm0.24.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/runtime-prod.gz.js
Source: GG8mUEsjQvSUh[1].htm0.24.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/runtime.gz.css
Source: GG8mUEsjQvSUh[1].htm0.24.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/themes/crisp-fonts.gz.js
Source: GG8mUEsjQvSUh[1].htm0.24.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/typekit-load.gz.js
Source: publish.combined.fp-67aad4c89568b23c662905b8b4fd16bd[1].js.24.dr	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: login[2].htm.24.dr	String found in binary or memory: https://static.adobelogin.com/imslib/imslib.min.js
Source: privacy[1].htm0.24.dr	String found in binary or memory: https://static.adobelogin.com/imslib/imslib.min.js
Source: unsupported[1].htm.24.dr	String found in binary or memory: https://support.apple.com/downloads/safari
Source: scripts[1].js0.24.dr	String found in binary or memory: https://twitter.com
Source: unsupported[1].htm.24.dr	String found in binary or memory: https://twitter.com/AdobeSpark
Source: onz5gap[1].js0.24.dr	String found in binary or memory: https://use.typekit.net/af/180c9d/00000000000000003b9b3f8a/27/
Source: vtg4qoo[1].js0.24.dr	String found in binary or memory: https://use.typekit.net/af/1da05b/0000000000000000000132df/27/
Source: onz5gap[1].js0.24.dr	String found in binary or memory: https://use.typekit.net/af/37eaae/00000000000000003b9b3f83/27/
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/37eaae/00000000000000003b9b3f83/27/a?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/37eaae/00000000000000003b9b3f83/27/d?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/37eaae/00000000000000003b9b3f83/27/l?primer=388f68b35a7cbf1ee3543172445c2
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: https://use.typekit.net/af/3d913c/000000000000000000017709/26/
Source: vtg4qoo[1].js0.24.dr	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/
Source: vtg4qoo[1].js0.24.dr	String found in binary or memory: https://use.typekit.net/af/4b3e87/000000000000000000017706/27/
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: https://use.typekit.net/af/6c57c4/0000000000000000000158d6/26/
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: https://use.typekit.net/af/74fc30/0000000000000000000158d4/26/
Source: vtg4qoo[1].js0.24.dr	String found in binary or memory: https://use.typekit.net/af/8f4e31/0000000000000000000132e3/27/
Source: onz5gap[1].js0.24.dr	String found in binary or memory: https://use.typekit.net/af/949f99/00000000000000003b9b3068/27/
Source: onz5gap[1].js0.24.dr	String found in binary or memory: https://use.typekit.net/af/97fbd1/00000000000000003b9b3f88/27/
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/97fbd1/00000000000000003b9b3f88/27/a?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/97fbd1/00000000000000003b9b3f88/27/d?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/97fbd1/00000000000000003b9b3f88/27/l?primer=388f68b35a7cbf1ee3543172445c2
Source: scripts[1].js0.24.dr	String found in binary or memory: https://use.typekit.net/af/97fbd1/00000000000000003b9b3f88/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: https://use.typekit.net/af/9951d2/0000000000000000000158d7/26/
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: https://use.typekit.net/af/9d1933/00000000000000000001705b/26/
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/a0c22f/00000000000000003b9b3f84/27/a?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/a0c22f/00000000000000003b9b3f84/27/d?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/a0c22f/00000000000000003b9b3f84/27/l?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/aa41d0/00000000000000003b9b3f86/27/a?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/aa41d0/00000000000000003b9b3f86/27/d?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/aa41d0/00000000000000003b9b3f86/27/l?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/ad2a79/00000000000000003b9b3f8c/27/a?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/ad2a79/00000000000000003b9b3f8c/27/d?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/ad2a79/00000000000000003b9b3f8c/27/l?primer=388f68b35a7cbf1ee3543172445c2
Source: scripts[1].js0.24.dr	String found in binary or memory: https://use.typekit.net/af/ad2a79/00000000000000003b9b3f8c/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: onz5gap[1].js0.24.dr	String found in binary or memory: https://use.typekit.net/af/b0c5f5/00000000000000003b9b3f85/27/
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/b0c5f5/00000000000000003b9b3f85/27/a?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/b0c5f5/00000000000000003b9b3f85/27/d?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/b0c5f5/00000000000000003b9b3f85/27/l?primer=388f68b35a7cbf1ee3543172445c2
Source: scripts[1].js0.24.dr	String found in binary or memory: https://use.typekit.net/af/b0c5f5/00000000000000003b9b3f85/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/c8f445/00000000000000003b9aee47/27/a?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/c8f445/00000000000000003b9aee47/27/d?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/c8f445/00000000000000003b9aee47/27/l?primer=388f68b35a7cbf1ee3543172445c2
Source: vtg4qoo[1].js0.24.dr	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: https://use.typekit.net/af/d5d9b2/00000000000000000000ffd9/26/
Source: vtg4qoo[1].js0.24.dr	String found in binary or memory: https://use.typekit.net/af/d8f71f/0000000000000000000132e1/27/
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: https://use.typekit.net/af/e030d3/0000000000000000000158d3/26/
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/e09494/00000000000000003b9aee45/27/a?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/e09494/00000000000000003b9aee45/27/d?primer=388f68b35a7cbf1ee3543172445c2
Source: pps7abe[1].css.24.dr	String found in binary or memory: https://use.typekit.net/af/e09494/00000000000000003b9aee45/27/l?primer=388f68b35a7cbf1ee3543172445c2
Source: vtg4qoo[1].js0.24.dr	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: https://use.typekit.net/af/edcf1e/0000000000000000000158d9/26/
Source: rbi5aua[1].js1.24.dr	String found in binary or memory: https://use.typekit.net/af/fe9c8e/0000000000000000000158d8/26/
Source: privacy[1].htm0.24.dr	String found in binary or memory: https://use.typekit.net/pps7abe.css
Source: login[2].htm.24.dr	String found in binary or memory: https://use.typekit.net/vtg4qoo.css
Source: unsupported[1].htm.24.dr	String found in binary or memory: https://use.typekit.net/vtg4qoo.js
Source: {135EBDC5-CADC-11EB-90E4-ECF4BB862DED}.dat.23.dr	String found in binary or memory: https://www.adobebe.com/page/GG8mUEsjQvSUh/
Source: AcroRd32.exe, 00000002.00000002.373401937.0000000008A2D000.00000002.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: scripts[1].js0.24.dr	String found in binary or memory: https://www.facebook.
Source: unsupported[1].htm.24.dr	String found in binary or memory: https://www.google.com/chrome/browser/desktop/index.html
Source: chrome[1].js.24.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?
Source: scripts[1].js0.24.dr	String found in binary or memory: https://www.instagram.com
Source: unsupported[1].htm.24.dr	String found in binary or memory: https://www.instagram.com/AdobeSpark
Source: scripts[1].js0.24.dr	String found in binary or memory: https://www.linkedin.com
Source: unsupported[1].htm.24.dr	String found in binary or memory: https://www.mozilla.org/firefox
Source: scripts[1].js0.24.dr	String found in binary or memory: https://www.pinterest.
Source: scripts[1].js0.24.dr	String found in binary or memory: https://www.youtube.com
Source: {135EBDC5-CADC-11EB-90E4-ECF4BB862DED}.dat.23.dr	String found in binary or memory: https://xinviaoafinabatizx.us-south.cf.appdomain.cloud
Source: ~DF8227BB7BB94304CB.TMP.23.dr	String found in binary or memory: https://xinviaoafinabatizx.us-south.cf.appdomain.cloud/?bbre=zoxsazx

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 13.225.74.123:443 -> 192.168.2.3:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.74.123:443 -> 192.168.2.3:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.195.109:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.195.109:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.195.109:443 -> 192.168.2.3:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.195.109:443 -> 192.168.2.3:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.195.109:443 -> 192.168.2.3:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.105.77:443 -> 192.168.2.3:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.105.77:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.47.124.25:443 -> 192.168.2.3:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.47.124.25:443 -> 192.168.2.3:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.59:443 -> 192.168.2.3:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.145.59:443 -> 192.168.2.3:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.3:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.3:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.175:443 -> 192.168.2.3:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.175:443 -> 192.168.2.3:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.187.69:443 -> 192.168.2.3:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.187.69:443 -> 192.168.2.3:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.64:443 -> 192.168.2.3:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.64:443 -> 192.168.2.3:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.3:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.3:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 63.33.31.50:443 -> 192.168.2.3:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 63.33.31.50:443 -> 192.168.2.3:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.236.176.210:443 -> 192.168.2.3:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.236.176.210:443 -> 192.168.2.3:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.74.37:443 -> 192.168.2.3:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.74.37:443 -> 192.168.2.3:49783 version: TLS 1.2

System Summary:

Found potential malicious PDF (bad image similarity)

Show sources

Source: Tribeca Investment Partners - Funds.pdf

Static PDF information: Image stream: 12

Source: classification engine

Classification label: mal64.phis.winPDF@19/308@15/15

Source: Tribeca Investment Partners - Funds.pdf	Initial sample: https://spark.adobe.com/page/GG8mUEsjQvSUh/
Source: Tribeca Investment Partners - Funds.pdf	Initial sample: https://spark.adobe.com/page/gg8muesjqvsuh/

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\A9Rmzh6rb_163jmjl_4lk.tmp

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File opened: C:\Windows\SysWOW64\Msftedit.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Source: Tribeca Investment Partners - Funds.pdf	Initial sample: PDF keyword /JS count = 0
Source: Tribeca Investment Partners - Funds.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Tribeca Investment Partners - Funds.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Tribeca Investment Partners - Funds.pdf

Initial sample: PDF keyword obj count = 124

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: Contact_72px_lt-gray[1].svg.24.dr	Binary or memory string: NEIBESjjzwKWaQEmuhbGgACFWDKdB5OZZSX+agjjkcZegD1y0h+ELA7oCf9h2TzH5Lk87RNpJWUz
Source: AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllm
Source: LawEnforcement_72px_lt-gray[1].svg.24.dr	Binary or memory string: 4RfwbOThACGyTEZ5moRPrV2QweL6BvvMQAZIZXEdT2O5NEPgUsRJGSwFUuYlgyhgfSp3NY2hgKUv
Source: Policies_72px_lt-gray[1].svg.24.dr	Binary or memory string: 4tB1EVplopO2rztHQjrQqeMUbUqdlUYbWkVkAS0rzSFGk5qfcFFaK8X2oKw7N1FayNdH7BQ+Tst9

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Code function: 2_2_04F1D1D0 LdrInitializeThunk,

Source: AcroRd32.exe, 00000002.00000002.365683252.0000000005860000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: AcroRd32.exe, 00000002.00000002.365683252.0000000005860000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: AcroRd32.exe, 00000002.00000002.365683252.0000000005860000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: AcroRd32.exe, 00000002.00000002.365683252.0000000005860000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Spearphishing Link1	Windows Management Instrumentation	Path Interception	Process Injection2	Masquerading1	OS Credential Dumping	Security Software Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection2	LSASS Memory	Process Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	File and Directory Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Tribeca Investment Partners - Funds.pdf	0%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://spark.adobe.com/page/GG8mUEsjQvSUh/?page-mode=static	100%	SlashNext	Fake Login Page type: Phishing & Social Engineering
https://xinviaoafinabatizx.us-south.cf.appdomain.cloud/?bbre=zoxsazx	100%	SlashNext	Fake Login Page type: Phishing & Social Engineering
https://spark.adobe.com/page/GG8mUEsjQvSUh/	100%	SlashNext	Fake Login Page type: Phishing & Social Engineering
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/TY	0%	Avira URL Cloud	safe
https://page.adobespark-assets.com/runtime/1.22/typekit-load.gz.js	0%	URL Reputation	safe
https://page.adobespark-assets.com/runtime/1.22/typekit-load.gz.js	0%	URL Reputation	safe
https://page.adobespark-assets.com/runtime/1.22/typekit-load.gz.js	0%	URL Reputation	safe
http://www.osmf.org/drm/default	0%	URL Reputation	safe
http://www.osmf.org/drm/default	0%	URL Reputation	safe
http://www.osmf.org/drm/default	0%	URL Reputation	safe
https://openjsf.org/	0%	URL Reputation	safe
https://openjsf.org/	0%	URL Reputation	safe
https://openjsf.org/	0%	URL Reputation	safe
https://ade0164.d41.co/sync/	0%	URL Reputation	safe
https://ade0164.d41.co/sync/	0%	URL Reputation	safe
https://ade0164.d41.co/sync/	0%	URL Reputation	safe
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/	0%	URL Reputation	safe
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/	0%	URL Reputation	safe
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/	0%	URL Reputation	safe
http://cipa.jp/exif/1.0/(15)	0%	URL Reputation	safe
http://cipa.jp/exif/1.0/(15)	0%	URL Reputation	safe
http://cipa.jp/exif/1.0/(15)	0%	URL Reputation	safe
http://cipa.jp/exif/1.0/	0%	URL Reputation	safe
http://cipa.jp/exif/1.0/	0%	URL Reputation	safe
http://cipa.jp/exif/1.0/	0%	URL Reputation	safe
http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default	0%	URL Reputation	safe
http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default	0%	URL Reputation	safe
http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default	0%	URL Reputation	safe
https://www.adobebe.com/page/GG8mUEsjQvSUh/	0%	Avira URL Cloud	safe
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/yY	0%	Avira URL Cloud	safe
https://page.adobespark-assets.com/runtime/1.22/images/favicon.ico	0%	URL Reputation	safe
https://page.adobespark-assets.com/runtime/1.22/images/favicon.ico	0%	URL Reputation	safe
https://page.adobespark-assets.com/runtime/1.22/images/favicon.ico	0%	URL Reputation	safe
http://www.iport.it)	0%	Avira URL Cloud	safe
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/	0%	Avira URL Cloud	safe
https://page.adobespark-assets.com/runtime/1.22/runtime-prod.gz.js	0%	URL Reputation	safe
https://page.adobespark-assets.com/runtime/1.22/runtime-prod.gz.js	0%	URL Reputation	safe
https://page.adobespark-assets.com/runtime/1.22/runtime-prod.gz.js	0%	URL Reputation	safe
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/v	0%	Avira URL Cloud	safe
http://iptc.org/std/Iptc4xmpExt/2008-02-29/	0%	URL Reputation	safe
http://iptc.org/std/Iptc4xmpExt/2008-02-29/	0%	URL Reputation	safe
http://iptc.org/std/Iptc4xmpExt/2008-02-29/	0%	URL Reputation	safe
http://medialize.github.io/URI.js/	0%	Avira URL Cloud	safe
http://www.osmf.org/layout/padding%http://www.osmf.org/layout/attributes	0%	URL Reputation	safe
http://www.osmf.org/layout/padding%http://www.osmf.org/layout/attributes	0%	URL Reputation	safe
http://www.osmf.org/layout/padding%http://www.osmf.org/layout/attributes	0%	URL Reputation	safe
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/y	0%	Avira URL Cloud	safe
http://www.quicktime.com.Acrobat	0%	URL Reputation	safe
http://www.quicktime.com.Acrobat	0%	URL Reputation	safe
http://www.quicktime.com.Acrobat	0%	URL Reputation	safe
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/4	0%	Avira URL Cloud	safe
https://page.adobespark-assets.com/runtime/1.22/noscript.gz.css	0%	URL Reputation	safe
https://page.adobespark-assets.com/runtime/1.22/noscript.gz.css	0%	URL Reputation	safe
https://page.adobespark-assets.com/runtime/1.22/noscript.gz.css	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dd20fzx9mj46f.cloudfront.net	13.224.187.69	true	false	high
dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com	63.33.31.50	true	false	high
rikapcndbn.web.app	151.101.1.195	true	false	unknown
xinviaoafinabatizx.us-south.cf.appdomain.cloud	169.47.124.25	true	false	unknown
kifot.wancdnapp.page	172.67.145.59	true	false	unknown
spark.adobeprojectm.com	13.225.74.22	true	false	unknown
s3.amazonaws.com	52.216.105.77	true	false	high
adobe.com.ssl.d1.sc.omtrdc.net	15.236.176.210	true	false	unknown
api.demandbase.com	13.225.74.37	true	false	high
unpkg.com	104.16.123.175	true	false	high
page.adobespark-assets.com	13.224.195.109	true	false	unknown
cdn.cookielaw.org	104.16.148.64	true	false	high
geolocation.onetrust.com	104.20.184.68	true	false	high
use.typekit.net	unknown	unknown	false	high
assets.adobedtm.com	unknown	unknown	false	high
p.typekit.net	unknown	unknown	false	high
dpm.demdex.net	unknown	unknown	false	high
static.adobelogin.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/TY	AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://www.linkedin.com	scripts[1].js0.24.dr	false		high
https://assets.adobedtm.com/d4d114c60e50/f3fbfbe0e7ca/f496fb7b47d7/RC881683c91a4d4caaa3e05264c5d9624	RC881683c91a4d4caaa3e05264c5d96242-file.min[1].js.24.dr	false		high
https://page.adobespark-assets.com/runtime/1.22/typekit-load.gz.js	GG8mUEsjQvSUh[1].htm0.24.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://assets.adobedtm.com	login[2].htm.24.dr	false		high
https://www.youtube.com	scripts[1].js0.24.dr	false		high
https://static.adobelogin.com/imslib/imslib.min.js	privacy[1].htm0.24.dr	false		high
https://www.instagram.com	scripts[1].js0.24.dr	false		high
https://use.typekit.net/af/c8f445/00000000000000003b9aee47/27/d?primer=388f68b35a7cbf1ee3543172445c2	pps7abe[1].css.24.dr	false		high
https://use.typekit.net/af/8f4e31/0000000000000000000132e3/27/	vtg4qoo[1].js0.24.dr	false		high
http://www.osmf.org/drm/default	AcroRd32.exe, 00000002.00000002.366941342.0000000007B70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://use.typekit.net/af/e09494/00000000000000003b9aee45/27/l?primer=388f68b35a7cbf1ee3543172445c2	pps7abe[1].css.24.dr	false		high
https://use.typekit.net/af/b0c5f5/00000000000000003b9b3f85/27/d?primer=388f68b35a7cbf1ee3543172445c2	pps7abe[1].css.24.dr	false		high
https://openjsf.org/	marvelcommon-51100480[1].js.24.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://use.typekit.net/af/3d913c/000000000000000000017709/26/	rbi5aua[1].js1.24.dr	false		high
https://ade0164.d41.co/sync/	RC881683c91a4d4caaa3e05264c5d96242-file.min[1].js.24.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://adobespark.uservoice.com	unsupported[1].htm.24.dr	false		high
https://developer.akamai.com/tools/boomerang#mpulse-session-information	en[1].js.24.dr	false		high
https://use.typekit.net/af/c8f445/00000000000000003b9aee47/27/a?primer=388f68b35a7cbf1ee3543172445c2	pps7abe[1].css.24.dr	false		high
https://use.typekit.net/af/e09494/00000000000000003b9aee45/27/a?primer=388f68b35a7cbf1ee3543172445c2	pps7abe[1].css.24.dr	false		high
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/	AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://use.typekit.net/af/edcf1e/0000000000000000000158d9/26/	rbi5aua[1].js1.24.dr	false		high
http://cipa.jp/exif/1.0/(15)	AcroRd32.exe, 00000002.00000002.373908461.0000000009350000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://use.typekit.net/af/37eaae/00000000000000003b9b3f83/27/d?primer=388f68b35a7cbf1ee3543172445c2	pps7abe[1].css.24.dr	false		high
https://github.com/kriskowal/q/blob/v1/LICENSE	marvelcommon-51100480[1].js.24.dr	false		high
http://underscorejs.org/LICENSE	marvelcommon-51100480[1].js.24.dr	false		high
https://assets.adobedtm.com/d4d114c60e50/f3fbfbe0e7ca/f496fb7b47d7/RC89c6d3bd15f043db95a5a0a4b5cc9da	RC89c6d3bd15f043db95a5a0a4b5cc9da0-file.min[1].js.24.dr	false		high
https://adobespark.zendesk.com/hc/en-us/articles/219243657	en-US_bundle-6a358124[1].js.24.dr	false		high
https://ims-na1.adobelogin.com	AcroRd32.exe, 00000002.00000002.373908461.0000000009350000.00000004.00000001.sdmp	false		high
https://use.typekit.net/vtg4qoo.css	login[2].htm.24.dr	false		high
https://adobesparkpost.app.link/nfQW2NoCVeb	express[1].htm.24.dr	false		high
https://use.typekit.net/af/9951d2/0000000000000000000158d7/26/	rbi5aua[1].js1.24.dr	false		high
https://adobespark.zendesk.com/hc/en-us/articles/218956027	en-US_bundle-6a358124[1].js.24.dr	false		high
https://npms.io/search?q=ponyfill.	marvelcommon-51100480[1].js.24.dr	false		high
https://assets.adobedtm.com/d4d114c60e50/f3fbfbe0e7ca/f496fb7b47d7/RC5e5d1b9fe0a942c38190dc219952994	RC5e5d1b9fe0a942c38190dc2199529941-file.min[1].js.24.dr	false		high
https://use.typekit.net/af/b0c5f5/00000000000000003b9b3f85/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8	scripts[1].js0.24.dr	false		high
https://use.typekit.net/af/9d1933/00000000000000000001705b/26/	rbi5aua[1].js1.24.dr	false		high
https://cdn.cookielaw.org	login[2].htm.24.dr	false		high
http://www.aiim.org/pdfa/ns/schema#	AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	false		high
http://cipa.jp/exif/1.0/	AcroRd32.exe, 00000002.00000002.373908461.0000000009350000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default	AcroRd32.exe, 00000002.00000002.366941342.0000000007B70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.adobebe.com/page/GG8mUEsjQvSUh/	{135EBDC5-CADC-11EB-90E4-ECF4BB862DED}.dat.23.dr	false	Avira URL Cloud: safe	unknown
https://use.typekit.net/af/97fbd1/00000000000000003b9b3f88/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8	scripts[1].js0.24.dr	false		high
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/yY	AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://page.adobespark-assets.com/runtime/1.22/images/favicon.ico	GG8mUEsjQvSUh[1].htm0.24.dr, imagestore.dat.24.dr, ~DF8227BB7BB94304CB.TMP.23.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.iport.it)	chrome[1].js.24.dr	false	Avira URL Cloud: safe	low
http://www.opensource.org/licenses/mit-license.html	marvelcommon-51100480[1].js.24.dr	false		high
https://cdn.cookielaw.org/vendorlist/googleData.json	7a5eb705-95ed-4cc4-a11d-0cc5760e93db[1].js.24.dr	false		high
https://use.typekit.net/af/180c9d/00000000000000003b9b3f8a/27/	onz5gap[1].js0.24.dr	false		high
http://www.opensource.org/licenses/mit-license	m-unsupported-88cd3215[1].js.24.dr	false		high
http://typekit.com/eulas/00000000000000003b9b3f8a	onz5gap[1].js0.24.dr	false		high
http://typekit.com/eulas/00000000000000003b9b3f8c	pps7abe[1].css.24.dr	false		high
http://typekit.com/eulas/0000000000000000000176ff	vtg4qoo[1].js0.24.dr	false		high
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/	AcroRd32.exe, 00000002.00000002.384922126.000000000B633000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://adobesparkpost.app.link/jsoIbkwCVeb	express[1].htm.24.dr	false		high
https://cdn.cookielaw.org/vendorlist/iab2Data.json	7a5eb705-95ed-4cc4-a11d-0cc5760e93db[1].js.24.dr	false		high
https://use.typekit.net/af/74fc30/0000000000000000000158d4/26/	rbi5aua[1].js1.24.dr	false		high
https://page.adobespark-assets.com/runtime/1.22/runtime-prod.gz.js	GG8mUEsjQvSUh[1].htm0.24.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.aiim.org/pdfa/ns/extension/	AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	false		high
https://use.typekit.net/af/c8f445/00000000000000003b9aee47/27/l?primer=388f68b35a7cbf1ee3543172445c2	pps7abe[1].css.24.dr	false		high
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/v	AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://use.typekit.net/af/d5d9b2/00000000000000000000ffd9/26/	rbi5aua[1].js1.24.dr	false		high
https://twitter.com/AdobeSpark	unsupported[1].htm.24.dr	false		high
https://use.typekit.net/af/ad2a79/00000000000000003b9b3f8c/27/l?primer=388f68b35a7cbf1ee3543172445c2	pps7abe[1].css.24.dr	false		high
http://iptc.org/std/Iptc4xmpExt/2008-02-29/	AcroRd32.exe, 00000002.00000002.384245575.000000000B4DA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/	vtg4qoo[1].js0.24.dr	false		high
https://reactjs.org/docs/error-decoder.html?invariant=	publish.combined.fp-67aad4c89568b23c662905b8b4fd16bd[1].js.24.dr	false		high
https://adobesparkpost.app.link/g8sk4xb8AV	logo[1].htm.24.dr	false		high
http://typekit.com/eulas/0000000000000000000158d4	rbi5aua[1].js1.24.dr	false		high
http://typekit.com/eulas/0000000000000000000158d3	rbi5aua[1].js1.24.dr	false		high
http://www.aiim.org/pdfe/ns/id/	AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	false		high
http://mathiasbynens.be/demo/url-regex	chrome[1].js.24.dr	false		high
https://use.typekit.net/af/37eaae/00000000000000003b9b3f83/27/l?primer=388f68b35a7cbf1ee3543172445c2	pps7abe[1].css.24.dr	false		high
https://use.typekit.net/pps7abe.css	privacy[1].htm0.24.dr	false		high
http://typekit.com/eulas/0000000000000000000158d9	rbi5aua[1].js1.24.dr	false		high
http://typekit.com/eulas/0000000000000000000158d8	rbi5aua[1].js1.24.dr	false		high
https://use.typekit.net/af/fe9c8e/0000000000000000000158d8/26/	rbi5aua[1].js1.24.dr	false		high
http://typekit.com/eulas/0000000000000000000158d7	rbi5aua[1].js1.24.dr	false		high
http://typekit.com/eulas/0000000000000000000158d6	rbi5aua[1].js1.24.dr	false		high
https://adobesparkpost.app.link/Wm9lz3B4tZ	invoice[1].htm.24.dr	false		high
http://medialize.github.io/URI.js/	m-unsupported-88cd3215[1].js.24.dr	false	Avira URL Cloud: safe	unknown
https://github.com/janl/mustache.js/issues/244	chrome[1].js.24.dr	false		high
https://use.typekit.net/af/b0c5f5/00000000000000003b9b3f85/27/a?primer=388f68b35a7cbf1ee3543172445c2	pps7abe[1].css.24.dr	false		high
http://www.osmf.org/layout/padding%http://www.osmf.org/layout/attributes	AcroRd32.exe, 00000002.00000002.366941342.0000000007B70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://github.com/janl/mustache.js	chrome[1].js.24.dr	false		high
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/y	AcroRd32.exe, 00000002.00000002.387053876.000000000D211000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://developer.mozilla.org/en-US/docs/Web/API/NodeList/forEach	headIE.fp-f9e44dbeef5252f4d02c4ed9c4b6a618[1].js.24.dr	false		high
http://www.quicktime.com.Acrobat	AcroRd32.exe, 00000002.00000002.366941342.0000000007B70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/4	AcroRd32.exe, 00000002.00000002.384922126.000000000B633000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://typekit.com/eulas/00000000000000003b9b3f83	onz5gap[1].js0.24.dr	false		high
http://typekit.com/eulas/00000000000000003b9b3f84	pps7abe[1].css.24.dr	false		high
http://typekit.com/eulas/00000000000000003b9b3f85	onz5gap[1].js0.24.dr	false		high
https://use.typekit.net/af/e030d3/0000000000000000000158d3/26/	rbi5aua[1].js1.24.dr	false		high
http://typekit.com/eulas/00000000000000003b9b3f86	pps7abe[1].css.24.dr	false		high
https://page.adobespark-assets.com/runtime/1.22/noscript.gz.css	GG8mUEsjQvSUh[1].htm0.24.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://typekit.com/eulas/00000000000000003b9b3f88	onz5gap[1].js0.24.dr	false		high
http://typekit.com/eulas/00000000000000003b9aee45	pps7abe[1].css.24.dr	false		high
https://adobespark.zendesk.com/hc/en-us/categories/202688167-Adobe-Spark	login[2].htm.24.dr, unsupported[1].htm.24.dr	false		high
http://typekit.com/eulas/00000000000000003b9aee47	pps7abe[1].css.24.dr	false		high
http://typekit.com/eulas/00000000000000000000ffd9	rbi5aua[1].js1.24.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
63.33.31.50	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
169.47.124.25	xinviaoafinabatizx.us-south.cf.appdomain.cloud	United States	36351	SOFTLAYERUS	false
13.225.74.123	unknown	United States	16509	AMAZON-02US	false
13.224.187.69	dd20fzx9mj46f.cloudfront.net	United States	16509	AMAZON-02US	false
151.101.1.195	rikapcndbn.web.app	United States	54113	FASTLYUS	false
104.16.123.175	unpkg.com	United States	13335	CLOUDFLARENETUS	false
104.16.148.64	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
104.20.184.68	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
13.225.74.37	api.demandbase.com	United States	16509	AMAZON-02US	false
52.216.105.77	s3.amazonaws.com	United States	16509	AMAZON-02US	false
172.67.145.59	kifot.wancdnapp.page	United States	13335	CLOUDFLARENETUS	false
80.0.0.0	unknown	United Kingdom	5089	NTLGB	false
13.224.195.109	page.adobespark-assets.com	United States	16509	AMAZON-02US	false
15.236.176.210	adobe.com.ssl.d1.sc.omtrdc.net	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	433116
Start date:	11.06.2021
Start time:	10:38:20
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 7s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	Tribeca Investment Partners - Funds.pdf
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.winPDF@19/308@15/15
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .pdf Found PDF document Find and activate links Security Warning found Close Viewer Browsing link: https://spark.adobe.com/page/GG8mUEsjQvSUh/?page-mode=static Browsing link: https://xinviaoafinabatizx.us-south.cf.appdomain.cloud/?bbre=zoxsazx Browsing link: https://spark.adobe.com/page/GG8mUEsjQvSUh Browsing link: https://spark.adobe.com/about?r=reader_page_logo Browsing link: https://spark.adobe.com/make/logo-maker?r=reader_page_learnmore Browsing link: https://spark.adobe.com/login?r=reader_page_bumper_createyourown Browsing link: http://www.adobe.com/legal/terms.html Browsing link: http://www.adobe.com/go/privacy Browsing link: https://spark.adobe.com/login?r=reader_page_topbar_createyourown Browsing link: https://spark.adobe.com/templates/resumes/ Browsing link: https://spark.adobe.com/templates/invoices/
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, UsoClient.exe TCP Packets have been reduced to 100 Created / dropped Files have been reduced to 100 Excluded IPs from analysis (whitelisted): 104.43.193.48, 40.88.32.150, 23.32.238.123, 23.32.238.113, 23.32.238.129, 92.122.146.26, 20.49.157.6, 23.218.208.56, 20.54.26.129, 23.32.238.90, 23.32.238.162, 20.50.102.62, 88.221.62.148, 23.32.238.210, 23.32.238.192, 23.37.33.211, 92.122.213.194, 92.122.213.247, 152.199.19.161, 20.82.210.154, 95.101.22.195, 95.101.22.203, 23.218.208.236, 20.54.104.15 Excluded domains from analysis (whitelisted): e6653.dscf.akamaiedge.net, cn-assets.adobedtm.com.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, spark.adobe.com, fs-wildcard.microsoft.com.edgekey.net, acroipm2.adobe.com, e11290.dspg.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, use-stls.adobe.com.edgesuite.net, adobe.com, a122.dscd.akamai.net, watson.telemetry.microsoft.com, fs.microsoft.com, stls.adobe.com-cn.edgesuite.net.globalredir.akadns.net, acroipm2.adobe.com.edgesuite.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, ssl.adobe.com.edgekey.net, blobcollector.events.data.trafficmanager.net, a1815.dscr.akamai.net, cs9.wpc.v0cdn.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, e4578.dscb.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, iecvlist.microsoft.com, go.microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, sstats.adobe.com, p.typekit.net-v3.edgekey.net, ie9comview.vo.msecnd.net, e1723.g.akamaiedge.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, stls.adobe.com-cn.edgesuite.net, armmf.adobe.com, e7808.dscg.akamaiedge.net, iris-de-ppe-azsc-uks.uksouth.cloudapp.azure.com, go.microsoft.com.edgekey.net, a1988.dscg1.akamai.net, www.adobe.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtSetInformationFile calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/433116/sample/Tribeca Investment Partners - Funds.pdf

Simulations

Behavior and APIs

Time	Type	Description
10:39:15	API Interceptor	11x Sleep call for process: RdrCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
169.47.124.25	#U266b Audio_47920.wavv - - Copy.html	Get hash	malicious	Browse
	American Freight Payment Advice.html	Get hash	malicious	Browse
	INVOICE & STATEMENTS -COPY.htm	Get hash	malicious	Browse
	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2f31c462c0f45d449c88055b8c23df7863.svc.dynamics.com%2ft%2fr%2fIofGGuGvOuh_i3k4U-jBzfE1u1yg9kHPBS0stRfoX3U%23rbartel%40murexltd.com%3a380%3d009&c=E,1,xP0RSUBtZVNwakaYXBLYnh2Aer2HVIwJdidGVeOhulL1sp9Nz6ix3XUeizBZxcVT0pOPcjsfxu1c2ehXg7iv-OghYMiZvZIGOr0QzAyBnhA8vRMsgY35uBOS2A,,&typo=1	Get hash	malicious	Browse
	https://901c5967cfa749e4868ebfd8398c3885.svc.dynamics.com/t/r/Q7S69AKU5cfMdZm6Wiy7rVvSMcARpFDrhoPhruYRCXQ#billsgates@apple.com:9ef73999=00	Get hash	malicious	Browse
	https://datasprdmailprocess.us-south.cf.appdomain.cloud/redirectgweb/?email=gudrun.olafsdottir@landsbankinn.is	Get hash	malicious	Browse
	https://39a92b17b8b040a184e275034819f00a.svc.dynamics.com/t/r/ZkmZ17B3DHQf-4v0ZPQlnxiSBL_T0O1K4CxjNJwBilI#hello@getfucked.ca:389001=128	Get hash	malicious	Browse
	https://u19125531.ct.sendgrid.net/ls/click?upn=xjpmsvvgLV84ud6ykgCFtAy3S1xHBauBdIJM5UD235WlidiBxLM0pfxvw4pceTf8aUKuLgyMDKiJcranrd3Lmg7IIrG3jdv9Ocp-2F2DyafnSXw33h7e-2BX62b3jYzjnGJ6G1FQOrX2uD-2B30ZDTUTmOLA-3D-3DFmek_B23bv3KjH97q3aPsYdTmlLBjXw-2FxHcZy8Rc6e72BVatoBXaexv1pzGmM10LI5AcaD3B54D-2FulZ7o-2B52hWKcp6toYRTrbLeV3OOUctQADFJ8sSHCBhyFyK9FFWTQu5TAN6AP4-2BnozVViVyqCREOQycVeUq8dqzo4b4e7l36BGqZYPBRdQDKw2lQV4LpmeKKclFyDPg9Ofvkj1J7OIUBNxX-2BDS82ofmNep9OfeS3yXmWGovkJeFxbGz-2FqauPRxbiZzj5kcmPms6QZdeiGYnbJkd9X29jUZTqyJbkxgluEIBZ-2FjfXeVPRh9WFGTPUF5a8nArKvArecF2d0jKqN2CyIebIZqaVPweogQIM3H0G0U-2FlifAnbDjOtPvx6QJe2O7CxCH6vYvaia3GkTaQ9UZ8-2FlZiUyxYaizeqkdZLbte-2BRQOG7aYFmN9fr21IyjYaO2Yo3rMhEOcvqwS0bRB54HX5jcTafWpollueWW-2Bq-2B78JHNTERvbizVpvicHX5FgMtZw44PD98rQYHq7PhncwBwV6hor7nkvw-2FKNjkHyMbFecYKi6a-2Bk0NXV4i4qJJiHdSAIfO1wlrFFb8A1Hr7CFCVCloM9NKJopK9W5UnKxJd5iQXfzv53ssgwWPzJq0xOFIJB0e2IBQVYX7QlbwZzww95cm-2BOUXP1qAQeFRvA2UsshFy-2FwnRqGagj3R6yyK47-2BkXF8jMlLbjCknKGEzOQOHRi7wJE-2B8GzFPUuvlYTRxtG14T8bSfWUOYIhYhuozPv0HnUKqcP96omztCnOI2L8csrh3Ks-2BJct4vDmHUTIWHz8LSjp1Kz9G0kPg4enPYqqBH-2FuH5ldT9flCLv0HMAozPADvIaKbi5B-2B8YSRuK8SkWroFdnEFB06gHla6Lr0zkRteymS6	Get hash	malicious	Browse
	https://mrsklzspproject.us-south.cf.appdomain.cloud/redirect/?email=david.termondt@zultys.com	Get hash	malicious	Browse
	https://11d1b1a708d345629044c3ad40d1ecce.svc.dynamics.com/t/r/u-pVz1saxqvYoENC2gfNyfmqxmRTA6ywUgXOHYh5EPA#aurore@idcom-france.com:3Tk39002=4000	Get hash	malicious	Browse
	https://eprints.tktk.ee/cgi/set_lang?referrer=https%3A%2F%2Fopps.us-south.cf.appdomain.cloud%2Fredirect/?email=john.doe@milkingab.com	Get hash	malicious	Browse
	https://e3e93d5a2c834987987b70e8f5cb9679.svc.dynamics.com/t/r/yuLm56H6RRyNVrsTvEs4LJf09g4YFRCuIYKW7pWJ24w#linda.stooksbury@nationalmi.com:3893=30939	Get hash	malicious	Browse
	https://e3e93d5a2c834987987b70e8f5cb9679.svc.dynamics.com/t/r/yuLm56H6RRyNVrsTvEs4LJf09g4YFRCuIYKW7pWJ24w#linda.stooksbury@nationalmi.com:3893=30939	Get hash	malicious	Browse
	https://u16155601.ct.sendgrid.net/ls/click?upn=A8c8TPcN5tpU3XvHkwU4SV9gO3DGRnLKMTXNksKihhwj-2BeAVJlcyCNT8-2FHE9gLEilCBS4y3onYdwAqG6xxdEiHKc3HjTy7DAovSvxwq-2BeAUDT7GuPnacJJriSfb57ok20iPE2lYEUXiW87ZQBr-2F37vizn2sLjKlI67gf6t3JyW4-3DSdmt_9cFwG5DSL37NF4NwRiUyooPh26FczTD-2FLPUp7OKhqxXYYRfOFexvUJOvqTynML1vztEpcQPPrxENXFLUdmQ01kKEEY55WnovrRRoqIdq8QQV3o-2Fw30Uc4qLThl3g-2FNxUCM7TeZ9cD3PJn4-2B0jw2rsALYQnsVKegSel-2Fsg6zBoPEn7YYYUhr9MVQFgW6E9llkSt3IHk6q4NQDV5-2FxAiZT8UJiV0CkOErNo963Wf3zscU-3D	Get hash	malicious	Browse
	https://hybrid-cloud.us-south.cf.appdomain.cloud/index.php?email=sbot@sbo.co.at%22	Get hash	malicious	Browse
	https://flourishalways.com/?user=ricardo.reis@novobanco.pt:3947=3993-3	Get hash	malicious	Browse
	https://flourishalways.com/?user=ricardo.reis@novobanco.pt:3947=3993-3	Get hash	malicious	Browse
	https://flourishalways.com/?user=ricardo.reis@novobanco.pt:3947=3993-3	Get hash	malicious	Browse
	https://wpo.us-south.cf.appdomain.cloud/index.php?email=junk@fodder.com	Get hash	malicious	Browse
	https://exmainrin.us-south.cf.appdomain.cloud/rsxpphp.php/?tyids=kurt.heim@goodmanmfg.com	Get hash	malicious	Browse
13.225.74.123	Qgc2Nreer3.exe	Get hash	malicious	Browse
13.225.74.123	Player.apk	Get hash	malicious	Browse
13.224.187.69	https://spark.adobe.com/page/s4liZTtRbzbxD	Get hash	malicious	Browse
	http://holoqueen.tk/click/nsw%203/data/index.php	Get hash	malicious	Browse
	https://kummy.ga/000/nsw/data/UntitledNotebook1.html	Get hash	malicious	Browse
	http://email.transactional.pandadoc.com/c/eJxVT8tuwjAQ_Bp8a-RH7CSHHICUVoIDFQ-1vaCN7SQWSZw6ppR-fU1VJKpdrWZHq5mds3XHcQCpD0blz5smhVniLt26nvnZKuur-XhEJqeYZASHEgwTFpEIc14UhZiLIsk45tNJjL2DfgTpje2hjQboFSgrI2k71OSEU6WVLqsKUgZxUhLAiaRZzJlMsSLIjIcgIDWUrc637qRRmzfeD-OETSd0ERqG4Z9qoAI6dbr3AcZxlWGagKKpJkyVhAnMAqYqxZkoU8Z1KagskXU19OYbrn9eM7v9WyfB9tosVuy42ormmNXvyOWdtG1r-jFEO5uhVO43is9vpg9jGPe7B1frewY5_WnGPx-zXDfAVbKIh4-CqZduZyHeoNvt9eTR0ItPYbf0X3pv1WUn7OsTRyqXVEsR_wD-fI4O	Get hash	malicious	Browse
151.101.1.195	triage_dropped_file.exe	Get hash	malicious	Browse	www.ndsplan.com/qjnt/?r6q=409VEscksmbemh4psNBSYZ81rwPnbusvlC1+acnRVCvPwVqGWkPGglJQMW6w6KHAVJPl&rTFDm=GBOxAlxXYbRxGd
	jH10jDMcBZ.exe	Get hash	malicious	Browse	www.covidtracksb.com/goei/?hBZpUr88=xBMInsAuN+E1djdIl4AZwIkS2iJ2Ju/hNdjKdY9aIZe6wtX7I1CrmxbEw1ye6jglvUKA0g+SVw==&ofuxZl=yVJLPZsh
	46578-TR.exe	Get hash	malicious	Browse	www.covidtracksb.com/goei/?jBZx=D8b4q&kfOdRJ=xBMInsAuN+E1djdIl4AZwIkS2iJ2Ju/hNdjKdY9aIZe6wtX7I1CrmxbEw2e35jcdm3/W
	remittanceslip_pdf.exe	Get hash	malicious	Browse	www.devfestindia.com/cu6o/?uN6x=W+WuFBrln1qCfAXJ5xKULfOGff8dAb86Jvk64PlTVVMLGqhT4HhQij0c0Z21Ont+U/Id&Vtx0E=FDHHERlxjn8PMDI
	Project.pdf.exe	Get hash	malicious	Browse	www.towatchapp.com/ocq1/?lhudJ=s9fWYY+GRE/zu2qn9kCI0m/+x20wNzaZElH9PrG8sfLhi2QQuUQu3XvRAAgtMskCm9iv&1bm=3fhdLbnpevPXqD
	quotation.exe	Get hash	malicious	Browse	www.fsjdc.com/x2ee/?iBZLH8e=/LfDiPUOWZnyidNro0j70T8JUoHePLB2D+vct3YQB9mB3q5S0iE8mJFwRkJZflqbRhoGi7RzLw==&_RA89r=ZL3D3PvXurq
	DOCX RFQ#2.doc	Get hash	malicious	Browse	dropb-cfeb2.web.app/white.exe
	DOCX RFQ#2.rtf	Get hash	malicious	Browse	dropb-cfeb2.web.app/white.exe
	12-4.exe	Get hash	malicious	Browse	www.cvscarepasscard.com/gwg/
	PAYMENT COPY.exe	Get hash	malicious	Browse	www.firedoom.com/sbmh/?EjRh0d=C5hy1K5oAHBPrT8N397N//2qVHn6YwjigpXcmeWEXRbnBwwwMsoNEjPCOjfDrGfyrTiG&Bn=8pt0_Nex
	PO987556.exe	Get hash	malicious	Browse	www.firedoom.com/sbmh/?Yn=ybIHmldXUn88Ur&jfIT64=C5hy1K5oAHBPrT8N397N//2qVHn6YwjigpXcmeWEXRbnBwwwMsoNEjPCOg/57X/Kx0DB
	account confirmation!.exe	Get hash	malicious	Browse	www.firedoom.com/sbmh/?0Tx43p=zbDHwlRpXFN&DV8X=C5hy1K5oAHBPrT8N397N//2qVHn6YwjigpXcmeWEXRbnBwwwMsoNEjPCOjfDrGfyrTiG
	New Additional Agreement.exe	Get hash	malicious	Browse	www.erraticer.com/bw82/?J2JxbNH=6vRuuEDvqC5+aa5DVmVINCXZAyoyPzPxPo5XFdu9xcvmHzBmwHK9JJE0E4eNhlSLE1w3&BXEpz=Z2Jd8XTPeT
	00d1gI2vB4.exe	Get hash	malicious	Browse	www.erraticer.com/bw82/?ET8T=6vRuuEDvqC5+aa5DVmVINCXZAyoyPzPxPo5XFdu9xcvmHzBmwHK9JJE0E4eNhlSLE1w3&URiP=qFQxprRp5PPPOfyp
	New Additional Agreement.exe	Get hash	malicious	Browse	www.erraticer.com/bw82/?8p=6vRuuEDvqC5+aa5DVmVINCXZAyoyPzPxPo5XFdu9xcvmHzBmwHK9JJE0E7ykiluzNWFh0m7Gjw==&Bh=H0GxrDp
	Additional Agreement KYC.exe	Get hash	malicious	Browse	www.erraticer.com/bw82/?Ezrtr2qh=6vRuuEDvqC5+aa5DVmVINCXZAyoyPzPxPo5XFdu9xcvmHzBmwHK9JJE0E7ykiluzNWFh0m7Gjw==&QL3=ojqPsv
	http://roundcubemailagentupdate.web.app	Get hash	malicious	Browse	roundcubemailagentupdate.web.app/
	http://auto78438787328758792947.web.app	Get hash	malicious	Browse	auto78438787328758792947.web.app/
	http://salary-bonus.web.app	Get hash	malicious	Browse	salary-bonus.web.app/
	Client Contact REGISTRATION Sheet.xlsx	Get hash	malicious	Browse	www.letsdindin.com/mnf3/?9rTpeFt0=G6fRyfWpf4em3a5PxYoprh6KPSSsHaeEr4x3W3Pvzp31VBrhmksxwaIIwF2fZ05EyJsOCg==&rj9L_=qpnTHjlx

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
dd20fzx9mj46f.cloudfront.net	Q lifesettlements INVOICE.htm	Get hash	malicious	Browse	13.226.151.66
	Remittance.htm	Get hash	malicious	Browse	13.226.151.66
	http://chr-cssnf.ga/?login=do	Get hash	malicious	Browse	143.204.203.70
	https://omsd-org.gq/?login=do&c=E,1,MTY2COfqGo5C-H4KALYqrUyXXPpd2evSCW3stb24PsdKe8xYdoYVhcjchdnzpUCr95AnX7X4QDVSQFpJtN_EpMZ8u2smwVQNUpYGz7Etn-l-NVb_st2_649iVg,,&typo=1	Get hash	malicious	Browse	13.224.91.69
	https://maxhealth-conm.cf/?login=do	Get hash	malicious	Browse	13.224.91.69
	https://maxhealth-adobe-auth.gq/?login=do	Get hash	malicious	Browse	65.9.60.66
	https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAA3AAABLblqZhB2iX6jVa7C1x9MSGt1geth5YYDH4M2JDCAcWcqhhgLV0fZugj5rbf5qFaEWcufPZItg1MCuEP5drSrTGzcJ2ES&	Get hash	malicious	Browse	13.224.91.69
	https://luacclibrary-my.sharepoint.com/:b:/g/personal/polson_luacc_com/EfAoFE3NqkFOtaxmNOJG-7cBczwxxIkQeEoohauxLQI30g?e=RpwCpr	Get hash	malicious	Browse	13.224.91.69
	https://luacclibrary-my.sharepoint.com/:b:/g/personal/polson_luacc_com/EfAoFE3NqkFOtaxmNOJG-7cBczwxxIkQeEoohauxLQI30g?e=RpwCpr	Get hash	malicious	Browse	13.226.151.66
	NEW ORDER.HTML	Get hash	malicious	Browse	13.224.91.69
	student_accessibility@umanitoba.ca.....htm	Get hash	malicious	Browse	13.35.251.69
	http://kalswingksk.ml/000/nsw/data/index.php	Get hash	malicious	Browse	13.224.91.69
	Creative_Cloud_Set-Up.exe	Get hash	malicious	Browse	13.224.91.69
	https://spark.adobe.com/page/s4liZTtRbzbxD	Get hash	malicious	Browse	13.224.187.69
	http://holoqueen.tk/click/nsw%203/data/index.php	Get hash	malicious	Browse	13.224.187.69
	https://kummy.ga/000/nsw/data/UntitledNotebook1.html	Get hash	malicious	Browse	13.224.187.69
	http://zaususkk.ml/sss/rdr	Get hash	malicious	Browse	143.204.204.70
	https://majeomojo.tk/huh/nsw/data/UntitledNotebook1.html	Get hash	malicious	Browse	13.224.91.69
	Secure draft contract - FAO - 12 Chatsworth Road.pdf.htm	Get hash	malicious	Browse	13.224.91.69
	Sample_UIS Insurance & Investments Excel Document.html	Get hash	malicious	Browse	52.222.145.10
dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com	Payment.html	Get hash	malicious	Browse	52.30.135.179
	7bYDInO.rtf	Get hash	malicious	Browse	52.210.171.182
	espn.html	Get hash	malicious	Browse	34.252.115.248
	Q lifesettlements INVOICE.htm	Get hash	malicious	Browse	63.32.152.233
	Red Gospel Mission Due Invoices.htm	Get hash	malicious	Browse	34.246.39.225
	Remittance.htm	Get hash	malicious	Browse	52.212.101.97
	Fortinet FortiGate Runbook.docx	Get hash	malicious	Browse	34.254.147.143
	099-563942-59-5095-73208.htm	Get hash	malicious	Browse	34.249.66.13
	Document0098.html	Get hash	malicious	Browse	108.128.13.248
	009-246036-32-4714-22135.htm	Get hash	malicious	Browse	52.31.176.223
	https://1drv.ms:443/o/s!BAXL7VqGJe6lg0eKk2MZcT_c29ga?e=Qdftz9F3oESsQIuV76Ppsw&at=9	Get hash	malicious	Browse	52.49.47.228
	http://search.hwatchtvnow.co	Get hash	malicious	Browse	52.49.59.93
	details.html	Get hash	malicious	Browse	34.254.93.110
	http://search.hwatchtvnow.co	Get hash	malicious	Browse	34.254.93.110
	details.html	Get hash	malicious	Browse	34.251.184.34
	http://chr-cssnf.ga/?login=do	Get hash	malicious	Browse	18.202.27.117
	http://search.hshipmenttracker.co	Get hash	malicious	Browse	3.250.252.43
	https://survey.alchemer.com/s3/6089047/Contract-Addendum	Get hash	malicious	Browse	52.212.154.51
	https://performoverlyrefinedapplication.icu/CizCEYfXXsFZDea6dskVLfEdY6BHDc59rTngFTpi7WA?clck=d1b1d4dc-5066-446f-b596-331832cbbdd0&sid=l84343	Get hash	malicious	Browse	52.18.91.199

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-02US	ehDnx4Ke5d.exe	Get hash	malicious	Browse	3.22.15.135
	KY4cmAI0jU.exe	Get hash	malicious	Browse	3.34.12.41
	c71fd2gJus.exe	Get hash	malicious	Browse	52.219.64.3
	XQehPgTn35.exe	Get hash	malicious	Browse	3.136.65.236
	E1a92ARmPw.exe	Get hash	malicious	Browse	35.157.179.180
	crt9O3URua.exe	Get hash	malicious	Browse	35.157.179.180
	E1a92ARmPw.exe	Get hash	malicious	Browse	52.218.105.219
	DNPr7t0GMY.exe	Get hash	malicious	Browse	13.59.53.244
	lTAPQJikGw.exe	Get hash	malicious	Browse	99.83.154.118
	SKlGhwkzTi.exe	Get hash	malicious	Browse	44.227.65.245
	SecuriteInfo.com.Trojan.Packed2.43183.29557.exe	Get hash	malicious	Browse	13.59.53.244
	Letter 1019.xlsx	Get hash	malicious	Browse	18.140.1.169
	#U260e#Ufe0f Zeppelin.com AudioMessage_259-55.HTM	Get hash	malicious	Browse	143.204.98.37
	Proforma Invoice and Bank swift-REG.PI-0086547654.exe	Get hash	malicious	Browse	75.2.26.18
	U03c2doc.exe	Get hash	malicious	Browse	108.128.238.226
	Letter 09JUN 2021.xlsx	Get hash	malicious	Browse	18.140.1.169
	Docc.html	Get hash	malicious	Browse	13.224.99.74
	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	52.209.246.140
	Sleek_Free.exe	Get hash	malicious	Browse	143.204.209.58
	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	52.216.141.230
SOFTLAYERUS	5t2CmTUhKc.exe	Get hash	malicious	Browse	119.81.95.146
	Ref#Doc30504871 Wyg.htm	Get hash	malicious	Browse	169.55.190.245
	7 #U039c#U0456#U0455#U0455#U0435d #U0441#U0430II#U0455.htm	Get hash	malicious	Browse	169.46.118.100
	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	159.253.128.188
	06.08.21 Inv & AP Statement - Copy.htm	Get hash	malicious	Browse	169.46.89.154
	Payment slip.exe	Get hash	malicious	Browse	169.56.29.200
	a8eC6O6okf.exe	Get hash	malicious	Browse	119.81.95.146
	Windows Defender#U68c0#U67e5#U5de5#U5177.exe	Get hash	malicious	Browse	50.23.197.95
	#U266b Audio_47920.wavv - - Copy.html	Get hash	malicious	Browse	169.47.124.25
	BS.exe	Get hash	malicious	Browse	103.226.228.233
	American Freight Payment Advice.html	Get hash	malicious	Browse	169.47.124.25
	EASTWAY COMNAGA SB PAYMENT BANK IN SLIP 250521_PDF.exe	Get hash	malicious	Browse	192.253.242.6
	de725d13_by_Libranalysis.exe	Get hash	malicious	Browse	50.23.197.95
	$RAULIU9.exe	Get hash	malicious	Browse	198.252.103.41
	Receipt565647864.html	Get hash	malicious	Browse	158.177.118.97
	350969bc_by_Libranalysis.exe	Get hash	malicious	Browse	119.81.45.82
	Open_Invoice_and_statements.htm	Get hash	malicious	Browse	158.176.79.200
	2x93jpW0Ac.dmg	Get hash	malicious	Browse	108.168.175.167
	4wHhXGk3b9.dmg	Get hash	malicious	Browse	108.168.175.167
	networkservice.exe	Get hash	malicious	Browse	69.56.135.212
AMAZON-02US	ehDnx4Ke5d.exe	Get hash	malicious	Browse	3.22.15.135
	KY4cmAI0jU.exe	Get hash	malicious	Browse	3.34.12.41
	c71fd2gJus.exe	Get hash	malicious	Browse	52.219.64.3
	XQehPgTn35.exe	Get hash	malicious	Browse	3.136.65.236
	E1a92ARmPw.exe	Get hash	malicious	Browse	35.157.179.180
	crt9O3URua.exe	Get hash	malicious	Browse	35.157.179.180
	E1a92ARmPw.exe	Get hash	malicious	Browse	52.218.105.219
	DNPr7t0GMY.exe	Get hash	malicious	Browse	13.59.53.244
	lTAPQJikGw.exe	Get hash	malicious	Browse	99.83.154.118
	SKlGhwkzTi.exe	Get hash	malicious	Browse	44.227.65.245
	SecuriteInfo.com.Trojan.Packed2.43183.29557.exe	Get hash	malicious	Browse	13.59.53.244
	Letter 1019.xlsx	Get hash	malicious	Browse	18.140.1.169
	#U260e#Ufe0f Zeppelin.com AudioMessage_259-55.HTM	Get hash	malicious	Browse	143.204.98.37
	Proforma Invoice and Bank swift-REG.PI-0086547654.exe	Get hash	malicious	Browse	75.2.26.18
	U03c2doc.exe	Get hash	malicious	Browse	108.128.238.226
	Letter 09JUN 2021.xlsx	Get hash	malicious	Browse	18.140.1.169
	Docc.html	Get hash	malicious	Browse	13.224.99.74
	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	52.209.246.140
	Sleek_Free.exe	Get hash	malicious	Browse	143.204.209.58
	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	52.216.141.230

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
9e10692f1b7f78228b2d4e424db3a98c	_VM0_03064853.HtM	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	payload.html	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	Ref#Doc30504871 Wyg.htm	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	#Ud83d#Udce9-peter.nash.htm	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	fTxhRIDnrC.dll	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	RRY0yKj2HM.dll	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	Check 57549.Html	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	sat1_0609_2.dll	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	7 #U039c#U0456#U0455#U0455#U0435d #U0441#U0430II#U0455.htm	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	Yl6482CO6U.exe	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	Sleek_Free.exe	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	WV Northern Community College.docx	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	LVh23zF9x9.exe	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	d7b9ef581459a0d8f94b789ae07a9e0892c0f0d0bcc74.dll	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	d7b9ef581459a0d8f94b789ae07a9e0892c0f0d0bcc74.dll	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	The Village.html	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	RFQ-INV-PAYMENT.Htm	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	#Ud83d#Udcde VM_58490931 Recoding.wav - 20223 PM.htm.htm	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
	Bills Pending Approval.html	Get hash	malicious	Browse	104.16.148.64 104.20.184.68 13.225.74.37 172.67.145.59 63.33.31.50 169.47.124.25 13.224.187.69 13.224.195.109 151.101.1.195 104.16.123.175
3faf2df7ab96c36419c31725cb1fa7d6	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	Agreement_052521.html	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	Remmitance-0484.html	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	New Financial Reports & Statements.html	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	#U260e#Ufe0fAUDIO-2020-05-26-18-51-m4a_MP4messages_2202-434.htm	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	March Financial Reports & Statements.html	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	V3kT2daGkz.exe	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	nicoleta.fagaras-DHL_TRACKING_1394942.html	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	Receipt779G0D675432.html	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	FARASIS.xlsx	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	Message.htm	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	LTR_20210317_TransferNotice_Vendors.docx	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	Ensono-F6966.html	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	New Financial Reports & Statements.html	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	Colt_Payroll_report.htm	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	INV-FACTUUR00921.xlsx	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	Final_Notification.docx	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	DHL eMailShip delivery Form - securedPDF.html	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	Jan_Order.html	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210
	PO-00172020.html	Get hash	malicious	Browse	13.225.74.123 52.216.105.77 15.236.176.210

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	5.670803816881926
Encrypted:	false
SSDEEP:	12:vDRM9+ZiE/DRM94PeZiEthDRM9HPZiEm/hDRM9uv3ZiEw:7KEr5PbEt1QoEW1cEw
MD5:	0A491081D88AC40C1BCD323C6FB158ED
SHA1:	B9B1EEACF8D875ECADF363BF12F41B3D9BC25C38
SHA-256:	DB30BACD869B4446B1A9655ADF4E651E0246C485D6935E01064488F581B94F6B
SHA-512:	1003E3B3439FC94158359BACE8FF8FFEBF9856820A7669E0EDD97559956CEF997496D64F45DEE2016B2DCC684267B05AF356E882A14EF28003FC729BE8A67926
Malicious:	false
Reputation:	low
Preview:	0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js .'tZE.#/....."#.D.....0.A....d.{v.^.G...d.W.:...P..k%..A..Eo...................A..Eo......G.b........0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js .5..E.#/....."#.DG>...0.A....d.{v.^.G...d.W.:...P..k%..A..Eo...................A..Eo......VG.9........0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js .p..E.#/....."#.D^....0.A....d.{v.^.G...d.W.:...P..k%..A..Eo...................A..Eo......,F..........0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js ..7.E.#/....."#.D....0.A....d.{v.^.G...d.W.:...P..k%..A..Eo...................A..Eo......j.n.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	696
Entropy (8bit):	5.60203649461146
Encrypted:	false
SSDEEP:	6:mi9NqEYOFLvEkHgmi8Be7Ywcr1TK6t7i9NqEYOFLvEkS8Be7Ywcr1TK6tiei9NqI:V9zji9PQM9zy9PQEd9zJ9PQ39ze9PQc
MD5:	536EC9035BFF1739BF7CB2B3C7B9AF9D
SHA1:	D2F8E6D7B27C68361733DF80BC947E2F7D126F39
SHA-256:	0076CFC1535D23D9F826A44896EE8C680FC484B02A50AB25F50C174BB7FB7155
SHA-512:	BC6B20D3523EF84FC8065E198749C16E5180843BBC3FF8AEE26EF0D1D14384400FA7B13688EE9AFF991C8A7393E33C71E9CAD84E8F1E1DF1A3E23649ECB2D5B8
Malicious:	false
Reputation:	low
Preview:	0\r..m............,....._keyhttps://rna-resource.acrobat.com/init.js ..KJE.#/....."#.D2....0.A.1.x.'.vI..\|Z..o...+.4....0..A..Eo...................A..Eo........f........0\r..m............,....._keyhttps://rna-resource.acrobat.com/init.js .$..E.#/....."#.D_}8..0.A.1.x.'.vI..\|Z..o...+.4....0..A..Eo...................A..Eo.......5..........0\r..m............,....._keyhttps://rna-resource.acrobat.com/init.js ...E.#/....."#.D....0.A.1.x.'.vI..\|Z..o...+.4....0..A..Eo...................A..Eo........`?........0\r..m............,....._keyhttps://rna-resource.acrobat.com/init.js ....E.#/....."#.D2.7..0.A.1.x.'.vI..\|Z..o...+.4....0..A..Eo...................A..Eo.......O2........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	984
Entropy (8bit):	5.618914899012875
Encrypted:	false
SSDEEP:	24:tB4v4xPSByB4v4FSBqTB4v4jsQSBwB4v4AgGQSB:nM2SBiMiSBqtMGsQSB4MIGQSB
MD5:	655F35F9452FC66E1F5B8B467AEFCDB2
SHA1:	9C76EBB8AEB039E97DD5EC4DD978728B715FC582
SHA-256:	80144F107A83A9A195EE4988739F674F064740876F842600637866939DEBC385
SHA-512:	4DCC3330F09D922C9CEFBA6F7A165FFD207EEB1CFF3410D795E75B14D50EFDB58DC870D603D4D985D421E15832F6E4209F1B24232CA211E7AE423B1740DFF288
Malicious:	false
Reputation:	low
Preview:	0\r..m......v...n......._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/selector.js ...YE.#/....."#.D+2...0.A..hvDO.N.t@.....n....... ....A..Eo...................A..Eo......0\|.........0\r..m......v...n......._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/selector.js ....E.#/....."#.D.c...0.A..hvDO.N.t@.....n....... ....A..Eo...................A..Eo.......<.<........0\r..m......v...n......._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/selector.js ....E.#/....."#.D.....0.A..hvDO.N.t@.....n....... ....A..Eo...................A..Eo......JG.........0\r..m......v...n......._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/selector.js ....E.#/....."#.D-%w..0.A..hvDO.N.t@.....n....... ....A..Eo...................A..Eo.......G..........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	464
Entropy (8bit):	5.656289025889394
Encrypted:	false
SSDEEP:	6:mNtVYOFLvEWdFCi5Rsq7taNR0iWulHyA1TK6tPMNtVYOFLvEWdFCi5RsNslR0iWO:IbRkiDZJkFWussMbRkiDisnFWussb
MD5:	265296634E8BEF9F4CF3398F48136BBA
SHA1:	3DCCCA836B36AF38AF608DE7BC1DCC63444DE138
SHA-256:	0E55C82247859D0BEA6235E509C3400495D10AC1EF71723EA3DCFAD901F5E4F9
SHA-512:	CC4921470A6BC83D6BA9A1C4813436984B0066BF0BE69F6CE737CE67E9B184FDFCBF06E3BE7E39656B5AC426548AA8AA9C70EFF92B309BFD749329053BE67D17
Malicious:	false
Reputation:	low
Preview:	0\r..m......h.....'....._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-tool-view.js ..j^E.#/....."#.D.....0.A..8 P..a...R..Y....7.@..2Dm{..A..Eo...................A..Eo......5.nd........0\r..m......h.....'....._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-tool-view.js .rY.E.#/....."#.D.!-..0.A..8 P..a...R..Y....7.@..2Dm{..A..Eo...................A..Eo.................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.547572590417689
Encrypted:	false
SSDEEP:	6:m+yiXYOFLvEWd7VIGXVu5RVyh9PT41TK6txle+yiXYOFLvEWd7VIGXVupl9GRVyX:pyixRujRV41TEryixRuORV41TE
MD5:	87CAE90B20FD86E49D563744534AA6A5
SHA1:	D65A356B29EDCFA77224E795E3392E9EDB9908BB
SHA-256:	34F1E220660245A61D0622443D7683F382830E528F459E8C9BF26C05F995192B
SHA-512:	C213C114ACB56796EF72823694174BE36562C0D11250923E8BA9659AF9208E21A8E8B08D66CF14E7F442D80BCCCACDEFC237C517061B37A2FE1436D8EF4C30A3
Malicious:	false
Preview:	0\r..m......R...kP]g...._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/selector.js ..v.E.#/....."#.D;s...0.Ak.Q.....-_..y.....O...>..1....A..Eo...................A..Eo......at..........0\r..m......R...kP]g...._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/selector.js .&~.E.#/....."#.D9.}..0.Ak.Q.....-_..y.....O...>..1....A..Eo...................A..Eo.......N..........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.59232915105424
Encrypted:	false
SSDEEP:	6:mvYOFLvEWdhwjQPsOhLZIl6P41TK6t9XMvYOFLvEWdhwjQcnhLZIl6P41TK6tM:0RhkGs2LZCTXqRhkrLZC
MD5:	23936B1FEF8D1073BB8175D2A9E8A317
SHA1:	3893C756E70B6E5E8B557CAAF6F5515D9D18A818
SHA-256:	59FDEB883975E552B6EBA7543C78AAF0EFEC7170EE2C2C17E098BBC00C5DD04E
SHA-512:	3C01DEDC5BE73DC50B82AEADCD17C8C79C4CBCD17F27D255BC6C4B31FD39195C4E3F19C99E4FAAEC3501F408F6A84B2D2DD8AC46A0A907116015EC9B68415A5F
Malicious:	false
Preview:	0\r..m......X.....V....._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/plugin.js ....E.#/....."#.D..t..0.A.].>....uUf..N...k......c..l.A..Eo...................A..Eo.......l%.........0\r..m......X.....V....._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/plugin.js ....E.#/....."#.D..m..0.A.].>....uUf..N...k......c..l.A..Eo...................A..Eo......'.a.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	5.55454680677488
Encrypted:	false
SSDEEP:	6:mJYOFLvEWdGQRQOdQPfvXV6g1TK6tzJJYOFLvEWdGQRQOdQ4/RnXV6g1TK6t:2RHRQCSfvF17RHRQC9/RnF1
MD5:	7005EED40F5F2A9738EA306416D91BA8
SHA1:	9762CFDE678A6C75DBBA8133397735A380986992
SHA-256:	E743051A07DDB265456557ECBC4322D6DE7242FC1C9D0EC68D6F49AE61387A80
SHA-512:	38C8A4F7D47D225B1B007A68E316B5D216B749DB241C797BEB8BAAF1E9F367707D84100841AA9F75FF0052C0F86FDEA9BEB9F7DA4117A17E5BA37B2A286F0D7F
Malicious:	false
Preview:	0\r..m......Q..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/plugin.js .Kg.E.#/....."#.D.....0.A..c..y/L....\|y.n..C/I.....X7-ne.A..Eo...................A..Eo.................0\r..m......Q..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/plugin.js ....E.#/....."#.DC:~..0.A..c..y/L....\|y.n..C/I.....X7-ne.A..Eo...................A..Eo......z..........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	716
Entropy (8bit):	5.578040457973639
Encrypted:	false
SSDEEP:	12:Z5MN5MuR/EXJ5MC24MuR/EDHB5MZUMuR/Ec5M6MuR/E:ZSwuR/E5SCiuR/EzBSbuR/EcSTuR/E
MD5:	9EE06C4460090D3FB89316B8BFE10DEE
SHA1:	DBA786217B265EE99D160019CC41C824C659E8FE
SHA-256:	AF49DA68403C6E4F94D0D86BE081CE50376E62BAB4B17566BF4762C83CC61A46
SHA-512:	9741CC47159D70EA13A2E78100552A872F13F8D4EAD4AD636CC7C7839D16E4914A01CD7BF9ED5A2C4558035DF38C4F364882C668E1B05A7B11A9240D0ED0A3B4
Malicious:	false
Preview:	0\r..m......3....<lb...._keyhttps://rna-resource.acrobat.com/base_uris.js ..oJE.#/....."#.D{....0.A.y...L<?W.Xi..A\Q3...J.}...d..~G.A..Eo...................A..Eo........9.........0\r..m......3....<lb...._keyhttps://rna-resource.acrobat.com/base_uris.js .)H.E.#/....."#.D..8..0.A.y...L<?W.Xi..A\Q3...J.}...d..~G.A..Eo...................A..Eo........_.........0\r..m......3....<lb...._keyhttps://rna-resource.acrobat.com/base_uris.js .R..E.#/....."#.D.6...0.A.y...L<?W.Xi..A\Q3...J.}...d..~G.A..Eo...................A..Eo.......-.3........0\r..m......3....<lb...._keyhttps://rna-resource.acrobat.com/base_uris.js ....E.#/....."#.D.<7..0.A.y...L<?W.Xi..A\Q3...J.}...d..~G.A..Eo...................A..Eo........u.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\39c14c1f4b086971_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.60025948014847
Encrypted:	false
SSDEEP:	6:mGpYOFLvEWdzAAuHaKWgm0bbsIDMGH41TK6tQ:XfRM9KKsIZE
MD5:	19D089D30212302279F245DD80224B50
SHA1:	3C7F7E3118F0E032365B179CF5F1D95526B10D27
SHA-256:	C861D9F57FC2031CFB768855582B95E7928BA0F5EAB555087F61D2CD9DE06992
SHA-512:	4DC4346F0514A9B81272CFE52A2ED4BA7E142E0DC453CF3ED584F28BD0A3F57CF70AB3684F5B013C4348309E47B4AF62510713F8126AFFFC4608863FEAA9112E
Malicious:	false
Preview:	0\r..m......T....,.^...._keyhttps://rna-resource.acrobat.com/static/js/plugins/walk-through/js/selector.js .L..E.#/....."#.D.?...0.A..`.....^....L>..Xa./......C.y.A..Eo...................A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.549273590048281
Encrypted:	false
SSDEEP:	6:m4fPYOFLvEWdtuiFQby0zBUKSAA1TK6tb84fPYOFLvEWdtuv49uby0zBUKSAA1T6:pRkbepR6jbect
MD5:	A6C4E73C8247230CF0650B03C8D325A6
SHA1:	0C0AAC18065C132A07E3BA5B25C62001285DDB93
SHA-256:	DB2A98DAF8F0501CB243ED1BA546BFD2FE1DF7FB00A260C38B55D7BEF0A87334
SHA-512:	472076C981B3AE7F13223851AE70FD9B4B18BDCEBD1BCE7AE1A90A3281320A15911564D98A8E95F27A8D6C0942992362F44B6D4AD311EC376DA3BC62D8CE90E1
Malicious:	false
Preview:	0\r..m......V..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/search-summary/js/selector.js .^!.E.#/....."#.D.....0.AQ..E.=....=h`t..t..3%A.F$..w..A..Eo...................A..Eo.........e........0\r..m......V..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/search-summary/js/selector.js ....E.#/....."#.Dx...0.AQ..E.=....=h`t..t..3%A.F$..w..A..Eo...................A..Eo......lQ.?........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	708
Entropy (8bit):	5.54633744296574
Encrypted:	false
SSDEEP:	12:KkXxKMSCvJg+tUlm9okXxKMSCvU7ZtUlYkXxKMSCv//otUld4kXxKMSCvzDctUls:KkXxiCtWKokXxiCUWYkXxiCnAWykXxiW
MD5:	33CCF19E67ECE47944B7A0F7FEFA998C
SHA1:	4F3B72677292B7D505416BAA18DBFA66E508F6EB
SHA-256:	10A26858256FA20155ACCD171436B9233B6D5C5B657DBD37B52910CF0A04B49F
SHA-512:	C29456813F2A53EE7C70981123592159274F1C58D36FED79F166034976AB81F381FAE3E38C3F656D62E5EA47E13AEBD2686B9AA46BAD3BBEAE725D6672C35A10
Malicious:	false
Preview:	0\r..m......1......5...._keyhttps://rna-resource.acrobat.com/plugins.js ..lJE.#/....."#.D.....0.A.PU ....t^.....a.k..u.7.M.BW6#}..A..Eo...................A..Eo.......`L.........0\r..m......1......5...._keyhttps://rna-resource.acrobat.com/plugins.js ..E.E.#/....."#.D..8..0.A.PU ....t^.....a.k..u.7.M.BW6#}..A..Eo...................A..Eo.........0........0\r..m......1......5...._keyhttps://rna-resource.acrobat.com/plugins.js ....E.#/....."#.Db/...0.A.PU ....t^.....a.k..u.7.M.BW6#}..A..Eo...................A..Eo......;..........0\r..m......1......5...._keyhttps://rna-resource.acrobat.com/plugins.js .b..E.#/....."#.D.'7..0.A.PU ....t^.....a.k..u.7.M.BW6#}..A..Eo...................A..Eo........M.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	5.596554136744823
Encrypted:	false
SSDEEP:	12:5h6OLiOkIzh6OLUvyqkShh6OLrkwBh6OLFkOX:5h6LrIzh6xvy/Shh6BOh6z
MD5:	FABE2533884CC615F53B3528F446BEF2
SHA1:	D32530F77626B6462FAD15FDF0CBA5EEBF0FC310
SHA-256:	0603283D9F124EC0BEA02E6BB681C8D007DBEC1290F873C912310C172978DA0C
SHA-512:	A98EB68E64BB2763CB6EDC9C00984085AA180CF8FB97D0A666878DDB346B66D685D34EAA0CD42AF56D1AEF59F7D899A02819A8B189DB67BC5B6063404B6A367E
Malicious:	false
Preview:	0\r..m......;...I......._keyhttps://rna-resource.acrobat.com/static/js/desktop.js .ksUE.#/....."#.D.....0.A..q.O...j....._y..L^z...?..@N..A..Eo...................A..Eo........g.........0\r..m......;...I......._keyhttps://rna-resource.acrobat.com/static/js/desktop.js ....E.#/....."#.D.%e..0.A..q.O...j....._y..L^z...?..@N..A..Eo...................A..Eo.................0\r..m......;...I......._keyhttps://rna-resource.acrobat.com/static/js/desktop.js .}..E.#/....."#.D.....0.A..q.O...j....._y..L^z...?..@N..A..Eo...................A..Eo..................0\r..m......;...I......._keyhttps://rna-resource.acrobat.com/static/js/desktop.js .f..E.#/....."#.D.(c..0.A..q.O...j....._y..L^z...?..@N..A..Eo...................A..Eo......r$P.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	5.638611073177741
Encrypted:	false
SSDEEP:	24:UB4v4+YwzXLnQB4v4NwzXLnCkB4v4K11wzXLnkB4v44wzXLn:8M/NbnYMzbnCsMTEbnsM4bn
MD5:	BA4FEEB2BCA500D4AAC12D03B4E74E15
SHA1:	F4538BC4DEE930C7F6DC4BB3441F00C0DC778A14
SHA-256:	E266BE2DB18EC47C6B385BB085EFFEC31C5737241B800CDE1E9FF00810B40A20
SHA-512:	C911791BC008CEEDABE0AE3DD05602B4E524FE286A5F5C6E61D1104067CF0E1ADA1B0BEB84693F09807D25CDB2217E35F972E3690EC948A52DACCA8651EDB19F
Malicious:	false
Preview:	0\r..m......t...R.1<...._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/plugin.js ..wZE.#/....."#.D.]...0.A......H...{...2../.k`..r4.C. .A..Eo...................A..Eo.......IW.........0\r..m......t...R.1<...._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/plugin.js .pX.E.#/....."#.Dq ...0.A......H...{...2../.k`..r4.C. .A..Eo...................A..Eo..................0\r..m......t...R.1<...._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/plugin.js .#V.E.#/....."#.D.S#..0.A......H...{...2../.k`..r4.C. .A..Eo...................A..Eo......V..p........0\r..m......t...R.1<...._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/plugin.js ....E.#/....."#.D.!...0.A......H...{...2../.k`..r4.C. .A..Eo...................A..Eo......m8%.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6267ed4d4a13f54b_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5317814704880695
Encrypted:	false
SSDEEP:	6:mq9YOFLvEWdzAHdQxOFl5GFCaa+41TK6ttLt:NRMHdCEl5Gda+Er
MD5:	761A29C7B78279FECB2B21E1103C8764
SHA1:	16E3F8928BD7D9EBC8A23FEF4F55F099C9E80911
SHA-256:	86A63DFBD17F29AA9BE606210A7F669A045B2D781C1BDBAA776A4D1D51A881AE
SHA-512:	B09A90FF02D9B243967F88370BBB7738D01761C768BE5FB839DD2DF91924A56637A11BB9AAE898650D49F791D1B561C302A73B25D797DB10672073277E20CF06
Malicious:	false
Preview:	0\r..m......R....L......_keyhttps://rna-resource.acrobat.com/static/js/plugins/walk-through/js/plugin.js .H..E.#/....."#.DKu...0.A...G.3D.....Q.g0...._.Q.........A..Eo...................A..Eo.......\'.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.492039616665217
Encrypted:	false
SSDEEP:	6:ms2VYOFLvEWdvBIEGdeXuJAuR11TK6tElEs2VYOFLvEWdvBIEGdeXu0Dcr11TK6t:BsR2EseMPalTsR2EsetE
MD5:	E43982F8FF6694E9051FE9546A32185D
SHA1:	68963D4A8F73FBE79D388063A057B09F0D8B1A04
SHA-256:	50F4DC4A07F525EAEA30095A2B1D80E7779DCCFD78EEE2917124A7A56EB5EE29
SHA-512:	CC0BFC3FA6DCB04FA1C0139DE7F25022EE78C6261B4DA50008D7CF29777B21AF002130682489E3B35FD943E66E32AADE21530D8D9365344EBC9849272C9FABF0
Malicious:	false
Preview:	0\r..m......S...]......._keyhttps://rna-resource.acrobat.com/static/js/plugins/add-account/js/selector.js .ZQ.E.#/....."#.D.Z...0.A.A.o]@r..Q.....<w.....].n\....A..Eo...................A..Eo.......oD.........0\r..m......S...]......._keyhttps://rna-resource.acrobat.com/static/js/plugins/add-account/js/selector.js .P..E.#/....."#.D..z..0.A.A.o]@r..Q.....<w.....].n\....A..Eo...................A..Eo.......e..........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	404
Entropy (8bit):	5.636430516906278
Encrypted:	false
SSDEEP:	6:maVYOFLvEWdwAPCQ7WB7OhKlvA1TK6t9/EaVYOFLvEWdwAPCQJlQwoB7OhKlvA13:RbR16vBJkbbR160lQ1BJk
MD5:	FC4F6400DC58CA60EB6FC7864C4BDA0B
SHA1:	34868D1698779BF4E2D26E341D3F5CE033A383AC
SHA-256:	3A959303C23CC3885AF00D612121244FEAAF858CB1FC9D186DC53447D957557F
SHA-512:	A97CF1E04EA3A86BE65F4D285C291D1EED2E4D6D590809CCBD0DF82F6D910209C810A316293B81069BA5FF5ABDC70606C1E5D629FBA67F39659673B14006E035
Malicious:	false
Preview:	0\r..m......J......{...._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/plugin.js ....E.#/....."#.DV.s..0.A..4T].....Tw.....(..b...EO....9.A..Eo...................A..Eo.......}I.........0\r..m......J......{...._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/plugin.js ..p.E.#/....."#.D..m..0.A..4T].....Tw.....(..b...EO....9.A..Eo...................A..Eo.......t.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.586997334822384
Encrypted:	false
SSDEEP:	6:ms2gEYOFLvEWdGQRQVuxvrRQdFt1TK6tUEs2gEYOFLvEWdGQRQVuPyr6QdFt1TKL:B2geRHRQerR0iT2geRHRQn60i
MD5:	3F64DA05E63DCBDFC6D93F341772FF8F
SHA1:	C209869A0D303BD66E0BD7958A1886E227F5CE21
SHA-256:	24F78E7CB62ED378722E985776F43C63FE28ECEE3D6131770DCFAD54A819CD3A
SHA-512:	6DBE2C36148D3646FEC4A066FE8F3673F39726BCB1D635EBBF674A0E794D522DE2D419BF5DF9FD561FBF130FCD30CEA8BBE70891436A57286BCFADF4E4E8EC13
Malicious:	false
Preview:	0\r..m......S...W.%z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/selector.js .. .E.#/....."#.Dt~...0.A@..{o]...9o\|..qY....T....{..u.b..A..Eo...................A..Eo........h[........0\r..m......S...W.%z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/selector.js .e..E.#/....."#.D.Hx..0.A@..{o]...9o\|..qY....T....{..u.b..A..Eo...................A..Eo.........)........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.653484535146409
Encrypted:	false
SSDEEP:	12:WyeRljAt1w/lEyeRlC2t1w2myeRlA+4t1wLyeRlXt1w/:WJrAfw+JXfw3Jl4fwLJPfw/
MD5:	DA0640CFB31FF35B4D45237B338E8824
SHA1:	820923E14B7CB7C4E8127ABDE022B5E055BA3D81
SHA-256:	B215AF902A37783670BD749EC73C684FB26897413A64528FEF75256682C0E53E
SHA-512:	E0C52ED15983CC30403F04DB144D4B99FBBF8CF6ED5B2303FF43D430A664A824DF11F89F126FBBF1482894A0DE5EA5259A65C5C9D3E38D06B536AD3D333F3BCE
Malicious:	false
Preview:	0\r..m......N..../......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/plugin.js ..WE.#/....."#.D....0.A.t\a......x5.'OuE.C..@......x..A..Eo...................A..Eo..................0\r..m......N..../......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/plugin.js .6g.E.#/....."#.D..k..0.A.t\a......x5.'OuE.C..@......x..A..Eo...................A..Eo......Ry'.........0\r..m......N..../......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/plugin.js .`..E.#/....."#.Dz....0.A.t\a......x5.'OuE.C..@......x..A..Eo...................A..Eo.................0\r..m......N..../......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/plugin.js ../.E.#/....."#.D*.g..0.A.t\a......x5.'OuE.C..@......x..A..Eo...................A..Eo......+\..........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	436
Entropy (8bit):	5.540145112292629
Encrypted:	false
SSDEEP:	6:mnYOFLvEWdhwyuHSGqwK+41TK6t/2nYOFLvEWdhwyu5pGR6IqwK+41TK6tHR:wRhUUwK+EhgRhRR6hwK+E
MD5:	B49E7B26354B8F151BD2780ADCD37707
SHA1:	D4E1B31E08A701DCC00CC36277FF294C4289B400
SHA-256:	E68C1CC1904C45C958D94BC7D7ABC9ECC206A5FE46ADB478AD576C757FF5E591
SHA-512:	5D3E30DB7939FC8E0244A059EE7249CCB7DD30C63ED0F15D6EF66882396FC44913A740D3524B99B8DBCCF2B6430BAEB21EF1B1C1A709CDD29AB45B3AFEFD105B
Malicious:	false
Preview:	0\r..m......Z.........._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/selector.js ....E.#/....."#.D..r..0.A.......7...o..a=.98I......(3.$G.A..Eo...................A..Eo......$.3........0\r..m......Z.........._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/selector.js ..o.E.#/....."#.D0.m..0.A.......7...o..a=.98I......(3.$G.A..Eo...................A..Eo.................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	920
Entropy (8bit):	5.5958992285557105
Encrypted:	false
SSDEEP:	12:/RrROk/w+bsfLEItvRrROk/UzsfLE6RrROk/VPNbsfLEIRrROk//bsfLE:/PJ/XI4YvPJ/546PJ/I4IPJ/g4
MD5:	3F87DAB1289E6A0EFDAEFBE8FC39E841
SHA1:	C646A53EECAFB48F3607681A30D081CEDC7E7182
SHA-256:	82EB911D63BDC58DEF127425DA48FD41D696EAAA997F4437D2071D3537BA5E81
SHA-512:	2A21B34BCE11E5937D8AC05A8BF9078B8D6E863BCE3A7DAA548D7B54EC31260FA76768E74C468F4B59BF54A3B4E6514FA99DDF07BB4B9972E4D9F408DB25A2D4
Malicious:	false
Preview:	0\r..m......f...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/selector.js .0SWE.#/....."#.DG....0.A..~..rw.+[....!.)?..f.U..(=.=.A..Eo...................A..Eo........!.........0\r..m......f...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/selector.js ..=.E.#/....."#.D.uk..0.A..~..rw.+[....!.)?..f.U..(=.=.A..Eo...................A..Eo......~`.#........0\r..m......f...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/selector.js ....E.#/....."#.D.b...0.A..~..rw.+[....!.)?..f.U..(=.=.A..Eo...................A..Eo........Yi........0\r..m......f...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/selector.js ..-.E.#/....."#.D..g..0.A..~..rw.+[....!.)?..f.U..(=.=.A..Eo...................A..Eo.......{..........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	5.608841549548081
Encrypted:	false
SSDEEP:	12:xqTOgoCPLnYqTmG5CPLnmqTavCPLn1sTqTpMCPLnM:AyLMnvj5MnZgMn1jlMMnM
MD5:	44A6DFDEAD0E9843C1A32DF39EFD4B9B
SHA1:	42CA27326DAF0BEC4D85AF39A66B1CA7EA68F8A2
SHA-256:	1196309D09D927B08E4F25EF56E3A33967ED6629867987A271B1E232D2F371A0
SHA-512:	B2E40F9CEF90BFABDF5337FDDCAEEEE46C66758BA9D537ED678540F77E0BA41D8B2BDD58B750F49BF7E9383F71D22920CEDA6EDD3364D5CAC15C14A4AC858536
Malicious:	false
Preview:	0\r..m......:....f......_keyhttps://rna-resource.acrobat.com/static/js/config.js .?qUE.#/....."#.DI....0.A..~]...%s..<...n.f..<.....1#..U..A..Eo...................A..Eo.......Qw.........0\r..m......:....f......_keyhttps://rna-resource.acrobat.com/static/js/config.js .c.E.#/....."#.D..e..0.A..~]...%s..<...n.f..<.....1#..U..A..Eo...................A..Eo......[..........0\r..m......:....f......_keyhttps://rna-resource.acrobat.com/static/js/config.js ."t.E.#/....."#.D.....0.A..~]...%s..<...n.f..<.....1#..U..A..Eo...................A..Eo......u.a.........0\r..m......:....f......_keyhttps://rna-resource.acrobat.com/static/js/config.js ..\|.E.#/....."#.D. c..0.A..~]...%s..<...n.f..<.....1#..U..A..Eo...................A..Eo......4...........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	5.673925968084092
Encrypted:	false
SSDEEP:	12:zRM9XgzsDsRMBzsDNRMdmzsDfRMGUNzsD8:zEggDssgDNtgDfnUNgD
MD5:	DDC565FC42CBA22CB571C903CE06542C
SHA1:	F00A0E4FD531E7FEF278E72F35501E209DAA9490
SHA-256:	887EAA27B1CEE9127DDFC235E896AC7DF49CDE405AA03CD33E0FD209D51AC621
SHA-512:	253C40DF810BE39B87E6325E9B3D4D80ECD3819101984988DD032838BCF726BC8B304EDDE8A033DD793D6033FE7CFE0A96256F8085B5A9B2B02B7F5903430AC3
Malicious:	false
Preview:	0\r..m......O...a.Y....._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/selector.js ./.YE.#/....."#.D.....0.A..z._a...'.v.......4p3..1.']...A..Eo...................A..Eo......b...........0\r..m......O...a.Y....._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/selector.js .>X.E.#/....."#.D.8...0.A..z._a...'.v.......4p3..1.']...A..Eo...................A..Eo........N.........0\r..m......O...a.Y....._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/selector.js ....E.#/....."#.D.z...0.A..z._a...'.v.......4p3..1.']...A..Eo...................A..Eo.................0\r..m......O...a.Y....._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/selector.js .}2.E.#/....."#.Dp.{..0.A..z._a...'.v.......4p3..1.']...A..Eo...................A..Eo.......AS.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	840
Entropy (8bit):	5.608320331964856
Encrypted:	false
SSDEEP:	12:6lJRTnFoMkClJRlFoMdlJRulXFoMjlJRVqBFoMA/:YFnFoMkwDFoMJOFoMX/8FoM
MD5:	B3EEAEAABC5AD2BB53368364B1A500A6
SHA1:	6B6E534E720336B4CA22B2F17AD17DBDA346AB6E
SHA-256:	5B2ACD73DDEC5393817E79A7B31075EFD64E9D3BD7B2192489BE4BB745756BB6
SHA-512:	2061DF2D04CB696E7FE641794E774EC370D2FD3B44A9F6B30D9B51360A166A6778AC0582CA4CEE8F5B1A6085135B4DAFF640FA400663B651696F3DF1540566A9
Malicious:	false
Preview:	0\r..m......R....\|....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/selector.js .`.YE.#/....."#.D.....0.Ac}.H7M=M..-.....Ix..R.l...}Rl.$q.A..Eo...................A..Eo......i?n.........0\r..m......R....\|....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/selector.js ..t.E.#/....."#.D.Q...0.Ac}.H7M=M..-.....Ix..R.l...}Rl.$q.A..Eo...................A..Eo........}........0\r..m......R....\|....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/selector.js .y..E.#/....."#.DW....0.Ac}.H7M=M..-.....Ix..R.l...}Rl.$q.A..Eo...................A..Eo......f..........0\r..m......R....\|....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/selector.js ..\|.E.#/....."#.D.}..0.Ac}.H7M=M..-.....Ix..R.l...}Rl.$q.A..Eo...................A..Eo.......,.(........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	892
Entropy (8bit):	5.60294702377411
Encrypted:	false
SSDEEP:	12:F8hRrROk/qje2aQn8hRrROk/Faue2WV8hRrROk/ne2E8hRrROk/Z6Dqe2:UPJ/qC2avPJ/Qt2lPJ/e2FPJ/Ml2
MD5:	2F78DFFB70EFB22E8A504951BF6346F2
SHA1:	3DED7E516FFF6BB785D2E374A6CA01C024889D78
SHA-256:	B2E8C75F92D6F44D5456B527FB48591E1ED0E81A0EB252CC7903619B801BB89E
SHA-512:	1B5FA4BCA55AFBDF7F6EB24FB0610A30A1A220C49F53D658E12865157DFC96F8E9910FD6A998F2C27EFAFE4470AC12AF520D43509985602B2906AFE4E9E53A27
Malicious:	false
Preview:	0\r..m......_...h......_keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/selector.js ..PWE.#/....."#.D.s...0.A..%.k.SZ..~W.....:)'B..ad......A..Eo...................A..Eo......hj.=........0\r..m......_...h......_keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/selector.js ../.E.#/....."#.D.fk..0.A..%.k.SZ..~W.....:)'B..ad......A..Eo...................A..Eo.........s........0\r..m......_...h......_keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/selector.js ....E.#/....."#.D.....0.A..%.k.SZ..~W.....:)'B..ad......A..Eo...................A..Eo.......R.........0\r..m......_...h......_keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/selector.js ....E.#/....."#.D].f..0.A..%.k.SZ..~W.....:)'B..ad......A..Eo...................A..Eo......W...........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	852
Entropy (8bit):	5.671650682950022
Encrypted:	false
SSDEEP:	12:ehRcUerNJICpmhRcgrNJIC3yhRc+QRrNJIC0hRc7erNJIC5o:eh6JICpmhXJIC3yhvaJIC0hFJIC5o
MD5:	9D8C14F0B46695A93EAADDF9A0834EFF
SHA1:	37AF828282415E1399A92C9209A1996CF3A64FA0
SHA-256:	8D6016CDAD3B9BE107AF7F90239CFFBF712019ECF891413BA889A9346C3FF009
SHA-512:	5B51C688FEFC782F662244D6CD91D447F01A9F105A6D6D94EBD7F3F6857747CCB182C5050F1D7ADA86C5802414F0FFB0820777B2FB227E9DCC12839C9BE66D6F
Malicious:	false
Preview:	0\r..m......U..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files-select/js/plugin.js ...WE.#/....."#.DM....0.A.;"./N_.,.:C..2....9L.H...3:...A..Eo...................A..Eo......\...........0\r..m......U..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files-select/js/plugin.js .ci.E.#/....."#.D..k..0.A.;"./N_.,.:C..2....9L.H...3:...A..Eo...................A..Eo......-.Qw........0\r..m......U..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files-select/js/plugin.js .G..E.#/....."#.D.....0.A.;"./N_.,.:C..2....9L.H...3:...A..Eo...................A..Eo.................0\r..m......U..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files-select/js/plugin.js ..W.E.#/....."#.D.:g..0.A.;"./N_.,.:C..2....9L.H...3:...A..Eo...................A..Eo......6J.#........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	5.593667163839036
Encrypted:	false
SSDEEP:	6:mOEYOFLvEWdrIhuAPxGLzgm2d/1TK6tX98OEYOFLvEWdrIhuO5yvLzgm2d/1TK6E:0RmeReh9SRJReJRyERexRLRe
MD5:	7F11AA7418A347DB05BC40D237595E9C
SHA1:	8CF61707EA1D7BE0BD15E084C12F214BE74DE5E1
SHA-256:	AEB6E6F1BE1834C54F45E5FFE429A881DD4810E6D69CE85111A025284721A9DC
SHA-512:	489EA2830C140B555F45CD6351300C5F9022E00955107AED8F0AC286A9890217E2B1119F0CEB5B60F1F799309816F0CC7CDBF1D0D1670E0F7EC9A2DC2F05911F
Malicious:	false
Preview:	0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js ...WE.#/....."#.D.V...0.AZ.Z}Q..4.o....0+..[\|..n:..U.W.A..Eo...................A..Eo......'. ........0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js .e..E.#/....."#.D.<k..0.AZ.Z}Q..4.o....0+..[\|..n:..U.W.A..Eo...................A..Eo......W .........0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js .q..E.#/....."#.D.....0.AZ.Z}Q..4.o....0+..[\|..n:..U.W.A..Eo...................A..Eo.......B."........0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js ....E.#/....."#.D.rf..0.AZ.Z}Q..4.o....0+..[\|..n:*..U.W.A..Eo...................A..Eo......9^I.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	5.631926624224222
Encrypted:	false
SSDEEP:	6:mAElVYOFLvEW1Kikx56uvp1TK6toAElVYOFLvEW1KTB2LWGOkx56uvp1TK6tGeAM:6JJKxuJJK0WKoiJJKQRMKLJJK5Q
MD5:	2246B51DD8025ABFD629DDA8DFC5CEA6
SHA1:	0B82DDA5B5EFDA64984D8B12B62B85004E2E0354
SHA-256:	93A80FB4B8CB79EFC1F8A6B95F76AA525EB76B4015257913331C729E67E0EAB9
SHA-512:	42AA1F617630710C4CF8ED550C6D07D0D58D5F6C54F8C7B0166C3015A6EF916ED1AC49F312C1BECB4529EC0D3FB679E7F7AB7F50DF85ACA7D69589DE3E349DCE
Malicious:	false
Preview:	0\r..m......<...)6......_keyhttps://rna-resource.acrobat.com/static/js/rna-main.js .n.LE.#/....."#.D'l...0.Az?...SwC...^..y.....V..7R-O.....A..Eo...................A..Eo......dZ.2........0\r..m......<...)6......_keyhttps://rna-resource.acrobat.com/static/js/rna-main.js ....E.#/....."#.Dm.I..0.Az?...SwC...^..y.....V..7R-O.....A..Eo...................A..Eo......._..........0\r..m......<...)6......_keyhttps://rna-resource.acrobat.com/static/js/rna-main.js .~..E.#/....."#.D.....0.Az?...SwC...^..y.....V..7R-O.....A..Eo...................A..Eo........d.........0\r..m......<...)6......_keyhttps://rna-resource.acrobat.com/static/js/rna-main.js .:..E.#/....."#.Du.I..0.Az?...SwC...^..y.....V..7R-O.....A..Eo...................A..Eo.......EKO........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.6226827985159185
Encrypted:	false
SSDEEP:	6:mWYOFLvEWdBJvvuugFGvhUDLYtmOZn1TK6tueWYOFLvEWdBJvvuPQhUDLYtmOZn5:xRBJE4KDcFZLuRBJcDcFZL
MD5:	D902494DDEB4F3F0B961FACD78E3579E
SHA1:	60B8C843DE5599E5BD4FEF7AACFAC6F30884B316
SHA-256:	7C055858699AB61C3C80FB3C83A6E4FAF6A7CD970471E337E1216B2E7CF8033D
SHA-512:	51B3597EA66F96F87F0C72B1C18D62733452E09349CB608454C198334C1151E4C439D19FB45C6C76ED68065BC292D54F9920CEA0797C984A96AC6BE815EB56E7
Malicious:	false
Preview:	0\r..m......V.....h....._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/selector.js ..T.E.#/....."#.D....0.A....t.q..W.EZ....1...[.zC.7mD..A..Eo...................A..Eo......f...........0\r..m......V.....h....._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/selector.js .r..E.#/....."#.D.X{..0.A....t.q..W.EZ....1...[.zC.7mD..A..Eo...................A..Eo......n.b.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	844
Entropy (8bit):	5.612946901682212
Encrypted:	false
SSDEEP:	12:BPHdrcoPHNcVRPHWKw0kcXHZPHzcOEc9c:BPHtcoPHNcjPHW50kcX5PHzcOEc
MD5:	8173BB6193375FE8B2020B9689415CB1
SHA1:	5F51CD1B218B72BB45B63BC6A4DA0F5CA87DC12B
SHA-256:	FA2C4DB8EB2C8BB2F8523F0AF446BB828DA398C8C349D26F177D165A4B21FD6A
SHA-512:	D427DBBC60FCDC93FA3A6AE4DD8B48FF4B125C0897E7C89BCB5259C7C97912CB649CE07A1A94F4CD609898E923E14ABA97EC3ADA2474055499FF45E043AE7970
Malicious:	false
Preview:	0\r..m......S...{.j....._keyhttps://rna-resource.acrobat.com/static/js/libs/require/2.1.15/require.min.js ..rJE.#/....."#.D.....0.A...L...Im.@.........E.nW...IP..A..Eo...................A..Eo..................0\r..m......S...{.j....._keyhttps://rna-resource.acrobat.com/static/js/libs/require/2.1.15/require.min.js ..I.E.#/....."#.D..8..0.A...L...Im.@.........E.nW...IP..A..Eo...................A..Eo.......C..........0\r..m......S...{.j....._keyhttps://rna-resource.acrobat.com/static/js/libs/require/2.1.15/require.min.js .L..E.#/....."#.DJa...0.A...L...Im.@.........E.nW...IP..A..Eo...................A..Eo..................0\r..m......S...{.j....._keyhttps://rna-resource.acrobat.com/static/js/libs/require/2.1.15/require.min.js .r..E.#/....."#.D.y7..0.A...L...Im.@.........E.nW...IP..A..Eo...................A..Eo......QQ$.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	5.590560280318395
Encrypted:	false
SSDEEP:	6:mKPYOFLvEWdENU9QOrNPiM3Y1TK6tG+KPYOFLvEWdENU9QIk0J7PiM3Y1TK6tg:bJRT93rFr0wJRT9Hk0dr0
MD5:	C933E2D82B3A806C71D649671171F938
SHA1:	90EE75FB10F949D819A1F7D822400CE994A2E230
SHA-256:	6A48E42A159631DF094F1164E8FB80207B1EA7A4B7CF6AD88A7255E5E06A8700
SHA-512:	E2FE8DE5E2F33DFB28575C24D46DCA54950FD173A5D9A74419BF0754BF062122BF67EE74111A8F9E20F2959BC0DFB75E63C62DC4021A8CAF2F1EE10B8A301E2A
Malicious:	false
Preview:	0\r..m......P...Yft....._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/plugin.js ....E.#/....."#.D..y..0.A...M....m+lS..e.....<7.U.P8.0K.A..Eo...................A..Eo........~.........0\r..m......P...Yft....._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/plugin.js ...E.#/....."#.D+.q..0.A...M....m+lS..e.....<7.U.P8.0K.A..Eo...................A..Eo........r.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	5.612197399405848
Encrypted:	false
SSDEEP:	6:mQt6EYOFLvEWdccAHQntdjBRCh/41TK6t6MQt6EYOFLvEWdccAHQKkMIjBRCh/4f:XRc9iPDi/EQhRc9ODi/E7
MD5:	344BD46BCC1D479D66AAE6BB9F69E2C1
SHA1:	B4F7BD20A7AAE931695CDE612E25B2C181C61E3E
SHA-256:	101D48E588F30120458FA462B55E28CF3E585F3E55543C35441CCE120915EACA
SHA-512:	E9F9D916BD988CE6B23152A3CD5C241F81251A4547CDFB1A696E6A7A9CF417E00E5B5D2AAACB76CE988DC6BE2A0837015D5CEB9A6D079834DECCFE7D661BD1D9
Malicious:	false
Preview:	0\r..m......P...W3......_keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/plugin.js ..c.E.#/....."#.D....0.APJm...0x.x..RD...BB!@5..<..]....A..Eo...................A..Eo......q..1........0\r..m......P...W3......_keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/plugin.js .r..E.#/....."#.D\....0.APJm...0x.x..RD...BB!@5..<..]....A..Eo...................A..Eo......^..g........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	462
Entropy (8bit):	5.577982444048799
Encrypted:	false
SSDEEP:	12:bs6xRkiGz/6LlF4nsws6xRkiabLlF4nC:brxp6/6oswrxpso
MD5:	348CF8B9E8E04166961F8DDAA708A964
SHA1:	4272AAB7A02938788CF43A481CA5337B9A42252F
SHA-256:	43DA04B1C7A268943030378292FC179785495B025384647EE31023CB5EBF1D0D
SHA-512:	08F7DD3B1FC26ABB8C6650FE4762C24E9B5A85C65F6F43B6A3543B96F47462FEB6E725B870F818BC479E91D8A97B98B8564930D53038C8B3CDA96A898F13EFCE
Malicious:	false
Preview:	0\r..m......g...~.I?...._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-selector.js .7.WE.#/....."#.D.....0.A.P...#4..l....5...5..).w.. .h.~..A..Eo...................A..Eo................0\r..m......g...~.I?...._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-selector.js ..-.E.#/....."#.D.c...0.A.P...#4..l....5...5..).w.. .h.~..A..Eo...................A..Eo......wy..........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	modified
Size (bytes):	430
Entropy (8bit):	5.540411427576483
Encrypted:	false
SSDEEP:	6:mhYOFLvEWd/aFu57iY941TK6tjcf2hYOFLvEWd/aFu7k941TK6tWz/:WRbz9EJceRdk9EM
MD5:	1295AB94DDB1A130AFD911234D4E89CA
SHA1:	50074CDB73494C3C9B85DC44FB7DE009AFF1B0B8
SHA-256:	EDF22C9DDC3A821B617C52B2EC8B2DCD18B8B3B93E620A309E795640C277B595
SHA-512:	836FAD401936FDD860222D8C31C9A76B54F264A8E12C9C6081B5C4B95ED189EC00841FE13E3B5AD72A5F3304AFF60377A804D2ACF1AB9F500E98E7148EA3384A
Malicious:	false
Preview:	0\r..m......W....w.m...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-recent-files/js/selector.js .A1.E.#/....."#.D.....0.A...a.f.m.i.o.p..3U5.....^...I.A..Eo...................A..Eo.......4.9........0\r..m......W....w.m...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-recent-files/js/selector.js ....E.#/....."#.D....0.A...a.f.m.i.o.p..3U5.....^...I.A..Eo...................A..Eo......<E,.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	5.56352629963541
Encrypted:	false
SSDEEP:	6:mR9YOFLvEWd7VIGXOdQG3nVvAGoBMqVd3G4K41TK6tg6+R9YOFLvEWd7VIGXOdQp:2DRuRPe5B9Vd2kgDRuROOpB9Vd2k
MD5:	A5945F76BC3FC56CD102184E6A87875C
SHA1:	EBCBCA93ACA1F1655103B10E9F6218FCBB2EABEE
SHA-256:	857216CB0CBEA1C2BAADBC7200AED158D1F7E9231B3737FDE64D571FE1E2EFC3
SHA-512:	120C830296911589140FE5393B66C7BC19C1FAE6EE0D65F84423D478BE2EA135F5D62EE0B3A4C0EF96873DC64201CAE382FE86B7209FBB3E5516A551A97C5CD4
Malicious:	false
Preview:	0\r..m......P...y.p....._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/plugin.js ....E.#/....."#.D.....0.A..y.$..$.v5j...T...z.]..._S....A..Eo...................A..Eo..................0\r..m......P...y.p....._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/plugin.js ....E.#/....."#.D.u~..0.A..y.$..$.v5j...T...z.]..._S....A..Eo...................A..Eo.................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	5.595627410266506
Encrypted:	false
SSDEEP:	12:+RQqeIrnHURQ5DrnKsRQXcrneRQ7Jrn93:+9Dn00nKsYAneydn
MD5:	3D79C89BEF3295FF031232DA43EC6EB4
SHA1:	BDE1FE92F2EE923B649F2FB2989B8DFF9FAD8760
SHA-256:	3A77224AA89BD0C63C8C3A166259D67835DA44901C094728BD612CD1F93C2E2F
SHA-512:	DD26A8A9DE652D810B24A28738D3D3BC7BCFCD54CFA6768213225ACC53A924EE6F7DB00F29EE2DB0342DA234860873FB8ED09654D9CC8F0BFEED6639441DAFC3
Malicious:	false
Preview:	0\r..m......P...gT....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/plugin.js .)vZE.#/....."#.D\|....0.A#..@..k(v.8g..5.~_....]Pj...6.A..Eo...................A..Eo......[..U........0\r..m......P...gT....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/plugin.js .=..E.#/....."#.D.....0.A#..@..k(v.8g..5.~_....]Pj...6.A..Eo...................A..Eo.......p..........0\r..m......P...gT....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/plugin.js ..T.E.#/....."#.D.P!..0.A#..@..k(v.8g..5.~_....]Pj...6.A..Eo...................A..Eo.........L........0\r..m......P...gT....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/plugin.js ....E.#/....."#.Dy....0.A#..@..k(v.8g..5.~_....]Pj...6.A..Eo...................A..Eo........i.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.568573373867437
Encrypted:	false
SSDEEP:	6:moXXYOFLvEWdENUAuVyC8n1TK6t/ltMoXXYOFLvEWdENUAu7R+ZMksyC8n1TK6tm:xhRT/7QZXzhRT5EM7Qo
MD5:	7FB9A25CDEDC0F78A45266E3A6169A75
SHA1:	0D496101CDE962601E606ECC5B83110E93C071ED
SHA-256:	728A9755B5F81181E0F2000CDACCE4B5C8B4C8ABFDD49BC0ADBC47A011574809
SHA-512:	A0E2A35CC2F2A0E452DAEE2781108E22118ABED39B9A28E64CDA7C0C4868A36C7CE4AD1842E02288F1600E8DE1E1E57A6DA4CBF3BE44DE0AFF3D7BFB8AF8D71A
Malicious:	false
Preview:	0\r..m......R..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/selector.js .}..E.#/....."#.D2.r..0.A8.../...;.\\o....1..........+..A..Eo...................A..Eo........^.........0\r..m......R..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/selector.js ..n.E.#/....."#.D?om..0.A8.../...;.\\o....1..........+..A..Eo...................A..Eo.......Wq.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	5.638365697318789
Encrypted:	false
SSDEEP:	12:nRrROk/VC2MmWXRrROk/VomCRrROk/VNmERrROk/V+cm8:nPJ/M2hGPJ/rCPJ/SEPJ/sR
MD5:	41641895746864AEED9E70161C272A48
SHA1:	3821D397D7BABFC564E02DFAF3FFFE913F13AEF2
SHA-256:	18D877891792A62DE0A9FAB934A35AA31C32062FA9FC98C0CBE984FE490AB417
SHA-512:	DACB4BDCA04A2E313A82E8C139B99CA1591385A8FC0CB38D9262E9DFF837740376293F8F992BD633F686CEFE8D784F2A01E9E9D9389A387760723B173BCCFC40
Malicious:	false
Preview:	0\r..m......]......,...._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/plugin.js ...WE.#/....."#.DC....0.A ./.ev......N~..6.b.....$.j;:C...A..Eo...................A..Eo......tv..........0\r..m......]......,...._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/plugin.js ..k.E.#/....."#.DL.k..0.A ./.ev......N~..6.b.....$.j;:C...A..Eo...................A..Eo........Tu........0\r..m......]......,...._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/plugin.js ....E.#/....."#.D.....0.A ./.ev......N~..6.b.....$.j;:C...A..Eo...................A..Eo......Ab(.........0\r..m......]......,...._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/plugin.js .'Y.E.#/....."#.D.~g..0.A ./.ev......N~..6.b.....$.j;:C...A..Eo...................A..Eo........`.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.561508736735259
Encrypted:	false
SSDEEP:	6:mZ/lXYOFLvEWdccAWuhs/GAdm9741TK6tWt2Z/lXYOFLvEWdccAWumIXWKSRBFGs:qxRcOGAdu7EE6xRcJXWvGAdu7EJ
MD5:	4AFF780C1EA40FF889BB2324410D2870
SHA1:	6C27A08BC904759BD6C313D2174605426581954D
SHA-256:	5F22DE000EA62158833B0039FE9279F0E6D31BEC175C04E2EDD2521B9566B7C6
SHA-512:	BE0EEB90542A6D8B823ACFB1E0449B86BFE074E4912F4F35F607ED93FBF3D9EC698B59B609FFB214C898A504D50FCC308C02F1E39ADE9D6056EF627280403DB5
Malicious:	false
Preview:	0\r..m......R...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/selector.js ....E.#/....."#.Dx....0.A...U...I.>P...X...x..0U.~;m.x.k.A..Eo...................A..Eo.......9.........0\r..m......R...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/selector.js .b..E.#/....."#.D./w..0.A...U...I.>P...X...x..0U.~;m.x.k.A..Eo...................A..Eo.......r..........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.557735052448219
Encrypted:	false
SSDEEP:	6:mMOYOFLvEWdwAPVuC7SJn1TK6tQMOYOFLvEWdwAPVuLSJn1TK6tg/l:2R1VcLaR1pL
MD5:	F481D379BE3CE3649A56EF890CB103CC
SHA1:	E565CBAA75DF9934CE10914D04F2A5A5F396CD72
SHA-256:	03E211BB6BD20936AE139105782D31A98E64E154A787349EFB45672C52E6E56C
SHA-512:	2B605566D4149E00CFCDA6502D607D83C7E3839C01DFDB60339928EF987328629CA9C910639F4F14D33B0E1A8C9CB01388BBEEE983C96042CDC49137CEC30B10
Malicious:	false
Preview:	0\r..m......L....Ey....._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/selector.js ....E.#/....."#.Dr.s..0.A.....k....F..D..O.n;[.1m.....=..A..Eo...................A..Eo..................0\r..m......L....Ey....._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/selector.js ..l.E.#/....."#.D.Pm..0.A.....k....F..D..O.n;[.1m.....=..A..Eo...................A..Eo......v.I.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	424
Entropy (8bit):	5.68614323599123
Encrypted:	false
SSDEEP:	6:m3PXYOFLvEWdBJvYQCzhcsBXIh1TK6tbl/23PXYOFLvEWdBJvYQaJzhcsBXIh1TF:mxRBJQxDB01tWxRBJQfJDB0P
MD5:	EA49AF970F9F7C37ECE424903ECD31D1
SHA1:	B30FADB414AF176AA5B59A03E78B87673A1BC1C6
SHA-256:	57BBD203666AFC2B7C75ED3ADFC6CAF0728A1397DFF870CA2E81DB5F1E91CB9A
SHA-512:	AB5C0AE344F9BDC5CEF53C18F864378E2A7298B2ECF3844550CBC1E9B7398B6E80360C01A447229F42CBFA08BF41914F0A1BACCF5C9477C6AA646A9B37765C78
Malicious:	false
Preview:	0\r..m......T......z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/plugin.js ....E.#/....."#.D....0.A...k..`..N3.... ..d..$[.....{.A..Eo...................A..Eo.......1..........0\r..m......T......z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/plugin.js .w6.E.#/....."#.D..~..0.A...k..`..N3.... ..d..$[.....{.A..Eo...................A..Eo......?..)........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	5.5940524283171635
Encrypted:	false
SSDEEP:	12:3RrROk/sRE2ccRrROk/s8lc2RrROk/sJ2cI/RrROk/syYkc:3PJ/v/cPJ/M2PJ/GoPJ/LI
MD5:	59CA02C939EE3630CF5597D5E07046CB
SHA1:	17439216FBA024C9C1552455B885C92BBA64384D
SHA-256:	00DF701915D3C01F3F4704EB1C0E170F480865D7F899EC157924147B151C7B86
SHA-512:	60EF763F295FC6B5B01AB4225732A8DB85B436DEEAC9F1A413425BF8D40964F0C40CB49613E6C63467A2C4E417ED5B1CE6873DC33B03A5B668221F697CCC95CE
Malicious:	false
Preview:	0\r..m......d...<.s....._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/plugin.js .>.WE.#/....."#.DQj...0.A.....9Q].8O.z....=..:.N.{....N{.A..Eo...................A..Eo........Sn........0\r..m......d...<.s....._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/plugin.js .d~.E.#/....."#.D..k..0.A.....9Q].8O.z....=..:.N.{....N{.A..Eo...................A..Eo......n..+........0\r..m......d...<.s....._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/plugin.js .=..E.#/....."#.D. ...0.A.....9Q].8O.z....=..:.N.{....N{.A..Eo...................A..Eo.......:.i........0\r..m......d...<.s....._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/plugin.js ..Y.E.#/....."#.D,.g..0.A.....9Q].8O.z....=..:.N.{....N{.A..Eo...................A..Eo.......)..........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	2064
Entropy (8bit):	5.338270495347256
Encrypted:	false
SSDEEP:	48:h1zZ4+dsp6skxylHW5q1p1VH4cHwEHIYU8EA9uuqHAbzbxtHvD7M9yMtpyendLFO:hX4p6srlHMOp1VH4cHwEHIr8EA9uuqHK
MD5:	23A1A85744D5735C1538C2B3AA76EDE4
SHA1:	1EF91A0B86B687AA387AA38358A4A000144F944B
SHA-256:	B4C30BCEDEAC892781B911051B7093E72857C6D7751B3AD08BDF8D8997761C46
SHA-512:	9A50E0F1CA37A9511C875F0996AD677A8A014BEB95E05C2B6489093FEE75C7CECD6007536A1DE5C72DA9543768B05491D950349DEA75D1DC504F11F8878C3A1D
Malicious:	false
Preview:	....h...oy retne....'........'............;.y~A..z.B_./..............z.B_./..............oB.8.B_./............#...(...A_./.............k7A..z.B_./.............D.4..z.B_./..........[.i..%..z.B_./.........<...W..J.8.B_./.........,+..._.#.z.B_./..........J..j....z.B_./...........6<\|....8.B_./.........A?.2:...z.B_./..........+.{..'.z.B_./.........)....J:.z.B_./...........2q.....z.B_./...........P....V.z.B_./.........+.U.!..V.z.B_./............P[. q.z.B_./.........!...0.o.z.B_./..........u\]..q.z.B_./.................z.B_./................z.B_./..........o..k...z.B_./.........^.~..z..z.B_./.............o..z.B_./.........Gy.'.h..z.B_./.........F..=z;..z.B_./...........3....z.B_./..........v...q...8.B_./..........C..M.....A_./...........a.....8.B_./..........~.,.4>..z.B_./..........&.S.....z.B_./..........@..x..z.B_./.........=....m...z.B_./..........;/....z.B_./..............q..z.B_./............MV3...z.B_./.........:..N.A...z.B_./............B_./.0......poy retne

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.178403825159476
Encrypted:	false
SSDEEP:	6:mwGTmyq2PWXp+N2nKuAl9OmbnIFUtpDG6cu51ZmwPDG6cuvRkwOWXp+N2nKuAl91:aT7vaHAahFUtpK6c21/PK6cY5fHAaSJ
MD5:	792A876184A16A16A277E9BD0C0F7554
SHA1:	55152B43962570E515248577537E6126B582E842
SHA-256:	7D804C31CA09591948830058C961735346FA1F0C2B4141C1ABAF5B8CB83EA12C
SHA-512:	39F90CD2C7A5ABC9AAB88EF06DE4A8BD89A66A2250C239A381D91F95629CD41AE683B2038466F1665FE82AE9179EFE8A671EB37D64AA642672B10F15AA4BB957
Malicious:	false
Preview:	2021/06/11-10:39:20.154 15a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2021/06/11-10:39:20.189 15a0 Recovering log #3.2021/06/11-10:39:20.189 15a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	0.010450311063861047
Encrypted:	false
SSDEEP:	48:TGEiaGEiCsMi9sMiDdsmWiDdsmWiDOsmWhCDTsmWhCDoDsmWhCDoDsmWhCDoDsmf:tFVFVAnfnovnovnovnovnovnovno
MD5:	C5320DB321A0EC2EA0AEE50ACE073382
SHA1:	2E3A5F1F8C5FE89B022C94BD3574BECA1445D34D
SHA-256:	10CB1245EF4F539D1B2E962879068A09BDCFD07FCEDB103F78A17338C73A6B22
SHA-512:	1FC54F5F46BFBF53AD1955165B9D246B1F351CA134578A028B118A3F887B8F72F710776A7FDF45731CE6DA20ED37FE07AE67FFD3B3236B845FC1140178C8D153
Malicious:	false
Preview:	VLnk.....?.......Tq.>..j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-210611173915Z-215.bmp Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PC bitmap, Windows 3.x format, 114 x -152 x 32
Category:	dropped
Size (bytes):	69366
Entropy (8bit):	1.0112122137822999
Encrypted:	false
SSDEEP:	192:35w5q5ZUY54ePnK5b6pLPUHjHzLgzk3gLbpoALbmo6nAPSl:348zrvq6w
MD5:	4565A9F519E1FC5EC62C689AC8F5C1C9
SHA1:	7F50DA6A2B1CDEBFA26470B5BC118A4E9A1F47A6
SHA-256:	F2430B5E3D5E24C0BBE6270233AF0CB8382977C34444813410A6CE81795CFE2C
SHA-512:	83F938995B253AB58F98C0E5CBF0B98B587E4E1DCD1B29CE56416BFC097D0D45ECC1DF2417C5C28785FED2CA09387DA7E7EDD3E18015158BB0C1DB5AB71A4471
Malicious:	false
Preview:	BM........6...(...r...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3024000
Category:	modified
Size (bytes):	32768
Entropy (8bit):	3.386711081908555
Encrypted:	false
SSDEEP:	96:iR49IVXEBodRBkQaOhFVCsL49IVXEBodRBkREaOhAVCs749IVXEBodRBklEaOhQ6:iGedRBOedRBdedRB7edRBm
MD5:	8E0AB7D815B1AFAD297558F04AD6BEB7
SHA1:	46885C4EDC08DF18FE59EAA061CE732CCFF75C77
SHA-256:	2F4BE45D570ABF4190E8D1A9A879164B078772F4DC74923B4455D7B6A75753D9
SHA-512:	8BCF169D9360A18BF374182409955AD92D0010B1EBA372C42649DFEAD2B5D9F1B7A89EE13104BB7CC734EAB773D5C958D7DF689DB251648DDC4D47AAA11546B7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................$.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	34928
Entropy (8bit):	3.199765215919205
Encrypted:	false
SSDEEP:	96:e7OhFVCP4949IVXEBodRBkJcaOhFVCsUfLR49IVXEBodRBk1EaOhAVCsyd49IVXy:e8iedRBsfLGedRB3CedRBfyedRBc
MD5:	478CD4C00FE99F426AAF674DFC40D9B8
SHA1:	BED188F03FC50BB3CDDEEFF245CD547AE3A3DF9F
SHA-256:	F93644A57F010AC867FB65FFD90591EB25AE6922308E89796AAFBA1C9A1BAFCA
SHA-512:	BAC2065A6856CB1A0193292B22785E185C694A40056612CD5E415C04041EF4627F418EED790C154FB11E13EBB1E76A17F6D2ED193377AAA4845FBA9D87E7D950
Malicious:	false
Preview:	...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................X...h...y................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\6T0VAUN5\www.adobe[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1201
Entropy (8bit):	4.841167538951289
Encrypted:	false
SSDEEP:	24:W0U1mKm6DOnPU1mKm6DOny6unPU1mKm6DOny6unAXnPU1mKm6DOny6unPU1mKm6m:0sKO8sKO48sKO4A8sKO48sKO48sKO41
MD5:	1E2A3B9A6A2A4310B284856E2ACEB18A
SHA1:	C8C1F1BAE4F1E32447694480DC716909E9F8A1C6
SHA-256:	BB2910C86C48F6D78510C3EBC3278424F03BC61C1F1D0C519859E3ABEB1316D9
SHA-512:	FB527C18F4E933A1BF0D345F60CBF900E9E09009DBE953CB04A65742DD8E24E0ACE9ABECD20C5C1EA35B82C687EAE125D5957DBB194F1F368876D07DDA3F770B
Malicious:	false
Preview:	<root></root><root></root><root><item name="com.adobe.reactor.dataElementCookiesMigrated" value="true" ltime="4021717408" htime="30891752" /></root><root><item name="com.adobe.reactor.dataElementCookiesMigrated" value="true" ltime="4021717408" htime="30891752" /><item name="mar_aud" value="Bot" ltime="4024097408" htime="30891752" /></root><root><item name="com.adobe.reactor.dataElementCookiesMigrated" value="true" ltime="4021717408" htime="30891752" /><item name="mar_aud" value="Bot" ltime="4024097408" htime="30891752" /><item name="isStoragePolyfillNeeded" value="true" ltime="4025617408" htime="30891752" /></root><root><item name="com.adobe.reactor.dataElementCookiesMigrated" value="true" ltime="4021717408" htime="30891752" /><item name="mar_aud" value="Bot" ltime="4024097408" htime="30891752" /></root><root><item name="com.adobe.reactor.dataElementCookiesMigrated" value="true" ltime="4021717408" htime="30891752" /><item name="mar_aud" value="Bot" ltime="4024097408" htime="30891752" /

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\QUN6RYTY\spark.adobe[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.745229021359919
Encrypted:	false
SSDEEP:	3:D90aK1ryRtFwsnObemKmlULF0VqHlJR37ccy/NsqSeUSQGLKb:JFK1rUFjgemKm6GVqHlJR3Yv/ueLQpb
MD5:	7ECB26FB33F1B14500E9D9CDCFB13DDD
SHA1:	CEC8897E78C7B09F9EF33E60B2335C96D302921C
SHA-256:	9C583A24ED234A94AB76E39EAB2F6559DDCC3AE249C475FBBCE0D5E4ACDCD280
SHA-512:	BD50604C3F501A45FF2A7EC3E013DA220D53CDBC7EDD671609B474F68809C184F8A1261054EE9D17C6ECB8DE22C8E6292D258E534049F0475F704A2BB632B99E
Malicious:	false
Preview:	<root></root><root><item name="com.adobe.reactor.dataElementCookiesMigrated" value="true" ltime="3999627408" htime="30891752" /></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{135EBDC3-CADC-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	32856
Entropy (8bit):	1.8512068900747847
Encrypted:	false
SSDEEP:	48:IwvGcprGGwpLxG/ap8FGIpcpYGvnZpvpmGvHZp9p5GoTqpvp2Go4XpcXGWvrvuGZ:rlZeZ12HWDtxfytvXW9UZtjy3
MD5:	EB2D2B22625666B8E26F7FBCCDF16B94
SHA1:	B4EEFFB0837C46BAB27003911360D8DD460C17B2
SHA-256:	926DD3E0D490ABB2AE66F1340839D723694866CEF3DF18D801D5FAD857AC1764
SHA-512:	7D7BE11A1409EA0CB636F81769D05E53A9304B2C74EA1085EB88571245579E77E5BE0954A37BA5E160055BDB7CD17F003D2D5E0D94027D9072C9D11EF4198DB3
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{135EBDC5-CADC-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	179124
Entropy (8bit):	2.544860081756992
Encrypted:	false
SSDEEP:	768:5NUFSGXj+izGCtUY53uMXl704uQAWsqq/Rin:GlX06
MD5:	380FF961B9F3C146284263EE515670E0
SHA1:	59C3CB030B958C26C900BE4A9A7FF2E0879EC1AB
SHA-256:	C65DDCC35D66518253DF56B51487557606EF8A1F7A1F156C2E38B3B2D1395BB4
SHA-512:	244FC3BD2CD1507221A3862C338B5A05F0521E9A07327109AB8BCC0A07A607435054AA9371B22071CA41D8FA764C530BC5FFC58757A51B667AEB0979D27D514A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1A6D0B25-CADC-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.566170173685886
Encrypted:	false
SSDEEP:	48:Iw9GcproGwpaVG4pQdGrapbSTtGQpKhxG7HpRicTGIpG:rjZwQH69BSTXAhgTzA
MD5:	4B229DB768417EC48238852B4112D225
SHA1:	B4324BD52E8F48D0D42BAC13098DB3D0BFB0A2E7
SHA-256:	3EB54C3E904DA1136885987DE5C2D5A7C2EF99982626187FEF3F985F5B1CF8C0
SHA-512:	5D423A109F66C7A2DD53E5B52EBBEB1C48CFD46D209ACCAAB5223985141809C2B893317F02CC1A8EC28E826D2EADAD159A860A7289C15B0D73411E29F6982AFF
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	28454
Entropy (8bit):	2.0664698546460576
Encrypted:	false
SSDEEP:	48:R6fVgizzxxEKzOQBbcpS5WT//zVJrc7gzdbklTMl1sy6TMenl7ulGt/3GmjAA2XI:Mdx70sI2NmU3G8cj70sI2NmU3Gz
MD5:	1F2BBE148080EDB61592819A2732E291
SHA1:	AF6D839E8AA1BD1283B70E05216A92E9C7A06E64
SHA-256:	B5C55B0E2C030849298D748810D49A9F2A8C75FDF7BF7C888FE0F6B629F7FDE4
SHA-512:	B2E79DA1305637469747C8588ED07C5A2CBC8AD7DD5140E229A8619CAB0BBBF97C248C279844E1A406A688CC7CF867A2347ED0383A6250C971D56C37893A5B60
Malicious:	false
Preview:	B.h.t.t.p.s.:././.p.a.g.e...a.d.o.b.e.s.p.a.r.k.-.a.s.s.e.t.s...c.o.m./.r.u.n.t.i.m.e./.1...2.2./.i.m.a.g.e.s./.f.a.v.i.c.o.n...i.c.o........... .... .........(... ...@..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................70..7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...70..............................7`..7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7`......................70..7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...7...70..................7...7...7...7...7...7.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Adobe_favicon[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel
Category:	downloaded
Size (bytes):	9662
Entropy (8bit):	1.5933577223587498
Encrypted:	false
SSDEEP:	48:97gzdbklTMl1sy6TMenl7ulGt/3GmjAAp:970sI2NmU3GY
MD5:	B28BF60DD7E50B6DFFD394EBC0F9057A
SHA1:	9EA7EED87B689757780322989EF426AEFFDC8F7A
SHA-256:	BF24C9E4D37F94D4BD2F870228FF421CA54B2949DB3391DBD3818EC0E6DB0F5F
SHA-512:	B16A7F756E38FFE4BBCC0394A6E41593CC9FE68AACA6350C1C20D10E7A284EBFC7937C15726D0F43A3ABD7C43D128A041A109CAC2C8F240707FE1997E633E025
Malicious:	false
IE Cache URL:	https://www.adobe.com/content/dam/cc/Adobe_favicon.ico
Preview:	......00.... ..%......(...0...`..... ......$.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................A...........................................................................................................V...............................'...............................................A..........................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Contact_72px_lt-gray[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	28341
Entropy (8bit):	6.120769466888277
Encrypted:	false
SSDEEP:	768:37iSZiRcO9jD+7ZBNq+2owtRXhhMEnWLbljThoIJ5q:cRzGZBk+2owPleZX5q
MD5:	901C088DD283B59F4A43F74D798EDC60
SHA1:	959EA9066F892F103A3DDA229D67619150F7DD7B
SHA-256:	C45E2555412C2D5EC5E521ED5851B3D3665F90DD1DC645D6D59DEEFD71BC2ECB
SHA-512:	DAE5CFA3F362280B2D903FC35C6290AB28CCF5E5E5EA6C081B2EFFDBC20AA34301085DFAB35A0EFF5B6ECC7ED6C049668D95274DDF8A06314D60FD612A004555
Malicious:	false
IE Cache URL:	https://www.adobe.com/content/dam/cc1/en/privacy/images/Contact_72px_lt-gray.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 19.2.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" [..<!ENTITY ns_extend "http://ns.adobe.com/Extensibility/1.0/">..<!ENTITY ns_ai "http://ns.adobe.com/AdobeIllustrator/10.0/">..<!ENTITY ns_graphs "http://ns.adobe.com/Graphs/1.0/">..<!ENTITY ns_vars "http://ns.adobe.com/Variables/1.0/">..<!ENTITY ns_imrep "http://ns.adobe.com/ImageReplacement/1.0/">..<!ENTITY ns_sfw "http://ns.adobe.com/SaveForWeb/1.0/">..<!ENTITY ns_custom "http://ns.adobe.com/GenericCustomNamespace/1.0/">..<!ENTITY ns_adobe_xpath "http://ns.adobe.com/XPath/1.0/">.]>.<svg version="1.1" id="adobeNews_x5F_72_x5F_lt-ou" xmlns:x="&ns_extend;" xmlns:i="&ns_ai;" xmlns:graph="&ns_graphs;".. xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="72px" height="72px".. viewBox="-359 271 72 72" style="enab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\GG8mUEsjQvSUh[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	52203
Entropy (8bit):	5.20614071782965
Encrypted:	false
SSDEEP:	768:8n8+27e5FyW7F1FnWO8JARtEeqakKnMrb:8nT224W7zhWO8JCnMf
MD5:	02DF9DD00895D7E0017A343FCD94B7A7
SHA1:	982E84D3E85CCDEAB0C881FB9B5CDCEF3D676B95
SHA-256:	B49AD6B8BA2A9617DD8F02411CE66B6579D95DDA2F8D625B946EE679EAB3DCE0
SHA-512:	AE52F0F90DDC9262A3DA0553E63256A66657C363FE3AD760809AEFA80BE3A278169A3BF936E9870029525ED62627EA920CFB5A1C3EA9AB3264C5F259BE1BBC96
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_29, Description: Yara detected HtmlPhish_29, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\GG8mUEsjQvSUh[1].htm, Author: Joe Security Rule: JoeSecurity_HtmlPhish_29, Description: Yara detected HtmlPhish_29, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\GG8mUEsjQvSUh[1].htm, Author: Joe Security
IE Cache URL:	https://spark.adobe.com/page/GG8mUEsjQvSUh/?page-mode=static
Preview:	<!DOCTYPE html>.<html>.<head>. <meta charset="utf-8">. <title>Auric Partners</title>. <meta content="yes" name="apple-touch-fullscreen" />. <meta content="yes" name="apple-mobile-web-app-capable" />. <meta content="black-translucent" name="apple-mobile-web-app-status-bar-style" />. <meta content="width=device-width, initial-scale=1, maximum-scale=1" name="viewport" />.. <meta name="robots" content="noindex">.. <meta property="og:title" content="Auric Partners">. <meta property="og:type" content="website">. <meta property="og:image" content="https://spark.adobe.com/page/GG8mUEsjQvSUh/embed.jpg?buster=1623333594506">. <meta property="og:image:width" content="1024">. <meta property="og:image:height" content="512">. <meta property="og:site_name" content="Adobe Spark">. <meta property="og:description" content="A story told with Adobe Spark">.. <meta name="twitter:card" content="summary_large_image">. <meta name="twitter:title" content="Auric P

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Privacy-Header-2-1440x340.jpg.img[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=0], baseline, precision 8, 1440x430, frames 3
Category:	downloaded
Size (bytes):	87554
Entropy (8bit):	7.97194369897045
Encrypted:	false
SSDEEP:	1536:jTiiUlWRB717xEVxvzDwgBFxks8cVzjNeyjFLdAZBc2:jT6AB/41is8cNRbjtdI1
MD5:	36815147C5BD0A82CF08ADF18C4CE9DB
SHA1:	F5FE3F3312117D43AF628780AD94F7409F51BC51
SHA-256:	FA058BE1A59315346088172661F221BB988B929F4FE9CA7C2C98F49970D0109D
SHA-512:	2DD8E040B9046322F4259ABC673BB1CD980E440FE0D1EE5BFD6FD6FFC14D36F810BB0222E1413ECF65A49C335F894923C365F0E7E6C0BB6DC69A4A3DBF05E406
Malicious:	false
IE Cache URL:	https://www.adobe.com/content/dam/cc1/en/privacy/images/Privacy-Header-2-1440x340.jpg.img.jpg
Preview:	......Exif..II*.................Ducky.......F......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8005f268-2f6e-41f7-b266-aa21258a942f" xmpMM:DocumentID="xmp.did:1DF2B77A0FFC11E6838996FD381AB7D0" xmpMM:InstanceID="xmp.iid:1DF2B7790FFC11E6838996FD381AB7D0" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3a3c0c1d-b343-4643-ac1e-d229304d8b58" stRef:documentID="adobe:docid:photoshop:c44cf741-5865-1179-9b5f-a5ee13961278"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\PrivacyChoices_72px_lt-gray[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	28419
Entropy (8bit):	6.117998475478093
Encrypted:	false
SSDEEP:	768:37S2WvPzXeJfwU2ihjrx8Ks+a/4TLpCknorFPBHCJ93BvxHtc6:0HzONH2ihRLM/4H8korVBiH3jZ
MD5:	775D2556523FF33568DCF0EE25C3249B
SHA1:	8575AF9EDFEB7E1A2D1B7A36DA34F13594CFD7F1
SHA-256:	241B307DFAB1F3CA3C626DF06C32F5472777A4316013981A121B951911B311FE
SHA-512:	5ED60101D06A32FDA1D8A979FFC701641577DD694987ABAE741B7B154AFDAAFBDE1A294EDB66AC14B1B8C3D82BB184B5BEE9E1F92000FF8669F8D99626645E34
Malicious:	false
IE Cache URL:	https://www.adobe.com/content/dam/cc1/en/privacy/images/PrivacyChoices_72px_lt-gray.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 19.2.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" [..<!ENTITY ns_extend "http://ns.adobe.com/Extensibility/1.0/">..<!ENTITY ns_ai "http://ns.adobe.com/AdobeIllustrator/10.0/">..<!ENTITY ns_graphs "http://ns.adobe.com/Graphs/1.0/">..<!ENTITY ns_vars "http://ns.adobe.com/Variables/1.0/">..<!ENTITY ns_imrep "http://ns.adobe.com/ImageReplacement/1.0/">..<!ENTITY ns_sfw "http://ns.adobe.com/SaveForWeb/1.0/">..<!ENTITY ns_custom "http://ns.adobe.com/GenericCustomNamespace/1.0/">..<!ENTITY ns_adobe_xpath "http://ns.adobe.com/XPath/1.0/">.]>.<svg version="1.1" id="adobeNews_x5F_72_x5F_lt-ou" xmlns:x="&ns_extend;" xmlns:i="&ns_ai;" xmlns:graph="&ns_graphs;".. xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="72px" height="72px".. viewBox="-359 271 72 72" style="enab

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\RC5e5d1b9fe0a942c38190dc2199529941-file.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	C source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	1568
Entropy (8bit):	5.27597051838108
Encrypted:	false
SSDEEP:	48:15+sregiQhdsitymtCZv4j+YuteKhXSXNjTjOofbOK5b/q:1ksrPld3tymtCpLYuteMXSXNjTjhT5q
MD5:	8F7C77F0608AE9AB17E6E07745FD24A9
SHA1:	850FF8C69723B05D83558C9832C294607C0E1C3F
SHA-256:	E49AE1EE55CC0DB995DCB4F734C59AEC3669F9532926B03EA8912435FB777573
SHA-512:	4E957A29AB4916027446EF5635CA2ADB57DAA0B337F0C9A4BD04425976952DE8AC567706CA86933D6CB6775E13D3DC699ADA8AD41DA2D682B7C7371F8E43C0B9
Malicious:	false
IE Cache URL:	https://assets.adobedtm.com/d4d114c60e50/f3fbfbe0e7ca/f496fb7b47d7/RC5e5d1b9fe0a942c38190dc2199529941-file.min.js
Preview:	// For license information, see `https://assets.adobedtm.com/d4d114c60e50/f3fbfbe0e7ca/f496fb7b47d7/RC5e5d1b9fe0a942c38190dc2199529941-file.js`..!function(){var e,t,n,o,u=window,s="adobePrivacy:Privacy",a="OptanonChoice",i=new Date,r={domain:_satellite._getDomain(),path:"/",samesite:"Lax",expires:(i.setFullYear(i.getFullYear()+1),i)};t=function(){o\|\|(o=!0,n=function(){var e,t,n,o,s,a,i,r={},d=u.OneTrust.GetDomainData().Groups;for(o=0,s=d.length;o<s;o++)if((e=d[o])&&(t=e.Hosts))for(a=0,i=t.length;a<i;a++)(n=t[a])&&(r[n.HostName]={groupId:e.CustomGroupId,hostId:n.HostId,displayName:n.displayName});_satellite.oneTrustList=r,_satellite.oneTrustIsHostEnabled=function(e){var t,n=window.OnetrustActiveGroups;return!(!(t=r[e])\|\|-1===n.indexOf(","+t.hostId+","))},_satellite.groupEnabled=function(e){var t=window.OnetrustActiveGroups;return!(!t\|\|-1===t.indexOf(e))},_satellite.track("initTrackConsent")},_satellite._poll(n,[function(){return u.OneTrust}],{timeout:1e4,interval:100}))},e=function(e){u

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\adobe-logo-gray[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 140 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2151
Entropy (8bit):	7.859633225944545
Encrypted:	false
SSDEEP:	48:FPEsgO6wykn4cbmeXfVzSzJwbU9dZKASJ/soJ0ANfknj28W:FPEsF6wfjvdOgUDZKzXyc6j28W
MD5:	9AE66EC6AE11F8E9D108E160D2CC138C
SHA1:	2A2D777BB0F63FF0AC298BE41FE2F046D91572CB
SHA-256:	6428A477DD15F959CB1B563A0009EDAA1EF0716852763792D0C66BCF1F4AF4AE
SHA-512:	ACB85C2A7530F2581D1BC52AF334A5A46452B8EAD3F1BD46C06BB5B9FF686C19B6D24BF25D1074777505D95611321A40D0E48D81FB3BA89926AB158A4BBE63C8
Malicious:	false
IE Cache URL:	https://s3.amazonaws.com/adobe-luca-prod-ue1-assets/experiments/base/images/adobe-logo-gray.png
Preview:	.PNG........IHDR....... .............IDATx...oTE..?[X..,wP....`.j./.11..51^6..O>...............e..."HA... ..h...X.~3..s.=.J.7.t....=...;..k.l\|....^.N{.}.X.b.../S..G....D..R...?..lN9.8..HC.:.U....)......S....=a./.%)..1..].O.......U.......D..q1....).^l....~.5....r....")a...S.SG...).f.{u.....d.Q%L.....v'Pk.}V...N..ql..iL.....f....X...h....U....<6...r.9X..l..79....h.K...O`..6.X9fO.<.Gs0_.de......I....n..2.....o.D...f.[.Mt.]....2....3...`.j{...N.,.hS.;U_5..$..{..Wm......R}....>L.R...Q........v....3....k.._..d.g.Y.z$@...E].L......e.:`!.b.).m......X....k..p..gT.......J5.,.....K....sI......w{......F.f%...>....S.".,u.....x<.L.9.p.,5.^[.....Y.zEa.B...uo2p/..."v.xD.... ..:.....ga\|'..X.\|.....I8..fq.F..c]....W!.....>&.Ob....[....].....3...y..1.V..ZEd...O...b!..}.b95."..vd.t#jp..:u..8.F.X.C.,W......C.J.p...#.S......I.\..A..4v9.p..,../#.c....Xz1f....u......xj!...p. Y.N!..[.;.I..v...0P...P...w..<.6.0..e..Z....2...D.*.....i2y...[.i\..ir....O..u........zq

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\arrow-down[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	637
Entropy (8bit):	5.905700149935229
Encrypted:	false
SSDEEP:	12:tmp/KYtvUUCbdhiLjCmiNRaPyTcGKHJXxIZVGtVz2i:tmpLtvUUmdhiLjRiTaKTcrXxtVzV
MD5:	22120158C53146B96EEEE7777298C110
SHA1:	783C883616B35F64634EC253AAC05F2108B97174
SHA-256:	73EA11E38E252B1D267A812BDE6B4F1EB335CA0770DCB60F9BD6A2E640A3DF3F
SHA-512:	01453A6483925DB61E0013FD8D89F718FE16E267DC87A59775DC81600469089F1C220C82496BF6F05EB8E8BA9C310496B17D680C91E62A942EE9E415491FF1FB
Malicious:	false
IE Cache URL:	https://spark.adobe.com/images/landing/arrow-down.svg
Preview:	<svg data-name="Spark landing.Image" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="9.5" height="5.04" viewBox="0 0 9.5 5.04"><title>arrow-down</title><image data-name="Play_32@1x copy" width="19" height="10" transform="scale(.5)" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAYAAABiDJ37AAAACXBIWXMAABYlAAAWJQFJUiTwAAAAo0lEQVQoU62RPQ+CQBBEj5hQUCAWdpT+Z3KttFhqaQ01HRb4T9aZZCUG7suE4oXc3sxLjjUiYvYkGvgXY61tgOxA8xVm4JpQCNHSszwZhwPoEooubuxv/iGGObgnCH55sOddCi4L8EwQieaKzVLWA4RKMERkvD86t+waIlyB0SPj/OTqeYUqPYNpJXtx7usEhSqtwayyN8+hfFSo0gvo+Y1lyQcNtaApEqmiXwAAAABJRU5ErkJggg=="/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\big-yellow-exclamation-point[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 110 x 102, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2410
Entropy (8bit):	7.569854461422992
Encrypted:	false
SSDEEP:	48:ukNNn2ktJ3PRre/eOxtZlfqY+rj1zXnUgO/GaCq7f:lf2OeeqlfF+ndXRO+Tqb
MD5:	0C48944C6F37B353D14892E8EB9862DE
SHA1:	8FED687740AED3F235F634A67203C61EB7F5FCAE
SHA-256:	8473E148A6C6B2199C07BD7DC0CEB54A5D943D0FEE634D56620763A42346813B
SHA-512:	BD455D36AE29735C9D737D11CDEC81A761A63203CB08B37C161D3ACAE61A542BB238C58137123224B469EE9BF7A4005E125B15DBA966A23AFCBA7BCB5737D628
Malicious:	false
IE Cache URL:	https://spark.adobe.com/images/landing/big-yellow-exclamation-point.png
Preview:	.PNG........IHDR...n...f.....*.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)" xmpMM:InstanceID="xmp.iid:07CAF5790F2F11E6B83680AF73847A41" xmpMM:DocumentID="xmp.did:07CAF57A0F2F11E6B83680AF73847A41"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:07CAF5770F2F11E6B83680AF73847A41" stRef:documentID="xmp.did:07CAF5780F2F11E6B83680AF73847A41"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>F.Ep....IDATx..[l.E..- .....RA.F....(.......x..T.[@...Qh....../..}..._.._4!.Q../.....h..~.....=..3.3../....9=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\browser-icon-safari[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 124 x 124, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	25115
Entropy (8bit):	7.984846894248758
Encrypted:	false
SSDEEP:	384:7jYMKpmdNqN0obP7YnB6pZj1MyPpC9/Hhw691Q/+3ryGjtx54ZNNlRiwnY1X:7MxqPoIMMyRcBw692jGjtKnlMwUX
MD5:	23B02AAF3435635E1E6C324D759B56CA
SHA1:	7DA557E711F8ADD60FE6493789ADCB97B6922A2B
SHA-256:	22B7C23F2DED34B2B0AF1B6D908A533130ABAB7EB32711052D0CAAB35D50BEBB
SHA-512:	7FF438AEEBB35FCC2F62C68E3EDD6C9914BF608BDDFC62B4AD20E91AF937A2395F882BF0CF85CFF2730B6BF4B145110E60FFF7F1F7AFE6FCDBE4A0C8885AC80F
Malicious:	false
IE Cache URL:	https://spark.adobe.com/images/landing/browser-icon-safari.png
Preview:	.PNG........IHDR...\|...\|............tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)" xmpMM:InstanceID="xmp.iid:87E1179C0FF011E69AFE8E50F5F6CE89" xmpMM:DocumentID="xmp.did:87E1179D0FF011E69AFE8E50F5F6CE89"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F7D657F0FF011E69AFE8E50F5F6CE89" stRef:documentID="xmp.did:5F7D65800FF011E69AFE8E50F5F6CE89"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.q+...^.IDATx..}...U...g...onz.i........*.......bC,X...../J.Ai..H.B.!..z{9........3..s.O.....)w.93..k.o...p].

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\cc11c7a4-3395-428b-9d98-bf562dee9fff[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1435 x 567, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	410284
Entropy (8bit):	7.981768998395451
Encrypted:	false
SSDEEP:	12288:4jDG91UqS+FQVVOGKlXjtoZBoSXifRzLUzvFRHe:4291JSuG+yBhX0tmdw
MD5:	F65E1BA320DE3F3D1F8C8A232F601D37
SHA1:	36B62D27D47DC712FBF12F8F8498DF7B1C8B9425
SHA-256:	5632A0E95C44D65D9BA1F3BF455469DA835C86AE86284BEB9E7E7467138A7423
SHA-512:	CDDF157E4F99BEEE5899FB9DEAD57CE24AF606097228AD8A5DEE3E9DC7628AED3864D2A468BF9A9275383BEBBD863C57D1F5D25886B3BAD95D48D17074CD66EC
Malicious:	false
IE Cache URL:	https://spark.adobe.com/page/GG8mUEsjQvSUh/images/cc11c7a4-3395-428b-9d98-bf562dee9fff.png?asset_id=ecd5146c-766b-46a9-9dcc-646d4f3a4baa&img_etag=%22cbca1d5e1d77d78ef66008afffa25830%22&size=2560
Preview:	.PNG........IHDR.......7......w.r....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164519, 2020/08/25-17:54:00 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/">. <xmpMM:DerivedFrom rdf:parseType="Resource"/>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.<?xpacket end="r"?>B.~.....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<.. .IDATx............N....wwh)..k.P...Z../..... 8.P..........nONf......y.3..9>3..;..6..3..c.1..c.1..c.1.....D...3..c.1..c.1...,...1..c.1..c.1.4I..fc.1..c.1..c.1..f...c.1..c.1..cL....c.1..c.1..cL....c.1..c.1..cL...l.1..c.1..c.1.I.F..c.1..c.1..cL...1..c.1..c.1...e.1..c.1..c.1..`...c.1..c.1..cL.Xl6..c.1..c.1...4...1..c.1..c.1.4...4..c.1..c.1...4^ ..c.1..c.1..cL...l.1..c.1..c.1.i,6.c.1..c.1..c.i.....c.1..c.1..c.....c.1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\chrome[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	192215
Entropy (8bit):	5.180324040916147
Encrypted:	false
SSDEEP:	3072:M0k0Ywhc7llWGQsRbiK7mPP67llWGQsRbiK7mPPz20VMqjwhF0MtkzWG82:M0k0Ywhc7lxQWbiK7mPP67lxQWbiK7mh
MD5:	DFDD3AA8B6F029403DC5DBB97F696EC6
SHA1:	05FF3F6C5F0B65C3C091E3B4D3CF69139CB46CAF
SHA-256:	AB889D6962A84FF0A8812667F14F1073E30D63E8023C96671E1A1BB17CDEF50B
SHA-512:	6100BA9798866FEB3D5C1A738E309EC99EB8B76139E581DA6AC3DA4F8E4D3EC4DB0A8835DB3513DF064EF65169F74EB40169432170955BE05DB8D4D64B8459F3
Malicious:	false
IE Cache URL:	https://s3.amazonaws.com/adobe-luca-prod-ue1-assets/experiments/chrome/chrome.js
Preview:	(function(){function r(e,n,t){function o(i,f){if(!n[i]){if(!e[i]){var c="function"==typeof require&&require;if(!f&&c)return c(i,!0);if(u)return u(i,!0);var a=new Error("Cannot find module '"+i+"'");throw a.code="MODULE_NOT_FOUND",a}var p=n[i]={exports:{}};e[i][0].call(p.exports,function(r){var n=e[i][1][r];return o(n\|\|r)},p,p.exports,r,e,n,t)}return n[i].exports}for(var u="function"==typeof require&&require,i=0;i<t.length;i++)o(t[i]);return o}return r})()({1:[function(require,module,exports){.var templates = require( '../../dist/chrome/templates' );.var Mustache = require( 'mustache' );..var topBar = function( trackingId, buttonText, linkToWelcome ) {. $( document.body ).on( 'luca-publication-viewer-ready', function(){.. var initialShowTime = 3000;. var backtrackDistance = 100;. var showClassName = 'show';. var aboveTheFoldClassName = 'above-the-fold';.. var $injectHTML = null;. var animator = $( '.article' ).data( 'animator' );. var

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\crisp-fonts.gz[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	139
Entropy (8bit):	4.811599389940217
Encrypted:	false
SSDEEP:	3:yLRmcpZBLvG/tLAJ2qW7RmMjuRmcszgcukrQLJkgfw0zRjf:yL/pZtvG1M2JRmMju/0gcu/LugfwmRr
MD5:	361FE227C22294543FE0FD29B8D28C0A
SHA1:	1D32C0DC6F27CA2A6C67E5C79DFC08DD39511B03
SHA-256:	17D7DDB7C7C94BA00A4F60835AC14512B6574E5D6B81E99542D44BDA414AACD0
SHA-512:	85C7DA240B8283EF24F91AFCB472AF9E9E2E91A5B6F4E7370E774A50F1BAA0F6DF47E7173854B6593FB4EC8673BF682B7122C3877902AE414F0FDD0334C937B0
Malicious:	false
IE Cache URL:	https://page.adobespark-assets.com/runtime/1.22/themes/crisp-fonts.gz.js
Preview:	document.write('<script src="//use.typekit.net/rbi5aua.js"><\/script>'),document.write("<script>try{Typekit.load();}catch(e){}<\/script>");

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\d[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, CFF, length 30832, version 0.0
Category:	downloaded
Size (bytes):	30832
Entropy (8bit):	7.985448564079255
Encrypted:	false
SSDEEP:	384:ULnH4B904aGBOfBA5ruEox7PvHxsFq36CoGkqzyAL6cRHbHOkhBnKW8x+OBEiB:Uz+93akYVEcP/ig6Nh+me7HLBnK1Pa8
MD5:	A24BAB0217A940502655CB39824C4CA4
SHA1:	031E50C9EF47A17C4077EDB15693225AFC16044E
SHA-256:	1CFA3682C2D68F282C013C471044AE4AF711E990D13B0A4A9E1EF257BABFA238
SHA-512:	4BA826B52A7E3E91C26FAF1C5D5DE5AB5A2E57C0DC393653FBA676433873022918CEB6B3016657D93622BEF2AC41C7CE3929DC710AE44BE42A4F5C92CA1F4EE7
Malicious:	false
IE Cache URL:	https://use.typekit.net/af/b0c5f5/00000000000000003b9b3f85/27/d?primer=7fa3915bdafdf03041871920a205bef951d72bf64dd4c4460fb992e3ecc3a862&fvd=n4&v=3
Preview:	wOFFOTTO..xp................................BASE...0...F...Fe$].CFF ......\...os5.Y=DYNA..`............3GDYN..a\|........s-.#GPOS..b`...u..$..~.sOS/2.......Y...`\Wv.cmap..w....V......3head...x...4...6..%uhhea....... ...$...Hhmtx..t....)...H.$.Imaxp..............P.name...............post..w........ ...2..............ideoromn..DFLT..cyrl..grek..latn...................\......x.c`d```5...3%...+.3........p..?.?/K... ....$..:...x.RKn.0..9N...Qt.5.v... .Wv..Y%...%....cH......g...g..:.X4M.."(.{ofH>..k\|.....l..W.Z...L.>.;.8.%'w..C..>..\|r..>>S.u_2..a.o....z....\|.>:.%....o...}g.p.Ig.(...b...-....7..U....b..b..S..nt.c.._.:.gz...u$.~4._O.#[..sWd.v2}"..u.U.hUws.H..(..w./...GE..Y.<K...h...1.K.7...dF.....7.z...0.W......8.Dc,Q!.&......W.J,X.......V.s..a....F._M..1.._Q..RZ....cr#..^w.....e...T..?S..[...J.v7.wY1...u...{!m7.3)Y.....y.....Z.qC.#g.lN...#;.....}.aW/.s..}...~.N.....7...#.C.;. .......x.c`f\|.8.......).....B3.1.1*.E.Y..XX..X......P..............6............1-.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\d[2] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, CFF, length 30980, version 0.0
Category:	downloaded
Size (bytes):	30980
Entropy (8bit):	7.987621377492639
Encrypted:	false
SSDEEP:	768:Nh0Jzz1kWYZQL4lNCzPhlKCdN7GgGAvOYHqycQ:Nh6WZQclQzJ5xbvHqnQ
MD5:	01BD649595C405E61BD162E40BFF7260
SHA1:	B03670659950A40A47F9658B71F69FF14F8DA4C2
SHA-256:	2FF95F05AA71F6FE45D80A3FC8585BDE66210ECBC83A1AC494BD679A5CAE28DE
SHA-512:	9C4A5AA9CCD44CDB780515532E79BD26C2F250DAFF67FAC3CDC2B9D7067AB664F1D1301183A928BCD950123652F44781B31EEF5A22B7AC939B261D242E92F4C0
Malicious:	false
IE Cache URL:	https://use.typekit.net/af/97fbd1/00000000000000003b9b3f88/27/d?primer=7fa3915bdafdf03041871920a205bef951d72bf64dd4c4460fb992e3ecc3a862&fvd=n7&v=3
Preview:	wOFFOTTO..y.................................BASE...0...F...Fe!].CFF ... ..]q..p.q...DYNA..a..........#.3GDYN..bL...........GPOS..c0...@..$..#..OS/2.......Y...`].y.cmap..w....V......3head...x...5...6..%ghhea....... ...$...Chmtx..up...%...H....maxp..............P.name............E@..post..w........ ...2..............ideoromn..DFLT..cyrl..grek..latn...................Y......x.c`d```5.:...]<..W.f..@....^0....~.).......@...).=...x.}..n.0...t..B.\q...s.D..UB.[.v...&..I.w...%.*....@....Ix..8....r.........+\|...9......:......w.f...C\|r\|..xp\|...0..?..w..^{..........s...C..7.Gx.{...Y.... ..\gJ...Qe#......N.......oW..3.zGc.?/TZMt..2....d:...8i=4^M...7.n..]..\.2...J...vb .y...t..Y.b..2..0..$^..=.}......}uW...<y.l.E.$.=..".HHc....s....K~......5...Z_.i.............S>.....,..&....c....}j.g.._1...j....V.2..c.k..=....hYQe.9+V-.k}.w7..d...%...f6>.sh....;.=<..a..-5.f2...\.pGu.}W.G....kJ.........x.c`f.........).....B3.1.1..E.9..XX..X......P.............6...........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\d[3] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, CFF, length 30780, version 0.0
Category:	downloaded
Size (bytes):	30780
Entropy (8bit):	7.988535310328335
Encrypted:	false
SSDEEP:	768:B4GGbSq0CiAIlwymd1yf04b80qrqH7b7V8zXe1X7QjQlWunvdoO6:B4/SqQ5wymryflbhqrqf7C6NrWunvdo3
MD5:	41291B5CC7AE5A302D0FF767D801DC05
SHA1:	A6B8FA2252C9563DE7FABC7A6F068E5D7C42383E
SHA-256:	641E63A696D3E572B940226372365DDE29D2D581D614B5FCF66323ED46A5CBDD
SHA-512:	3F6F193E7B3F5E0743427577E129D5F21E9A0598F5444A930B53573A87A562861807ACAD2CD4065BBB8FFF7C70821DC500BDBBE431662EC9C04064E975AD5B28
Malicious:	false
IE Cache URL:	https://use.typekit.net/af/37eaae/00000000000000003b9b3f83/27/d?primer=7fa3915bdafdf03041871920a205bef951d72bf64dd4c4460fb992e3ecc3a862&fvd=n3&v=3
Preview:	wOFFOTTO..x<................................BASE...0...F...Fe(].CFF ......\...o...C.DYNA..`............3GDYN..ah...........\|GPOS..bH..._..$.....OS/2.......W...`[.tJcmap..v....V......3head...x...4...6..%`hhea....... ...$...Lhmtx..t....%...H{e!.maxp..............P.name.............8..post..v........ ...2..............ideoromn..DFLT..cyrl..grek..latn...................`......x.c`d```5..?..N<..W.f..@.....0....6.;.c@.3..H......x.RMn.@.}&$U7.......-+.V. 5R$"...a... {.......r....^.G..y<mQ.....\|.g......Cs]q6..[....+\|p...0u.M...s.....f~u......_s.....{..-t.O..a.}q.M....Qz....h..w..>?._...-.X...2:..].(.]QFF/.....%..LW....oR....fz..Fe(.^8..'C+..K.`u:..g\|.e...h..s.K..pS.E..EOy...h....i..2..@....cv..9..61rQd].#U]....A.....!.Cq.FX.@.M<....q.... [....rKH.K9.fH..LeW.OM..)..o..L....j..O.".Bz\|..!...b..E.R.e\.e4.U..........B..i;.X.Pel.r.....$...l..-.j......v.l.......r.~..U[.).....u."V'F.....O.G......x.c`f.........................L,,LL,..L.@yF.(ptqr.R.....gc``...K..q>H...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\d[4] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, CFF, length 31340, version 0.0
Category:	downloaded
Size (bytes):	31340
Entropy (8bit):	7.9870881023883635
Encrypted:	false
SSDEEP:	768:8pXzzHNr6GY0k1BBwz8d1Ip1WbAy/iGGOYKzte6fcq:4XJ6LBa8dmib7/NGOYc5n
MD5:	588A4A92645A9E137308924C68778A29
SHA1:	99F03745B7B06DB4201A3B00C6D9BEDEA3F97E9A
SHA-256:	B3220E43420A21615A932915870167A21F7A34E64EBEF3323209E6A9553C1B11
SHA-512:	FCF13CD9528CB0CFE2AF66AEAD2D0029EB6B6514907DF318815C8F08F06E6F4D12299FDBB98B50E5DEA2A01144B43FAB062F880006E2BFF074BA3D2B4DBE7FCB
Malicious:	false
IE Cache URL:	https://use.typekit.net/af/180c9d/00000000000000003b9b3f8a/27/d?primer=7fa3915bdafdf03041871920a205bef951d72bf64dd4c4460fb992e3ecc3a862&fvd=n8&v=3
Preview:	wOFFOTTO..zl.......4........................BASE...0...F...Fe.].CFF ...0..^...rzyB..DYNA..b............3GDYN..c............^GPOS..d....G..$.....OS/2.......W...`].z.cmap..y....V......3head...x...4...6..%}hhea....... ...$...Ahmtx..v....!...H...emaxp...(..........P.name............a..(post..y........ ...2..............ideoromn..DFLT..cyrl..grek..latn...................W......x.c`d```5.z....o....P..\|rh0....e5.} ....$..g...x...j.@....'..L..~6.R.x,!b.+;."..`C..=...1.....u...,....!...h4MC14...f.Gw.d......u.Y...\....\|u\|.cL.7..s\|.......g..<1.k....9....9n..}w\|./...Mj~9>D.8v\|.O.o.[..?...TW.fy..dW....2...&/".gR..D.W..).X...r..':......0Ofc..M.".~'.......Y......h.....U....z"\|.../s3...H%O.~..un.2Y..e.Sj.s..l..m......i..5.+..+.{q0.Fx.....%.0C...<..%.9.]...........f.6/...c.....v.y..n...934]2.....C......n...C...4B..qA......^'{..+....nl.%O.[......o.vNqgI....xZA]...S....].....5....=....T.5\|.ghs.....kz..U5...{%Y.g.\|j.3`u]D..J-..x.c`fbeV``e``.b.```...q.F..@QnNf&..&&....v.<#..8.8..)..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\d[5] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 24744, version 0.0
Category:	downloaded
Size (bytes):	24744
Entropy (8bit):	7.978627515034273
Encrypted:	false
SSDEEP:	384:EVkksCq/KOwmOt8IEOsyhgjzfwTJsPj6V9teCsx/Abr2k88CDW001VEKHUM7Ozip:qktXUt8he8UheCsx/AhKW0CUUV
MD5:	A14F6E1E3181DC10FDB66D2A7FB54CA7
SHA1:	605808488DD7FEC481400AA948F80E66189D25B5
SHA-256:	A4B8520DF89E973A968FCD3CF78F742E073EA9645D03ACCF360EB4AB5E6E1001
SHA-512:	E741918EF1EC6A3C0B87D996245945AEA9DB8C7D798352756F409A5E519BBF89EBF8F6AFA1E1A71D5C24C4E1C364F7C2EF38622C0897F852C6E9C7E6C27BBE29
Malicious:	false
IE Cache URL:	https://use.typekit.net/af/1da05b/0000000000000000000132df/27/d?primer=7a5a436c948772f5260024dfadc8f7cd849e1448f8bf41ba74a247e8e46f3aee&fvd=n4&v=3
Preview:	wOFF......`........l........................DYNA...$.........D..GDYN............L.i.GPOS..........G..9..OS/2.......[...`\|.M.VDMX............l.tPcmap.._.........!k`Tcvt ...H...........tfpgm...`.......s.Y.7gasp...d............glyf..&...4...e..V .head...l...4...6..M.hhea...........$....hmtx..Z........(.G$nloca..\...........Jmaxp....... ... ...nname.............!.,post..^t...l.....moprep...T...2...2....x...S.X..D.s.X...Vc....jl5....m.m{:...3.....#..C.P..WB..!..K8}...'.>...6".l$"....b....F4}$.m4b...ic...$....866q..8.q.o.@o.OB..DzCB..D$..I..$!.MJr.;).d...I... .MI....zAj..4..s...#.MO&=#..mF..)..j3..f!.....6.9....c.... .....6..ln..!y(`.RP..G!....Et.....(f.S\.(B.[...K1J...RFw(AY[.r.M)...T.e..[...-Ge.<Ul...T..Q.V...BM].*.l5j...ckP.......m-....ih......S.&.>Mu..4..in..B.iLK.V.).u.f...i...mI{..:..t......mK...:C{...t.i:..v...L/....mW..n..I......N.....mo..8.0..a.......l...(..a.2..b..0..v.ct......g.3^....;..:.(&..L.c.....T;.i..8B.x.....>&2.Nb...l.e.s.T.j..oCX`..P...";...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\d[6] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, CFF, length 46088, version 0.0
Category:	downloaded
Size (bytes):	46088
Entropy (8bit):	7.991344892853239
Encrypted:	true
SSDEEP:	768:cbb1bWj8ZMc7qG0jmQcHDJINQubS5HF9GctB7jiDbtUPL6n9MRXVFtf8u:qb108ngj4tImubIpHWHyWn9MZVfL
MD5:	F6772D5F038A33A09B062FA7D7FD1E73
SHA1:	19295E0771CD244E3C71F7D2D209B9A7309A8DE0
SHA-256:	AF6B2610431D075E5266E7D97EF7B53314F04EC64A56CD8872AD5FFB85DBA88D
SHA-512:	64179523C0D4EFAA89AA10670CB89D91D7B97C9685E5919E7E1D014602634AD98FCA376A8433A9C31B13F0E3AF944EC330A858486F58DA726EA953117FA3575C
Malicious:	false
IE Cache URL:	https://use.typekit.net/af/a0c22f/00000000000000003b9b3f84/27/d?primer=388f68b35a7cbf1ee3543172445c23e26935269fadd3b392a13ac7b2903677eb&fvd=i3&v=3
Preview:	wOFFOTTO....................................BASE...D...F...Fe(].CFF ...@.......{].R.DYNA...H.......\|.6IlGDYN............v.A.GPOS..........0P.3.(GSUB..............t.OS/2.......[...`[.twcmap...(.......(..TIhead.......4...6..%<hhea.......$...$...^hmtx............:.".maxp...8.........kP.name................post........... ...2..............ideoromn..DFLT..cyrl..grek..latn...................`......x.c`d```5.J.S,........(.p>9..F.......\|.........2...x.R.n.@...i%$T.O...];v.&.)i..T..z..Mc.?..F....x.>.wn..O.....Z!.j...73..g.x..p.>'.-v...8.[.....,....}............7..........K'...S..{x.\|..C.w..Q....x.j......D..=1\....].U^.I1/.MY.Z-..f...7+]...U.e..e..E...8K....`x>......,.......ZUuZ...^.D }...J=/...J_...<^.R/e.&..d.....VZoN=O.6j.j9/sO.fq....0.'.w.;...9zDC,P".".a...8.0...3[ac..- ....."..V..f..r..y....E....n..3..VDE.. ..s.06.......-..(.]....4..u...C...gdE.6.(x/A^....Cfs....p..67I.>2.o\......Sx.._cC..M..~..-.b..'...Y....d=....[..x.c`f..............7.f.b.c0b...r333..p2.(00.300

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\d[7] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, CFF, length 58352, version 0.0
Category:	downloaded
Size (bytes):	58352
Entropy (8bit):	7.992884507564213
Encrypted:	true
SSDEEP:	1536:U2Ph1fS3ZeHACznHaKNlKjE39zfZB4kKAkr:Hvf2OzH/NjlSAs
MD5:	3C48D869909CC053C2EFA6800B492ADD
SHA1:	882C7495CC54A32EF795B89E9E84D1B69C3F87C5
SHA-256:	CFD20EA88B7F7A1B3E18890AAFF228FD6F134095AF8F6DB1F66E4DD551B59306
SHA-512:	0E2ABD3D074418386C6290B0AA5EA09BB8BDC486C715EC426CE1F0D6B48C3EC2EC85EDA7BAAF31375B3481FDCE1DE7886AC0325AA7877F48516D0877F7C061A1
Malicious:	false
IE Cache URL:	https://use.typekit.net/af/ad2a79/00000000000000003b9b3f8c/27/d?primer=388f68b35a7cbf1ee3543172445c23e26935269fadd3b392a13ac7b2903677eb&fvd=n9&v=3
Preview:	wOFFOTTO..........T.........................BASE...D...F...Fe.].CFF ...8..........DYNA.............N..GDYN....... ...Q<@..GPOS......!+..N`b)ihGSUB...$.......N`^.iOS/2.......W...`^B{.cmap...........(..U.head.......4...6..%phhea.......!...$...Uhmtx.......'...Dv;8.maxp...0..........P.name............a..npost........... ...2..............ideoromn..DFLT..cyrl..grek..latn...................U......x.c`d```5.....+...+.3.......P..._.?7.#..@.3..H..cy..x..1n.0...9N..F{..{hZ..;...@39...L.d....;w..#..=@.^.G)....F:X......'.$.......e..j..7.....0w.f...#\|v\|A.o.{......[...r..:..}q\|....q.....Qy.._@tJ.=....+5..U.k.\|.....H.j_V..+)&y...fkj........\G...Q.-..1..P..p<....Vb..V..\|:...AWuZ...._._*....$eq....U0.E...Z.i..P.#.^.o.._...i......5.T..+.Gq..&x....1$M.B......j..O.;.?a..Gk.. m].!.@.....v..............yJ......B....@.1ko..Y..............5O^.....B..i;...Rel.......I....;zf.k4kFs..>.sd]N...a....0..{.2z..4{...K5Y...w.q.<.......tx.c`f.`na`e``.b.```...q.F..@Qn.f&..&&....v.<#..8.8.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\e2042c70cc1c4a7dd81fb01c353d993dnbr1622136582[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1086
Entropy (8bit):	4.943990229770432
Encrypted:	false
SSDEEP:	12:n/3qtdyuzm96olbOw2XmLxhlFfgaVtnHJX5GL4pr7tnk1A1iGc4bDY8zIXmuA:Pyw60ajXKx/FIWpX5GLW9k53iDjgmuA
MD5:	CB372B95DFCAF79CF09DA253AEDEA8B1
SHA1:	08E7999607C2F6B8EBB5E07681B0F22857D88E94
SHA-256:	118F4D0A8C85BFBE5E7DFA3162E04E73C6FCDA9CF1736B28F9472AA7E03BA2AF
SHA-512:	08476963CF8B4A3DAA000ACE639C9E713D37B0879EEA131287051BD6EEB309C2C267DAE6D36DF48EC093DCE6F4C879095FD0C14482B8B6AEF81077F6BFEFE667
Malicious:	false
IE Cache URL:	https://rikapcndbn.web.app/jutyrtersdzx/themes/css/e2042c70cc1c4a7dd81fb01c353d993dnbr1622136582.css
Preview:	#outdated {font-family:"Open Sans","Segoe UI",sans-serif;position:absolute;background-color:#f25648;color:white;display:none;overflow:hidden;left:0;position:fixed;text-align:center;text-transform:uppercase;top:0;width:100%;z-index:1500;padding:0 24px 24px 0;}#outdated.fullscreen {height:100%;}#outdated .vertical-center {display:table-cell;text-align:center;vertical-align:middle;}#outdated h6 {font-size:25px;line-height:25px;margin:12px 0;}#outdated p {font-size:12px;line-height:12px;margin:0;}#outdated #buttonUpdateBrowser {border:2px solid white;color:white;cursor:pointer;display:block;margin:30px auto 0;padding:10px 20px;position:relative;text-decoration:none;width:230px;}#outdated #buttonUpdateBrowser:hover {background-color:white;color:#f25648;}#outdated .last {height:20px;position:absolute;right:70px;top:10px;width:auto;display:inline-table;}#outdated .last[dir=rtl]{left:25px !important;right:auto !important;}#outdated #buttonCloseUpdateBrowser {color:white;display:block;font-size

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\icon-footer-facebook[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	423
Entropy (8bit):	4.868918333773956
Encrypted:	false
SSDEEP:	12:t9D/0IHZJwB5MK7Nj8/66L/fUSCZ3GM65nKFw:t9D/0+677p8/fLnUSC4MMnKFw
MD5:	79B5A539C142059EE68CA83E8846C412
SHA1:	97EBB1258C37BB6BCA866A4EFF63D67F8960D3FF
SHA-256:	AE7F81F5F3D2679D1C7D4E099F16A37D5B61A5E9F580FBCB175DFFE53516A623
SHA-512:	149DB16384AAAC76EC5C351CBA4A6B98700B253F982884B759000E7712264EE48EC6FE8666FFD6DC81AF3215CB03CCFC238FF8534C529C7D46599834048F7397
Malicious:	false
IE Cache URL:	https://spark.adobe.com/images/icon-footer-facebook.svg
Preview:	<svg height="67" viewBox="0 0 67 67" width="67" xmlns="http://www.w3.org/2000/svg"><path d="M29.765 50.32h6.744V33.998h4.499l.596-5.624h-5.095l.007-2.816c0-1.466.14-2.253 2.244-2.253h2.812V17.68h-4.5c-5.405 0-7.307 2.729-7.307 7.317v3.377h-3.369v5.625h3.369V50.32zM34 64C17.432 64 4 50.568 4 34 4 17.431 17.432 4 34 4s30 13.431 30 30c0 16.568-13.432 30-30 30z" fill-rule="evenodd" clip-rule="evenodd" fill="#717f8a"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\imslib.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	46020
Entropy (8bit):	5.247108485619506
Encrypted:	false
SSDEEP:	768:6y/BMM1ALvYYtNwaIQzhxmQuLWpXcFJw+YoSorR:hgjia012XcFJHYoSo1
MD5:	B439B689448BCAF4ED270F5AF5477C37
SHA1:	6E71ACE46CA64143CA6C7373D2C3DB960EB8F5C0
SHA-256:	4492E3E27970CDEF4E460DA2FA944B12C09AF19575447F91DFECD9D587818A0B
SHA-512:	9541DBAEBE8CC3DA98259BFD0AFB003BEFF471C91CACBA35E446B199D961C55DA1642485B6E00F73949AB65BA9C2EC5EBE7E48833FD61588B18C10C8FDD4D9FF
Malicious:	false
IE Cache URL:	https://static.adobelogin.com/imslib/imslib.min.js
Preview:	/! imslib.js 1.13.0 18d23dc-b2b44fe /.Array.prototype.every\|\|(Array.prototype.every=function(e,t){"use strict";var n,i;if(null==this)throw new TypeError("this is null or not defined");var o=Object(this),r=o.length>>>0;if("function"!=typeof e)throw new TypeError;for(1<arguments.length&&(n=t),i=0;i<r;){if(i in o)if(!e.call(n,o[i],i,o))return!1;i++}return!0}),Array.prototype.forEach\|\|(Array.prototype.forEach=function(e,t){var n,i;if(null===this)throw new TypeError(" this is null or not defined");var o=Object(this),r=o.length>>>0;if("function"!=typeof e)throw new TypeError(e+" is not a function");for(1<arguments.length&&(n=t),i=0;i<r;){i in o&&e.call(n,o[i],i,o),i++}}),Array.prototype.includes\|\|(Array.prototype.includes=function(e,t){"use strict";if(null==this)throw new TypeError("Array.prototype.includes called on null or undefined");var n=Object(this),i=parseInt(n.length,10)\|\|0;if(0===i)return!1;var o,r,s=parseInt(t,10)\|\|0;for(0<=s?o=s:(o=i+s)<0&&(o=0);o<i;){if(e===(r=n[o])\|\|e!=e&&r!=r

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\location[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.685293041881485
Encrypted:	false
SSDEEP:	3:LUfGC48HlHJ2R4OE9HQnpK9fQ8I5CMnRMRU8x4RiiP22/90+apWyRHfHO:nCf4R5ElWpKWjvRMmhLP2saVO
MD5:	C4F67A4EFC37372559CD375AA74454A3
SHA1:	2B7303240D7CBEF2B7B9F3D22D306CC04CBFBE56
SHA-256:	C72856B40493B0C4A9FC25F80A10DFBF268B23B30A07D18AF4783017F54165DE
SHA-512:	1EE4D2C1ED8044128DCDCDB97DC8680886AD0EC06C856F2449B67A6B0B9D7DE0A5EA2BBA54EB405AB129DD0247E605B68DC11CEB6A074E6CF088A73948AF2481
Malicious:	false
Preview:	jsonFeed({"country":"CH","state":"ZH","stateName":"Zurich","zipcode":"8152","timezone":"Europe/Zurich","latitude":"47.43000","longitude":"8.57180","city":"Zurich","continent":"EU"});

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\m-setup-9f808447[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	21489
Entropy (8bit):	5.017049351374479
Encrypted:	false
SSDEEP:	384:hSeHjFWqmemiJvBZKCeTzcjvtaQwFyw3OhaNxQQgIx8MZe:hLHj4qLZKCeetaQwf3OhaNxmIxRZe
MD5:	E506A21C909F422EC580D07AE67D02A9
SHA1:	433ACE5C2D8E30329CCF06F20EBD5716D28C3A97
SHA-256:	013173243A5FC47030B79878154FE50E0075F4111FA071E5459A10206E18D0EC
SHA-512:	C0FBDFB3EDE721792889765FA91653AEB22675503C4324EE96D185A2013217535B88646F7A1CEEACC9A0020C2B56C82F7FF2BEBA7CC08E7862CB9E866B5C93F9
Malicious:	false
IE Cache URL:	https://spark.adobe.com/m-setup-9f808447.js
Preview:	var globalObject={};"undefined"!=typeof window?globalObject=window:"undefined"!=typeof self?globalObject=self:"undefined"!=typeof global&&(globalObject=global),globalObject._prjtmrvlsetup={buildVersion:"773541f915a72c91d9d8",environment:"prod",snapi:"cc-spark-services-snapi-prod[SUFFIX].adobe.io",postsnapi:"projectm-postsnapi.adobe.io",postsnapi2:"postsnapi.adobe.io",fluxo:"fluxo-us-east-1.prod.adobesnapi.com",ss:"cc-api-storage-creativesdk.adobe.io",links:"links.adobe.io",sparkEduHost:"https://spark-cs.adobe.io",collab:"invitations.adobe.io",behancePublicProfile:"https://cc-api-behance.adobe.io/v2/users/",cid:"MarvelWeb3",imsac:"marvel.adobe.com",imsDebugMode:!1,imss:"static.adobelogin.com/imslib",imsh:"https://ims-na1.adobelogin.com",imsCommonScope:"openid,creative_sdk,gnav,sao.spark,additional_info.projectedProductContext,tk_platform,tk_platform_refresh_user,creative_cloud,ab.manage,sao.typekit,mps,read_organizations",blogAPI:"https://blog.adobespark.com/wp-json/wp/v2/",instagramCli

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\m-unsupported-88cd3215[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	1641442
Entropy (8bit):	5.473866996545552
Encrypted:	false
SSDEEP:	49152:ZQZqBr4+BR5okkiRb8GRuXAiT6VcHad+sJOfV+kYFYkw8c7SjAAsYuMOcdSll:L5FckkihqXT
MD5:	E4216F66DAE5AEF0264C54EFBA38DFB7
SHA1:	0DD6C2AE19455C49E4820FB57C7A28AB22D5C2AE
SHA-256:	DD6B957EFABFE9FF7EF0F508C191DC635C269F7C3E192E7641D1878FD210829A
SHA-512:	0C3857B94D51B83FF1BD6084AAF9EAC08B00D25933A0CE64AD6550F81137A16DB5769589F88652BF8FA994BD6C2FDBBFA6D44E254071368C5EB27F8E1BC5711D
Malicious:	false
IE Cache URL:	https://spark.adobe.com/static/m-unsupported-88cd3215.js
Preview:	!function(e){function t(t){for(var n,r,o=t[0],a=t[1],s=0,l=[];s<o.length;s++)r=o[s],Object.prototype.hasOwnProperty.call(i,r)&&i[r]&&l.push(i[r][0]),i[r]=0;for(n in a)Object.prototype.hasOwnProperty.call(a,n)&&(e[n]=a[n]);for(c&&c(t);l.length;)l.shift()()}var n={},r={"m-unsupported":0,3:0,"vendors~brand-kit-controller~gic-voice-publishUtils~m-storage":0,6:0,"brand-kit-chooser-view~m-storage":0,"brand-kit-chooser-view~user-profile-view":0,"vendors~BumperViewModule":0,12:0,13:0,16:0,21:0},i={"m-unsupported":0,3:0,"vendors~brand-kit-controller~gic-voice-publishUtils~m-storage":0,6:0,"brand-kit-chooser-view~m-storage":0,"brand-kit-chooser-view~user-profile-view":0,"vendors~BumperViewModule":0,12:0,13:0,16:0,21:0};function o(t){if(n[t])return n[t].exports;var r=n[t]={i:t,l:!1,exports:{}};return e[t].call(r.exports,r,r.exports,o),r.l=!0,r.exports}o.e=function(e){var t=[];r[e]?t.push(r[e]):0!==r[e]&&{"m-react-spectrum":1}[e]&&t.push(r[e]=new Promise((function(t,n){for(var i=e+"-"+{0:"aea76d9f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\main.no-promise.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	10741
Entropy (8bit):	5.442372384249071
Encrypted:	false
SSDEEP:	192:JtsMOjdwfVbwVhYeB8qfRiaAWfjIVHY7W35Qg6SF6gZhfRmlW1YDqs+qg:JtsMydwfVsVhYhqf0aAWfjIm70eVM6gH
MD5:	CCA018E06A68F94A49E79B2B87096FBC
SHA1:	1DC051BD56CA3E2B0ED6E95AE56FC449831062D3
SHA-256:	350A14AAA52348E4768E8146C3449D7789C92344C4537CE31CF137711E5A90E1
SHA-512:	A90B93282F61F721F40E8010D6B2F9D06017F622CA5CE21E370D55C4DB0EAEDDD8DAE114C79CB12223F2024E1BCED55903CC852DD36D42C14FA89D123DA1C448
Malicious:	false
IE Cache URL:	https://www.adobe.com/marketingtech/main.no-promise.min.js
Preview:	!function(){"use strict";var e=document,t=Object.defineProperty,n="replace",a=function(e){return e=e[n](/%2523access_token%253D.?%2526/gim,"%2526")[n](/%23access_token%3D.?%26/gim,"%26")[n](/#access_token=.*?&/gim,"&")[n](/information=[^\&]+/,"")[n](/puser=[^\&]+/,"")[n](/fnuser=[^\&]+/,"")[n](/lnuser=[^\&]+/,"")};try{var o="referrer",i=e[o],r=a(i);r!==i&&t(e,o,{configurable:!0,value:r})}catch(e){}var c=window,l=c.console.log;function d(e){throw Error(e)}var s,f,u,p,h,g,b,v,m,_=c.__satelliteEmbedCode,y=c.marketingtech,E="digitalData",O=E+".",C="object",D="array",N="function",k="sub-object not ",x=k+C,S=k+D,P=/^(.+?)((?:\[(?:n\|\d+)\])+?)$/,j=/n\|\d+/g,w=Array.isArray,T=0,I=y&&y.digitalData&&y.digitalData.debug;if(v=function(e){return typeof e},m=function(e,t){return e.hasOwnProperty(t)},(u=(f=function(e,n){var a,o=this;if(t(o,"_id",{value:++T}),I&&l(o._id+": CREATED"),t(o,"_pending",{value:{}}),t(o,"_listeners",{value:{}}),e&&o._set(E,e),n)for(a in n)m(n,a)&&o._set(a,n[a])}).prototype)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\marvel-landing-unsupported-ec51f18c[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	92372
Entropy (8bit):	4.941174507427571
Encrypted:	false
SSDEEP:	1536:6HnTWlRCnXfH3Jy4xYuwO8gVR8xyDDtxu5+gBiEffU9+Zz8AMwKpLDtn+jFY5:6HnrnXfH3bxYxOAU5
MD5:	C619CDA442CF0F3808A18ECDEC51F18C
SHA1:	A2D5784420901F3B9BA979EEB50C3BF769ADA3A2
SHA-256:	D53F86A45B7263BECE92128951805436235C90CC77F67FA45188EE6BEF7BA4FF
SHA-512:	2E0DD30F9AB1D50451F013EA25CABE03D599AEDF1F0B18F3BE200BEBACD25460D2D844547155F32283715AC78D433CDF5F2E186FF883F36E9FD6BF685FDD3352
Malicious:	false
IE Cache URL:	https://spark.adobe.com/css/marvel-landing-unsupported-ec51f18c.css
Preview:	.glb-nav-menu{overflow:hidden}.glb-nav-overlay{position:fixed;top:0;height:0;width:0;z-index:-1;cursor:pointer}.glb-nav-overlay.menu-opening{background-color:hsla(0,0%,100%,0)}.glb-nav-overlay.menu-opened,.glb-nav-overlay.menu-opening{transition:background-color .5s ease-in;height:100%;width:100%;z-index:200}.glb-nav-overlay.menu-opened{background-color:hsla(0,0%,100%,.75)}.glb-nav{background:#35414c;position:fixed;overflow-x:hidden;overflow-y:auto;margin:0;padding:0;box-shadow:1px 0 5px 0 rgba(50,50,50,.75);-ms-overflow-style:none}.glb-nav a:hover{color:#fff}.glb-nav::-webkit-scrollbar{display:none}.glb-nav-top{position:static;margin:0;padding:0;border:1px solid transparent;min-height:calc(100vh - 125px)}.glb-nav-btn{-webkit-flex:1;flex:1;display:block;background:none;outline:none;cursor:pointer;text-align:center}.glb-nav-circle{outline:none;border-radius:50%;width:48px;height:48px;margin:0 auto 10px;background-image:url(/images/plussign.svg);background-position:50%;background-repeat:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_11509db7f6d2114f580490ba33b5f8b113df45a01[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	12488
Entropy (8bit):	7.985091843499927
Encrypted:	false
SSDEEP:	192:g+tRi7RhoNKL/AOzYh6oOXsZgZY/bn0wtmEP/y1cjNdOucFH51xpSTpisTxGv/6i:PAFhV4h6oVwwmE3yuy1HyMSxg6j9tOBT
MD5:	C64C86FE6BF1E64917CD40F51A3F0212
SHA1:	EE0AD8959A9619AB9ECF6447A73233C38998993B
SHA-256:	E5F1BD8E854076333BB35D12C7C8AA4764F2F9692A9DB079E0D2B0EFC80BF426
SHA-512:	963B7283782186407DEA17459D9B9FF8FFBAB34574849D391688D8F0B5427FE240892C0107B3D03A4C46878CDD491E7C613DBCE9157C6C07DF15F6DB6DF35BCF
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/discover/templates/media_11509db7f6d2114f580490ba33b5f8b113df45a01.png?width=2000&format=webply&optimize=medium
Preview:	RIFF.0..WEBPVP8 .0........k.>u2.H$..!'.[...bn.rP...d..f_...........7.........\|...@.......7..u....{...~.....{......e...I.o.....PO...}n.S?.z.~......b...k.7........nn..Y..........C.....=..W..........Jj...6..........W./...^`........`_....e}....'.O`...e...].......7....J....#.....]f.......j.Z...-..K.<....'.9.t.i?.../.R..m=..-I......^^:. @.GH.......6.J.?.xq.8.....w...d.D.e.xU'.H/\+.../...^.3J...8.#d.....j!..."....U.E.(....v.......X)A...w.q w..jnlQg..h.}%H{...u..;.r..^..T.K....Z.+<g.8....'v.O.s....S.hO...xc. a..y.t.X.. %.rh..gJ......8..+.rC......6.%.%e$...-.2....\|.g.....\....[.3..G7>.....1.N..N:.......R.EXw3in.5..j...Rm?.O=.q.....:.....'......x.A..M.t.....N..;7......s....FTw7?.......3.d...`#H...o_..7...U.tV..M.p......b..j1...K.d.m.{e~..y...O../...B6......;...?.A.w....%.{I.$aWS..v..%&.z>Ut'.t.....o..I.iB.K.<.{b..+.B..Y..... .+..C...1.q...r..?".Z....<.....P........z.`[T..8\|.8......g...B.-.. 0-.p.........T....!...r.pN.....\|o.=a.pR.J;r}..(.c.r..-.,..E

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_11ac71813080b7ad80d8486ba8212b564a66f1d25[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	8602
Entropy (8bit):	7.980706577311374
Encrypted:	false
SSDEEP:	192:0Vb5mwlQbI9SDD9SEpabX0yTyPB5i3Ky5y6qfo5GmE:0/MqSsECXsZ5k4vmE
MD5:	3519DBDEC738221B4ED56F146889B0C5
SHA1:	8368D90BB91AB4BF312B31A0959AE311AEE8FB7E
SHA-256:	F3884FE1C01470D8BDA7E399CF81D46299FFC11C39FD6F2C74A164607505B0BB
SHA-512:	570E2481C9A11A30EE6E7025248FC2518B1416F37F2BD3134FE4EBD6BBC870E017F95CE329DAB48F3B28D4CD138AE14F8BC4AEEB175FB0710E503141F3ACDDEF
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/discover/templates/media_11ac71813080b7ad80d8486ba8212b564a66f1d25.png?width=2000&format=webply&optimize=medium
Preview:	RIFF.!..WEBPVP8 .!.........k.>u6.H$.".%s;@...en.K.O....W...<"......K.....;.o.O.....X.../.W...../.?P.:..~.?...^>...\|.=@?..9.....n...xK...x..../..;_....'....m..}....?..........^..r.O.w..........A.k.........G....+............v-.7./...5.....>....y.\..WH%.. ....UY..v..l..D..\|...=...Lzl(....Mi..g....y.R...X.P.1^Z.....PJ.U.sqy;..).qT..s.r.7...J.UW...]..u:..&..Vug.....wz.l2...6.6.)........x..].)Fn..X....q.^~....^.5.Q:RT'#.W.~.>\.........JZ.=\|{....e.g..S.73.R.w..dT.T.,....%.o\|....8..]..:..6._...Rm1.:..>._..1..4...D.h.#.PVI)...@..=.......r....;.Lh...q.(.n...\|u.C.../.......A......8..Q....H.D;..g..;Z..X...[..z... .~..J...j..5l..Z}.....>.GU.1.R}.qF....a.E.9..L......}{....>G$...Q......@...^..!.$..SML.u.....r...p....+?.Cg.....(.-.D.......v...]..n.u.Z&...&...&u...nT].1MS.q.......1.D\|.>..o.......`?l.&.b.....@..-..I..pe..OJ.\|C/\|...x.....)...&._+.A..+.=...U...?...d..^#A.:r.~...TPQ0#..R'6....y.@..d....ZLZ.u..s;I. .t.+..f.g..{.6...........D...J.l.p.9

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_1203acb3d260e5e6e58ad701c56479e3ea2f24dde[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	13058
Entropy (8bit):	7.98575258195856
Encrypted:	false
SSDEEP:	192:pCeVWW1Q5fgWELOJ+hKZwmkuLlsUbARcqqfHLnVXxGDFUuj7XzMtP/8aCebMifCO:pC81GPELS+qwUI+PAXwtshebMUn3pV
MD5:	40F31E7D1C620A53849C0EB68A13D79D
SHA1:	5D5E02091ECAA3A78234C7716914D8C91F0F7559
SHA-256:	619F71DC13AD6BF9E97884D4098E8C31FE611E0FFDA50BE4167DE7188989199B
SHA-512:	7030E37E39026082474CBB4741C11A0FF274B9AE21800EBD270E975D6ADFD739D0308D28444A8CACEAE8D94656F715C8F07DC13A31C54A156F8D2B8F01402005
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/discover/templates/media_1203acb3d260e5e6e58ad701c56479e3ea2f24dde.png?width=2000&format=webply&optimize=medium
Preview:	RIFF.2..WEBPVP8 .2..P......k.>u6.H....%..H...gn..{.q...hCz..0..e.4.5...\|._....z.<...(_y.1...O.?..?.o..f..o.^/..............-.O........tv..^......c..f}M...!.....W.......}{..._.........-....._@.\{.~~.....U....T.2V....n..y`y`......G.<x......T.\+.q.rN.-.@.M........M)./.E.....Ax.].P...V..6.F0p_w.r..]-.>..y_...)..T.y+....&.{....T.K....+....Z....ZS.....V%....s...b1..h..W....Hh.p/...%.Ov..s.... ..".bB...)y.5.8.....W....)..p...8..>..:/.BB.x~2.GS.S`...3U.s.a..)Yi.jV..X...^8..p!J....^......,........hR....ia..Av..[O.}.a..d.......*......&......na>m.k...>....+.cN.?.W.Y@Vs.H....S..}:...g..1C..S......a..J. ..[..#>YJ.L.ok.q....Z1.\.t=...e(M...=25L..r.5..~Vy.&.......f].`6&.....uW...x.l.ZE.~..$...(.....n.v.CE.r..k..d\..9%.X-a.1$.".f.(3&Y..1S.....f.'auQ./!;..9.+....u]#r.e...K....sH.y.a:."q.]...2.YE<O..![..&>.t.!.7[....&v;.....Mj[.E.0..{......N.....XXv.@..k.+.a...0x...j....#..?.L.ZY..5GY.SM...j.@...^....r........../.o....-../mF65:<..3V-......y.!.R.i.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_1214e0e49cb388dca5a84c369402d152a38682f84[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	5708
Entropy (8bit):	7.965305970259403
Encrypted:	false
SSDEEP:	96:QkungeXPS1mCH5eaJ1pjCA91DQ8Ix+1UNo/sKLBm/I3itzTvMkfmOy1:Qkugefh4brpjCuFExiUNMlWIkzw9Oy1
MD5:	502945F63FBDD30964F4CE97871AF3A2
SHA1:	E30785AE564B46CCCABA0B4CB2E1FA05B4ED0368
SHA-256:	9AA4349900A643FE5FF83FD15985F121A4A155D9D8DB421F5BFDA166A9CA5ADF
SHA-512:	6FB9FE7F0A5827D9FEF27690AE519BBBB37A7F68E00D1FFC8799BF60351F085B775285B2BD8AFBAAE3D67AA7D1E4A0064917F62AB4FBE1A16ADF7C111BA4132B
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/discover/templates/media_1214e0e49cb388dca5a84c369402d152a38682f84.png?width=2000&format=webply&optimize=medium
Preview:	RIFFD...WEBPVP8 8....h...,...>u8.I$.".#.:(...en.ru.^...f............E.....Y..W..?1.s_...?...z....j...W.....3..?.gU..?......C......w8.H.)..?....C._}?..r............w......o......._....?.\|..y...G.o...?.?..}...b...G.o..k?H...1...........?...Q....t...M.....K%=L...Y...~.\(mF..&.P......\|\|L.).}p.....1..y.4KsB.J.....5.I..)....Uka....bn.....eW.%.H.F.).Vl..."(xT^P.ID@.!-.{......^ZyY...g8.Z...$..6@PW6.aV.+.<.v.9....f....z...W...5...w.P+......L....Q.X...{.L..n...,.,.........wj..oz./.u.DN'......"1f.Z..^>....i~+[+...U.<i..71...fd...u.....1...l..1v.-...0....u.....$.,.d@....-k:..Y.B.\9...b..bX...$N..p...#G.k56C/........s.. gK.gsL,........N.....Bu.#...d...m{[8..}l.@:...>..d+......j.S..u.....[.X.4&....N.{$.%\.[w.P.o.....Y.J^.R.Bu...i...0Y...z.((..'........>.t.f....f...jk?.0.@.N.._!O.....Cj6..a...t..}p.....Q......../.........<~......o>_le7...u..?...0.N9.P..........^.?...'!g.G.j .....-..t#..-}s....I{.J.+......;.I.YI...q/.vK.eG..(=5n.....<...*.P.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_12be25e65cc93e1440bc25fe8d545d5755fbd3f9d[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	12744
Entropy (8bit):	7.984434447626562
Encrypted:	false
SSDEEP:	384:m2VKB+rxH6ZgKPsL5Dw6qXoDYr9FplMsIyBo/1a:mfK6Zg6U5E64oK9FXMGo/E
MD5:	75340F2CA756FB72A15C6A269E20C3B6
SHA1:	96157EBE0D3D143A2C6B11F52D881C0AA9BA01E5
SHA-256:	8A1461DA7256179A86600B5C14F2BBDEF900851D8F40D82FC7B438AF8D89DEF9
SHA-512:	C72DE25E4AB647F10E062012DADE8B3FBA672A2AA529AD1EB320665F54AD40A3F5C1F32657BF424118BF7CB8018DE09A0E0C4A0BE20F42D9F0F9CE9749525E28
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/discover/templates/media_12be25e65cc93e1440bc25fe8d545d5755fbd3f9d.png?width=2000&format=webply&optimize=medium
Preview:	RIFF.1..WEBPVP8 .1........k.>u2.H$..!.w.H...gn.[....IL...?L;y..lp.j.....g.?w................".u.M..................b.i....P_.?..........-..G./..Q...w.../@.I......O...?....;...Y.[.....?....5.s.....w./.?..h>.?......S.W.........o...../m_...?s.....O....~..."&...H1...-....a3#..;[..z.'.-../..B..i:.&........}.....x..G.f.,x56....N:t.k....m7.Y;.?...NW.h<<m.......U.Y.ya9.i........O..1Y....}...q...rA.,Q....2..;.-.N.\|.~W.Y.O%H5WP<....+4l.t\|Eh.xX..ZwH.7F...h.-.VL...]0........\|...'....,b..Q.F...N.i..]lQ.............?...o....l..+..lb..\c.O.(...0.q).....>..J.(4.52.....4.)....Qr.2..h.R.^..>;.=...3.7....pr.z...;..&..O1)t.....{...v.32j).S........q......<..1........LK....<{.M...[.g. .....KV..q.,..jO..s..4.a...b....7..G#..TaY.YO/yX=1....D...QS.."9s....yR..Q.....6.......r.Vo4R..U...[K..$..Y'.j..w.._.W.....K......5..2...-..1.m~...2.,Y...PF..+..'./...&.....Q..QD.....N.3Y...G0...!..W\|_y....a.ZK.n.l.,.J..........4................a.8...5\.........nA_/.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_12ffb8f594d179340cbd2d62c4c20754c61bef675[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	9050
Entropy (8bit):	7.977963494130041
Encrypted:	false
SSDEEP:	192:A0TLhO72UStgZBt52PVmJKn+bA69ajuwYbL5npPjErN3QTIu+DFAiK:vTLhWyOBt52PVObdajbYbL5nd4hTu+Fo
MD5:	16B03AE7E942E7CA2A756CFA4865A71A
SHA1:	2CA89B1B463E27B5C1D90E7073C7A99FA3513144
SHA-256:	08C2F5D4031764B1C4968B8195EEEEC7659BC1154656C0830D4AD632C4382A95
SHA-512:	72F43FCF3D9591C07016C86A649678C8AB055952CA0DE8B8DBED7B75D1AB3ECDECB5E4BB0CC7FABB28B906794769E7D93A1BBBEE9DC8C45ECE48CC9D50D9B4DA
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/discover/templates/media_12ffb8f594d179340cbd2d62c4c20754c61bef675.png?width=2000&format=webply&optimize=medium
Preview:	RIFFR#..WEBPVP8 F#.........k.>u6.G.."!#.l....en.\|...`M.{6......8...._\..TG......7...........[.G...............'.O.w./._....j.E...._...o..........].c..._..............._.?......V......:.Y{....q...........g.....OTHp.>z...Yq.w#Ki)...7.L..j@../.&G.J.I.l...9.1.)Ns.....%.nT..Lc..E5.GkPw.a.."T...._I[B.Y].qT,+.R.>.x..b...i....$.2.^d.p....S..+..x.....P.......=...'..r..e.4...>`../D..?.9.=z...}.v7..{.l;$....h..K....Sr.D8J.}..N..,]Q...N.LA....:+.u./@.,.$ow:.q3..-.Se....I.r.W.m.X.V..\|....&.h&.....m...=..U..v.%L.+.ep.z6..Z..dlK...,..H.1`..L.m\|.#..Vi.... M.H....\.....X\..4..!..(:..z.8P./Owvj.'[.../n..T;...(.......#F..0Q~D.G#.0...uD.-.8..F...+...\|(.t..`..rY..Mfz.Q."..g....(\Z.....L.~...u..J..(.q....=@B{.:..`.Gn..bl)....;.j.F..)?%.7.+..gB.+.9.z.\|. ]/.28%x.}..S..i.......%Z......:...!.[?..I7...9[5..P..rwy09....H...#..&u...%.......,.. B..-.Y.&..<..._...J...M..^I..#L..R.i.5..&...k'..".:...d.Yx.3.N.x..3..g.....}.B...1..8....A...D;..........~Li.G..<H.L....X.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_1305c910c0a67cde46c623497f55543f11073ad37[1].jpeg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	8360
Entropy (8bit):	7.526038660340304
Encrypted:	false
SSDEEP:	192:iTo39Suu0GeweXkwDVC+rcAjAkkHqSbYBKWoy/9D:iwGi15V5jWSok9D
MD5:	396D3A51520B2A4909BDADFD389DEB05
SHA1:	C7E82C11A8A5657353A1AC24747D2947AB2548C9
SHA-256:	FDAE6BEFD121ED601DC35AC46B10CD9DEAE9A1B774FED0499863F3A802D48F2C
SHA-512:	D18801C9D405CDDCD5AB8C36A364C69007A70346B7F60D698123DDEC777374AD440CDF6F7A078358663C79C03B4F6888F348250A4CA566E4B610787BCB3BC0BE
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/create/media_1305c910c0a67cde46c623497f55543f11073ad37.jpeg?width=2000&format=webply&optimize=medium
Preview:	RIFF. ..WEBPVP8 . ...F...*....>u:.J$."!... ...in.wa....r.......~.{.(.m.{.o..d...u...../...O...?...}s............'..?.........."...........8.......+........P...g.d...../......>.Y....?...._y\|..(.....{.;.....8........>y.g.....G...t......<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x....<x......7...<x....<x....<x....<x..b.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_136c5cb6ad4a0d600e590f39420d670bb0df6b5c3[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	10908
Entropy (8bit):	7.98224084555292
Encrypted:	false
SSDEEP:	192:6nqEHXvk2yWmbxzITPo+PpstostXzartUR+IZTdj6MB86yNn0CU9Dncz9r:lEH81aZWys5zKyd5INnTUFcZr
MD5:	37E2D15C114E6D43DBEB510CE1C12927
SHA1:	3173B72D47EA2685B7F3D25ED6BEF3E66E2018B7
SHA-256:	0600C75B7CD5433C681620372ED2E5704D35E46B191995AAF1088C1D1A5B9579
SHA-512:	4DF6A1912D55B31CD664607562E31F1186C68988270A2EF4C95F11F64408A869D00DA8A686DCA505AE30107B50D3E86AE6519714F12CAA67B57C273D70825291
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/discover/templates/media_136c5cb6ad4a0d600e590f39420d670bb0df6b5c3.png?width=2000&format=webply&optimize=medium
Preview:	RIFF...WEBPVP8 ........,...>u6.H$.".$v. ...M.......%.>....V....?.,k.?...y..?.c......^.............G............(.....w...O..........h~....H.....7.......P...l.a...W.O._...+.....r.yr..v._,...?.x..............._._.\|..&i.....z....o...........>.?.?....../..._......[...?.?.........[....._8.........W./.O.>.?...~....T....i>.C.%..?...>.rv....w....G..]......O,..E.1..4.O...H.=..r.j#iZM...y.\2V..5......:....M-...I\|..6...."...........D.rLcp.......Fb.....=..i .a./......./.-..]..X..e..Q..,.Vm..5.hp[.....D.:.S......f.7......D0...5=.[\j{.G.&w....g.4....PB..v94..5C.....[@..8.6.7.?....l.~#...z.......Vb\|/y...4?.f.G...1Q.Pm#.m./.}e../N\|&.....-.6......qJ2...x[....Y.&...,Qp.Q.=+.......L]n.....`V...v......U.t...Jg.....y.7x...IH^...........G.'j.%...x....Vhq.....O$..+....B.............J"..........,...o...${.o.mT......X..k.O.O..d...P.`.C.5x=\.M.k..`8...d..m)..x..9p.G:!>..e..?@#.......le.)#.$L.P..&..\|......n.G.....X.A........U.Yi...FY./.p...s.:.g..s...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_13f1bc71a8681cdd7cb22c202f5a3c11bce1c01b5[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	12628
Entropy (8bit):	7.982545840794857
Encrypted:	false
SSDEEP:	384:SfcrQbUMDW4yQORBvyZ5zfcSeNPW2g6hx:7uDWd97vyZ9UfNe2zhx
MD5:	C82FA189EE214CD72B7CC9BC103291C1
SHA1:	D940ABFD7668D8A04ADF4419CB8A4B44542D5781
SHA-256:	13E2F45B312E32569613AB0CB690B04F6F1FA51322678D758AA6D9568E2D8366
SHA-512:	A4A2AF1170B19070B92A78158CDB31DEF3088AE222E0D059A2AAD4C4953332E85771F16E3FE805E5A8CF97C9CDB21A88B9013730A058FA5FF989B739E3C1E66B
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/discover/templates/media_13f1bc71a8681cdd7cb22c202f5a3c11bce1c01b5.png?width=2000&format=webply&optimize=medium
Preview:	RIFFL1..WEBPVP8 @1.........k.>u4.H$...&r.ip..in..Tq..a?.C...s...........{....[.L.....y.....W...?..g..._......_.../..'.....#.?....7........g.......?..]..../......~....{.........?...}7.y................{...?......\|1~...@R%~..De`.".c...D.y.8._..8.F\|.i[xM......v.a.x...R..2....+....H$.fN..kt..%j@.t...6oK...mI.4 .\..r.#im.UI....e.q......vQ5..8o.6.D..Y.y{.\G}M..........T...iJ..}t.2zg..FD..m..}=1{.f.....pD..dd\|.CC=........\L.[l...^h..s....K.].=M&..2...J..n.....j.......&...2.]..........UT......?..3.....U....}......2..f.Ct.a7kh`[$.x_.7&8.?..tz........3'...?.+C...{+W.soKp+.Y.....X..~(........A.G+...u.j.cAr2..f.....HZ..2GZ...k....5...T..iv:+....8Il....{..;bQ..\|.....`..r.../_....R..."o.T.:...1.....X...rp%.p.&<^4.Rh.@.#...S..<..N...#....{+h>vRO.....p.``._x...6..2....(..U.U..q..3Z.3..j......C........(&...X+4....H....n.]..^.c.....~@v.#C...?._x...G.....V)MP..4..'?..D...?2.r.....j..w.....Q....'....%}......J.....0x3...\...H..'+..o....O....n..!.u..t\|.(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_1414f90572f278eae7d49cf2222e9b7d0063180cd[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	7583
Entropy (8bit):	7.9682402325669415
Encrypted:	false
SSDEEP:	192:OvaQ0itv25JIQNCSCNXgB1dbwIAKlf0AT4CdY:OvftCIQ6NQnNhnJu
MD5:	5A509325B04D91D2F591B9354DBF978A
SHA1:	5B3FD56483BE38F599D69F7E84ABBE260C98C11E
SHA-256:	B194025E947012B53598A578437208ECAA6EE2BFEBED193E02C08131CABB3E64
SHA-512:	DE5B557E1865BD69228ACC9C81C5DA4D733F08CA38A28CEB6B1D50FFC68408FF664CA726FFFB975C53D74D717F0D84FC7BF10DD8482DB2DEA9C81F088157C02D
Malicious:	false
Preview:	RIFF....WEBPVP8X..............ALPH.S....X...mj...&\|......<.".?.#R........5.....\|.#..R..J...J.M..I "..].........4...."..}.:..PD'1Q.Py..O.7^.t..0.............$e\..$.:P.M,.j.t..Z.T.ng=(..p.R.G0.`.Lf..#....m.HR.]..........R..Tq^.&'g..4=c.N.,...i.U.....YMP..M..Q.$9n$!..o.4..$.P@.!v#&..d[m.'Dy..r.]....y..M.d....&/f^..._.....9.>..TM...-.A..l.ms...%.s.:....b.....d..~3..1..ql.}...=W.o..m{.[3kf.Aw.R?~".Y......DD.,.v.FA........h..84u`..A.+..4..a......./..q...rp..+.`..Xd.....G.a....sv0yV.\Q.r..B.....'.<)l~..\...O..... ........4..........{..^.]0~s..a.LN%.....7N..h..........u.!...x.F?..jZ.fE...q.......V..J..g-sz8).."@.?...;=..Sr....8..wN.{...X...G.....Y...N!'.>cy.......k-s6>.x..x<..VV..W\..pP....!.(..8.a>\.Q.../...A(Y......q.......]..!...n..B...%.B3....f.'u.AS.....m..k.t...o.........\...R].sj5\.'.[b.....V..y......Y....c.+..9..`....E...Y...D- kX....0=.......9..U.U. ....m...N...z...F;.I.j...C1/.#.7e...K.>J.i..%...0Y...v...[.N....P@....M......5l

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_153a9944efc4f66008369b127ef8ac607cf5a2f2e[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	15502
Entropy (8bit):	7.98589541672613
Encrypted:	false
SSDEEP:	384:4avLotIiOGdeULbLu3O1Uy+SJjPsZrjnHxgAFJYAZuGCw:WnXz3yOMAjynHOeYAZu/w
MD5:	83419D67087B63320C68B3EBC4555826
SHA1:	062F4932098A68F9599C2C99EF53294401BBE559
SHA-256:	DA81D743FB878FBA7554DABC55A0964C052A6D56F5A8D4FBCB66E9ECDA2B16D7
SHA-512:	207484B4A0B0A3A1AB81CFDF3510BE45D8B3DE74EA517F875E401813288E04DDD637E41D3C268BBDEB3A68D03CF705A193AF1BDDD92C4A802A690340500F7B84
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/discover/templates/media_153a9944efc4f66008369b127ef8ac607cf5a2f2e.png?width=2000&format=webply&optimize=medium
Preview:	RIFF.<..WEBPVP8 z<.........k.>u0.F...!)..h...bn.Pt.5......>..;~.Q{./.......=C.\.?.........Ov..?............I......I.........o..........w......._.....@?..f.......^.;..'....<=_.O.....1_.._>.Q...~.e.......N..........?.z.\|w..r...{........\|...@.R...s..........V..._.3.?..i>....q...W.S....?W..~..........'...u........\...o7. D-........qa..L....7s,..C<.V.C5.=..zJ........8......=..S.....E......Z....F.KL...K...@]..i....g.w...n..Q.q5%..A.......o=..!..^..{".x....V....&....>.&}..3.....V.~. D.G.Wg.%....".xS:.q.z..h&...F.$.JZgb.Wj:...-.HT.......u...a.../E;.@fx.:.U..4....2.s=?1K....'.ewB7....wc\.....1....q.Y.......z......W....La......Uoj..Bm.k.vN....J.D..<Y]ke...M.J.H0..qS.y.........s-/.....c.x%..:.X....s.8Y5..2j....jdE......;.....2......h./...s?..gO..".l$....d....yS...Kl.ly.T..[.=b12....jh..=5.sV..^{..+p..J.q9F..2......R/..n...K...Lm.CU..Ee../..L...s..,...'...fi..soq....R....=hO_......H...k/.j....{..U...\|../U.A......J.r.y....f./6..aj.....t..j...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_174ecc6dbabbb98eb5dde237dabdd3d20371598c0[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	6630
Entropy (8bit):	7.970522293634058
Encrypted:	false
SSDEEP:	192:3yvE4jwT3UtIyVpeydV1pozXsbgRrFoeAu+ZDJ5y:ivxcTkt2GzbGFI1Zzy
MD5:	10A85D06B222424CC9C9571EABBA257D
SHA1:	5C9CCFE9E6E864EB79EAEAE478E8DBE444BFFF9E
SHA-256:	F554F18D1C2B96AC105581380A48F0BEFCBF4057B04FDB117D0A2856884F4BED
SHA-512:	A174DB99E8EE9BB1D976C498C3A4F20CA17CFC49505855D54A853D7589E8038AF99B38C844474C6BAD85D488242BD0E7EC8AE5EF8AD778B14C14CDB5B5192D2C
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/discover/templates/media_174ecc6dbabbb98eb5dde237dabdd3d20371598c0.png?width=2000&format=webply&optimize=medium
Preview:	RIFF....WEBPVP8 ....0y...,...>u6.I$..."TJ....en.....o...].i....x.sW..X_.}@~j.c...W._....xO.>.<...=...=.......w...?.~My.......{..2.............x..P/........+....z..o._..n....#.g..p.......n\|.............._.'...?..........G...[.....~....k...3..7....t....D..&$T.1"....~..EA.......X0.&..$$.9Qe.d_>.GJ.f:...@W)..>5\|K<.......,..V...[...D.',1.)...D....v.#[...=+(3.......K.MQ.._...~..nr..?.Mb<B.U..5uo)z[G`.bRf^.....G.g..;.Z....O...f.......A\.5...S.\:.&.t.Jp2'..6....XXc.....3i....>./@..@.2..L..,g........{...(.',..`.v.2.. 8...f._...MRo6}.7....L.m.?......;.\...nL.e_.!d....4.....3-.....$J...\.E2%..O..r.....m......r.<.O.....W.K.......E.<....+t.1........>W.g.r.JY..a.@;....r(Z..V..=?[..../.l,.Om..XtH...X.x4.x..=.........,...5.UD......@..F.(.}_<..j.u]r..d....q#')A.r.jZ......C.+0.7..$U..h...S..I.?.....w/....3F....... .;.4.>....(.5.-w.....>D.Xq...gt.....0...<..&.$v`.Z-@...A.DK..O..9xy......)....Ha{..u...>..cJ..B..h...kB.<.w46G.f...6..."....LH.2bEA..*.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_17f1e6d035b268330c49c1a92e3daa7ac9e6a1844[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	9224
Entropy (8bit):	7.976810066591466
Encrypted:	false
SSDEEP:	192:XxtpXv4v5LjWWYi38uwc6mc75lroS9EHEWRerO6bdGb3tHv:XTpXv4x2WYNuwcOzrl9EHtReTxGt
MD5:	F63210EFD2178990D5D077B20BB4F468
SHA1:	6FFD154323C6BC68190A28F0FD306F1135E79D35
SHA-256:	2FCC885BFF41C1BA0F3003EDDEE547B8D198D5E27B7452A7D5597C827BAF6F0F
SHA-512:	891DBD2D38056FBE406546FF4A45D1D0A3823F7BCADC75E444A39B4A730AD2C671899378F3BB8B0B6AD70035C6F5B6D4A8822BD0E11C3BC2821E18A4C2E9E79E
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/discover/templates/media_17f1e6d035b268330c49c1a92e3daa7ac9e6a1844.png?width=2000&format=webply&optimize=medium
Preview:	RIFF.$..WEBPVP8 .#.......,...>u4.H....#t....cn.........&._......m....+.....x.tW._...?@.....B............\|.....#.....O.......}.<.=..............b...e......].....Op.......~W..........w.7...?.=....W.+.?...]..W.o@_]>..c.g.7........?.?....".w......\|O...../.../......~..1.M.{.....?.....-.........?................ ...b..Y....o/..:...8.)hS..;.R..yP.WJ$.[.8..N$Q.M>..@.7..x+.I.{...7..c.`Q..(............4&.w{.ex_......p.?.._..l...9.W' .........y{".%.Y.`!..d^V...1..-..@..G.y.@Y...\l ....~.k...d..dZ.;P...h1.9.P.....R........:y.2t...A.K..O.N..8.+...Q+...S.f..v....9...-..q.{Y....v.n..-....X..."p....X.\|.B..../....jm.1k...zL......A..?.d....A..e.c....&q.W...}....Ww..;...E.....R.....XV...4......c..-.....e....f.....~h.. ....L..e..9......^.......}m....Or.K@.._.\|B.0..MB.7....n..`..!.......s.V.q.(M?A..g..k.$U1.,.)[..2.nN.K..p.I0v..R...gX..>...(..$D...X.+...5..{8..1.<..<m.x.B.2.kk.k<K.c..F.].t...[..I6.c.}Y..<wg.W#.\.W..Phe.Km.`..!...........j..N8..F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_181b604b63bec3b8bbee889de292d1daea1530139[1].jpeg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	8292
Entropy (8bit):	7.759602489884572
Encrypted:	false
SSDEEP:	192:bZafxTBUUcjZetRs44bS3rttQH4uFq04sO0:bATBuetRV7ttQRFW0
MD5:	2CF10D42514EF842F3BBF35508623D23
SHA1:	831045C456D1606D73318BFFB9DF178CE6EC308D
SHA-256:	572A525434EDE642C011CEF6EADDBCD485FA8EFEB2D323E0BA1CE14C86CA6BF9
SHA-512:	D70E9F2A36F59B46F1623EC79E5CDA5C4947AF9394EA97D858E64C08F72F5F4EC12B4AC5F9BFA0349EAD6E9C405DE4EEA8F1C79BB6555969B8DC8118C69D4FC0
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/create/media_181b604b63bec3b8bbee889de292d1daea1530139.jpeg?width=2000&format=webply&optimize=medium
Preview:	RIFF\ ..WEBPVP8 P ...V.......>u:.J$."....@...in....#..~.....1..M?...s.y.o.S..C..d..z_>O.u...........{B;.....h..pE.+....Y?......3.`.....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p....8p..f...aB...(P.B...(P.B...(P.4xj..?...............$2.6+..^.z...^.z...^.z...7.....L.C.9.O..b..s.Y.. ...^..l.,!G..d.W{..........f{8....W,..\|..b.}5.^.z...^.z...^.z...S..9h......c.."8......]2(.y....TE..+..,..KDY4../+6t...k\|.\L.5.....f.6l.f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_1968c8f3dd906c601b557aba0c66fbd643d723203[1].jpeg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	16001
Entropy (8bit):	7.9260475506105
Encrypted:	false
SSDEEP:	384:51VbjiuxiUz/LEVJjcOuz3Dt1HVCPlmgns+pBXqC:5/XiuAUzQVJYrATvlF
MD5:	E10BCDBAE85362CF7AB1FBA39B7C8C4D
SHA1:	649FCB45F298A86B1D9BCF927F221F6D52274DA7
SHA-256:	491CDDBBCAC63FFEFD69CF89C3BEB1F55A2D0DC673571111984649F8C86D0CE7
SHA-512:	D65E674FA832259D9BA8493AD105258AEA7D22D3F7FB5E0DD3546720D7312593777225038C191EFB018AE13A4F504792FA2F19781098322238DDF95DC84E5095
Malicious:	false
Preview:	RIFF.B..WEBPVP8 .B..p....*....>u:.J$....qh....in.N.?+B5,<....y...`..+..t.................W.......}..`....yx{H.\|...w.i..?.?.=.............................y....Q..............a.M.......o....S.....W...w.{..2.......W.?.....~S.....?......?.....{...........P.v/3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3.._;.%..0...a3d...~...6..#K..O.!y.C...T...}..ng.u~.\d2.8K2C...7..3...`.v/3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>..3...s>...]...G.p.@-.._..k.....G...lB+..Q...id..(.?..3.6b...}..ng...}..ng...}..nJy..gs..0..;.j.\|.... .}...X.+......s..E.8i.qm../3...s>..3...s>..3....uj.M-5...l....).d$HJ&...q...P...na.lT..L....s>..3...s>..3...s>....-.8.6l..j, .....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_1a5f64a3bc2be800f6f8ab67daf17e7f0e7ce636d[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	10326
Entropy (8bit):	7.979768487789043
Encrypted:	false
SSDEEP:	192:WudZ13f5gjPOAMqTVMEcSAj3OvSqFevcKBELffafEENA/vVOFc:xdZ1P52MNEcFrSe5CbfgS9OFc
MD5:	7B3EE46514F25D79F816B2F2A0E2D6B2
SHA1:	C452D57F2864FC6E88C3B8F7B191CF1B92E73F1F
SHA-256:	5BBD58CAE1FCF68200DF325AC9BA0130B338E17C975873207CFD85618889600A
SHA-512:	879ADAB31768F24393B75C7BF9F4956B8909FE5F93B141CB058ED95FB9FD70301D478B819726494A85BEA0CBD2A4994EBC106153D8F6EC01346A4122448DA852
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/discover/templates/media_1a5f64a3bc2be800f6f8ab67daf17e7f0e7ce636d.png?width=2000&format=webply&optimize=medium
Preview:	RIFFN(..WEBPVP8 B(........k.>u8.H$..!$.L ...cn.[....M..zS.O;.Y...=.K...y......_......Q....~......e..........~.............k.......g.7.O.O...?r.............../...i.I...zm..VA.3.o1..gs.....~;}.............}...g=.?.y........=........S.....=...y....=....j......`WH!..z@I..M......m...T..!....uH.-.m..a...9O.B..!<.....~>...p....s.y..62......g..=+g.m...A...67.?D:...;9t0.Hz....lp... ..`r.0?eD.#....q....~...3...c.....lJ$...S..%z2...;2.)W..]p.W.>..]....,*+.......t..;.y..{....p(J...G.....k.~Z.c.....fi.V......G..d.,.e=..iE..N^`.].1.....J.80K.F..p.{.T....H?..^#....o..}NYMK.4....@.6..Kc.y..Ps..\!.^..d.t..c........c.II.....p5..t0...~..W..t.i...(..$...l..b."0..b....S.yh...&.B.J..$..G.ej.3....E..p.?.!........}..7.a...,G...K.\.......c...B...5.$.j.4-..v'.[...i.n....y-"i..V..;....q...[....n.8.\|...2..T..&.r..U.SM....kgg..w!.....Z.l.7Yy./..X..2.OC...0.-{T..b...%.I.~...rK..l.;......``.4[.h+......h..pr.oVQ.vL...&/....^y... .6.!I....h..w{>.n!...=G...cK.[...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_1a92e0ac878c2fd223de53d35d857869c15554031[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	8590
Entropy (8bit):	7.977187421262688
Encrypted:	false
SSDEEP:	192:wgqvM1TzqVApm676PjHkqGv3hnmYv67lLbMTi5SOIB9WCd:wtcTznmk+am26hvei5JI3
MD5:	FB859E52DD20BA87612747105AC952B0
SHA1:	AD06A39BEE6B13DACDF62CE5A3FA6C4AFFBF0C89
SHA-256:	71A1DAE9A84B243FE87BF0AEA3CE75154273B5579755475FD09253E650F705A8
SHA-512:	9BB340A124CC088A5527C448D634D62D36DA8C56DA72D0786641C7CDD52E6A48E9193F8B763F4F31C06992C6C45DAF6A1A3290BD21C21CDE877D54296F591555
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/discover/templates/media_1a92e0ac878c2fd223de53d35d857869c15554031.png?width=2000&format=webply&optimize=medium
Preview:	RIFF.!..WEBPVP8 z!..P}.....k.>u8.H.."!#.....in.:...P..H......A....vYO.'Q...o...?............_.<..&k^`..}.K..Q.;...3.....O9.....9.E..............#.e....._..s~..........?.o.....?.......;.)o....L0a.......S...../.\|.i....3p!&..<.xS.n.3...C.C._m......(..y..M.g}.l......rz.iM.D...Cf......O..l.1@./.,.^A.......f...S5H..l.`z.^ o.....k...).M.~.]wR.+;...t...u...8..wk..lu..$.l..........X.....A:..q..[1..^@z.....)!:..J.7.=...x..?b.......n3@.3gn.C.42:.....?..........o ........`S?.t.b..Hm.Xtw.T?@S....~..,V..).......1.....8M......:........$...m..s.5.z..aeD.U.f.[..q....,.]....o{...[E~..i.....}.-...M6wM..?O...kYtS.[..:....pK..c.MU.0.)V"..T..J...X.Ge......Z5[..-.8..A./y.~...T/O.5./_.}........X.o.. .C....;....H..I...\..e....M.f..\|..>.YX..K .b..#7..$.D..R.@...u.....E..t.5....VF.s.#U.i.k.[6...Yn.KM.By.J....l....&.0....;......QM...\|]..=k_..l....gvP.Q......n.....KB....W.S...i.".....I.}..U......D".2..VZ.l...7....Z ...$..1=....~..(..%..9u..c.].....4...l.t....tb.-S

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_1add7401488fed12c28150125da85e141e2081d96[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	7262
Entropy (8bit):	7.972800657105986
Encrypted:	false
SSDEEP:	96:gZZJ9S+eUWHuU0Rqk9q4+zzMFIxKWOGjj2v7n+AaCVP4CrbrmzY4fO5NALOTHxYY:gZZJxWZ0RDq4+zzRxk2jcj5axeaEazQ
MD5:	13AB0F1839F68C406E8F6F9CF3C359B0
SHA1:	0931E45F5C57946B5948A750E4F50229E3C3DF70
SHA-256:	8FDAA9139DFC94373125757FF37216A14866FDE9F86AC4C4491CE5F50240E663
SHA-512:	E412AD3AFC5EDE4EEBAB8FE0A2C9AAD0F57EFB190EDE428D289E5ED2A02393C2506C8C94654DD9FA265DEE5D60E472886E0FFCFD6F080F24E279BCD220F67A24
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/discover/templates/media_1add7401488fed12c28150125da85e141e2081d96.png?width=2000&format=webply&optimize=medium
Preview:	RIFFV...WEBPVP8 J...pr...*..k.>u4.I$..!#P.x...in.r..>r........g.o...~y.9......?{;d..K>q..._.<..{...?........O..C.q'...}w..x..?............~.?..Q.g.g...O..y...g....O.?....+.........W.......?..m.........7.o..r...8.X.9c....8.X.9b..........:...B..2.T...U#U..<.^..)_.I.K~q.RR..'h..........h.#.6\|.f .]IQ_..lpRFL...N._........8.X.9X...=..e......j.......y...d.%.b....._..G..C..v6R.q..}...`...........G.=6<.."..`.H.&..CX..0.Bw1....#......\|..?..L$..p.8.Kv..l.KN...x..v..]..nK..........,.{u....=.[...e[..^.........._......J..Y...v\@v...=R..e..PhJ-.u.....V.+i..k.....Yb#.....{b.u@...^X1.....C.'...[.y.p......e"..Y........@......\%0.+ 2...f....{..YY...`7.......o+P.j.E\|w.`.$...~.......t....... ..b..1.S......x.z.....T."....G......%...L..y[[....M(.Bl.._..af:j.8a.>.<_...C.N....&...,t.6.8Yc&.UF#.6....^.(..p,e.!...@..d....8....s.8..N32../............9@9Sq.b.{7...).r<.Za..?.?.u..q.\|.o..O..x..[w.....q...Y.T........"z.V..[Z`...p..#...Fy.7.....n......qE.<.cPh...P.[@..7.%.3b..\..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\media_1b1edc2eb0698cdb9a2fe1b8b32e420743c6137b4[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	9458
Entropy (8bit):	7.978909076804826
Encrypted:	false
SSDEEP:	192:+7op9Mt9JgeFZOnME8DM+mJ80pOWvM5t+xrMfmPi4gzKkVfpR8F/7/SB:gJT38ME8HSO8Mj+xru4gOQwF/7/SB
MD5:	B1FDC53A3202237C8FD7FC9122BEBDDC
SHA1:	7A534922F4B6333901AAB35F50138B7F8ADA2E63
SHA-256:	09F6B16C71FC41F43FBD74117093D0009954793DD0126AE23A0F044311050393
SHA-512:	6B796E0C658A31760357F767AB128B2FE35E20D9F74ACC84AE8E5193735BC2DEC34BBB11B09AB782611F9022D21068C45B7E7D911B2762553ECE90603BFAFE5B
Malicious:	false
IE Cache URL:	https://www.adobe.com/express/discover/templates/media_1b1edc2eb0698cdb9a2fe1b8b32e420743c6137b4.png?width=2000&format=webply&optimize=medium
Preview:	RIFF.$..WEBPVP8 .$.........k.>u6.H....%3.....gn..X0]f[....y..Iz/#..........k....L..^a...%.v..;..._.e.Q..%.....v....s....s...N0.G.....?v.g........M..._.\|.v.n~a..}.........................g...?........[......w...o\|..e.o.!.........p[&...9..]...".E+.k<."k.y.4.3Q.c.]/.[o+S.K.J7.&...TW.[.,...dI..._.P..E;l...a....d.@Q.Z..........v.@......).R........7t....6bb.k.qmgL.g6..;.&.L......Cs..z..ky:9.._.kpT.m......Ch..P.s.t.2\|]..4.........&.EZ.%.-Z.\|.X..`..j.a.....l.kC.....\|..o...o......u..R......(.s..V)..".UGP.n.y{..k.............Y/...nUW.:]..o..1.$..\..-I.....i.d..0.....Mm.{...X4z...5...?...B....R..J..c].d...N.5.....nB....4..B;$....8....0.$u.L.@f.Q@.w......)h~....8.....[#.QR..8o]..De........5";e._....8~UBK;..b......I.....N.v..X..aw:Y..g;..!.#..b.~.1l.[0...7F..\|g.3Z.9..n..c..w..b.~QG7..WnW.VbH.Se..f.@3.s.. .F.Hxw..[....:..S>......_......:.$s..8l.."2.i...r.....^...4....WC..z2.)....(.-..o.....~..P.....7adP#!E,..8J..*.G.....q...c..3..._.g.:D`!......p..aB

Static File Info

General
File type:	PDF document, version 1.4
Entropy (8bit):	7.923657090473706
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Tribeca Investment Partners - Funds.pdf
File size:	200272
MD5:	1f514a862d7eb6e2c4952b67a97a4e56
SHA1:	4a4d5f759793397ebdc72679895ef62f6a74fed3
SHA256:	6c796e1a57333bc61e0a45a6398da2393ce0529304b57abc8d22125862a02211
SHA512:	0911f3f36a44bd0ded6b5b21d422478e3000eda11b8e1aaf8183fcbdb469f50ff9c66a84d6bd140114c7a434d2059ef22d8de57f942bcbfb1b662892fafa9df7
SSDEEP:	3072:/09brBZCFS4SyYp1XNvubBFrrsVntyaNEwg5SN6mRsY/NNQbcuvfiwXx+HxM8nbV:/012FS1vGFrrSyaNd6bufQXlhSqb4t2i
File Content Preview:	%PDF-1.4.%.....1 0 obj.<<./Type /Catalog./Pages 2 0 R./MarkInfo <<./Type /MarkInfo./Marked true.>>./StructTreeRoot 3 0 R.>>.endobj.4 0 obj.<<./Creator (Canva)./Producer (Canva)./CreationDate (D:20210610134729+00'00')./ModDate (D:20210610134729+00'00')./Ke

File Icon


Icon Hash:	74ecccdcd4ccccf0

Static PDF Info

General
Header:	%PDF-1.4
Total Entropy:	7.923657
Total Bytes:	200272
Stream Entropy:	7.979116
Stream Bytes:	182979
Entropy outside Streams:	0.000000
Bytes outside Streams:	17293
Number of EOF found:	2
Bytes after EOF:

Keywords Statistics

Name	Count
obj	124
endobj	124
stream	9
endstream	9
xref	2
trailer	2
startxref	2
/Page	2
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
12	50a49a92a2b2ac40	11d882a5533667ff70efe6570562d5e6

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 11, 2021 10:40:17.073354006 CEST	49735	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.073970079 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.116117954 CEST	443	49735	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.116213083 CEST	49735	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.116724968 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.116906881 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.132297993 CEST	49735	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.132345915 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.174973965 CEST	443	49735	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.175002098 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.175241947 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.175266027 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.175307035 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.175335884 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.177321911 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.177422047 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.179094076 CEST	443	49735	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.179125071 CEST	443	49735	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.179205894 CEST	49735	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.184060097 CEST	443	49735	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.184130907 CEST	49735	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.208595991 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.208655119 CEST	49735	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.214098930 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.214235067 CEST	49735	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.214456081 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.251410961 CEST	443	49735	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.251468897 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.251790047 CEST	443	49735	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.251822948 CEST	443	49735	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.251854897 CEST	49735	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.251885891 CEST	49735	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.252536058 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.252648115 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.252666950 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.252726078 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.253379107 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.253664017 CEST	49735	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.256846905 CEST	443	49735	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.256879091 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.256966114 CEST	443	49735	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.256993055 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.257025957 CEST	49735	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.259983063 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.260124922 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.296186924 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.296241999 CEST	443	49735	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.429012060 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.429088116 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.429141998 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.429166079 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.429199934 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.429203987 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.429208994 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.429260015 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.429966927 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.430030107 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.430038929 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.430088997 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.431143999 CEST	443	49736	13.225.74.123	192.168.2.3
Jun 11, 2021 10:40:17.431221008 CEST	49736	443	192.168.2.3	13.225.74.123
Jun 11, 2021 10:40:17.622049093 CEST	49737	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.622080088 CEST	49738	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.622184038 CEST	49740	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.622193098 CEST	49739	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.622402906 CEST	49741	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.664978981 CEST	443	49740	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.665024042 CEST	443	49737	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.665051937 CEST	443	49738	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.665080070 CEST	443	49739	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.665106058 CEST	443	49741	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.665132046 CEST	49737	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.665174961 CEST	49740	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.665201902 CEST	49739	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.665208101 CEST	49738	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.665219069 CEST	49741	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.666585922 CEST	49737	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.666795015 CEST	49740	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.666816950 CEST	49739	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.666842937 CEST	49738	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.666856050 CEST	49741	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.709295034 CEST	443	49737	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.709337950 CEST	443	49740	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.709366083 CEST	443	49739	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.709388971 CEST	443	49738	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.709415913 CEST	443	49741	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.710932970 CEST	443	49741	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.710993052 CEST	443	49741	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.711080074 CEST	49741	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.711132050 CEST	49741	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.712482929 CEST	443	49738	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.712538958 CEST	443	49738	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.712644100 CEST	49738	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.712693930 CEST	49738	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.713138103 CEST	443	49740	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.713191986 CEST	443	49740	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.713227987 CEST	49740	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.713257074 CEST	49740	443	192.168.2.3	13.224.195.109
Jun 11, 2021 10:40:17.714442968 CEST	443	49741	13.224.195.109	192.168.2.3
Jun 11, 2021 10:40:17.714519024 CEST	49741	443	192.168.2.3	13.224.195.109

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 11, 2021 10:39:11.887558937 CEST	57544	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:11.937467098 CEST	53	57544	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:14.042583942 CEST	55984	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:14.092966080 CEST	53	55984	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:21.801464081 CEST	64185	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:21.816705942 CEST	65110	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:21.861926079 CEST	53	64185	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:21.879523993 CEST	53	65110	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:22.836148024 CEST	65110	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:22.836229086 CEST	64185	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:22.897349119 CEST	53	64185	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:22.899215937 CEST	53	65110	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:23.883187056 CEST	64185	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:23.883276939 CEST	65110	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:23.943908930 CEST	53	64185	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:23.946171999 CEST	53	65110	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:25.932111979 CEST	64185	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:25.932157993 CEST	65110	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:25.991391897 CEST	53	64185	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:25.993674040 CEST	53	65110	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:29.798913956 CEST	58361	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:29.850461006 CEST	53	58361	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:29.994689941 CEST	65110	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:29.994798899 CEST	64185	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:30.047950029 CEST	53	65110	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:30.053685904 CEST	53	64185	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:30.695847034 CEST	63492	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:30.749406099 CEST	53	63492	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:31.613392115 CEST	60831	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:31.666630983 CEST	53	60831	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:32.498750925 CEST	60100	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:32.552016020 CEST	53	60100	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:32.891803026 CEST	53195	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:32.972542048 CEST	53	53195	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:33.374037027 CEST	50141	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:33.424731970 CEST	53	50141	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:34.182487965 CEST	53023	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:34.233170033 CEST	53	53023	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:35.218832016 CEST	49563	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:35.270080090 CEST	53	49563	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:36.102462053 CEST	51352	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:36.161194086 CEST	53	51352	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:36.964030981 CEST	59349	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:37.014481068 CEST	53	59349	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:37.863528967 CEST	57084	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:37.924314022 CEST	53	57084	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:38.385230064 CEST	58823	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:38.435683012 CEST	53	58823	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:39.647609949 CEST	57568	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:39.698771954 CEST	53	57568	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:41.298959017 CEST	50540	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:41.352386951 CEST	53	50540	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:42.090192080 CEST	54366	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:42.140913010 CEST	53	54366	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:42.957906008 CEST	53034	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:43.011218071 CEST	53	53034	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:43.743139029 CEST	57762	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:43.796427011 CEST	53	57762	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:44.567112923 CEST	55435	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:44.627648115 CEST	53	55435	8.8.8.8	192.168.2.3
Jun 11, 2021 10:39:55.267949104 CEST	50713	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:39:55.334698915 CEST	53	50713	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:02.901074886 CEST	56132	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:02.984978914 CEST	53	56132	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:09.754539013 CEST	58987	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:09.826435089 CEST	53	58987	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:13.798511982 CEST	56579	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:13.859103918 CEST	53	56579	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:14.119606972 CEST	60633	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:14.191540003 CEST	53	60633	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:16.994467974 CEST	61292	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:17.057204008 CEST	53	61292	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:17.501697063 CEST	63619	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:17.565608978 CEST	53	63619	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:17.793529034 CEST	64938	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:17.855024099 CEST	53	64938	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:18.395910978 CEST	61946	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:18.446257114 CEST	53	61946	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:18.511737108 CEST	64910	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:18.574915886 CEST	53	64910	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:19.530021906 CEST	52123	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:19.593228102 CEST	53	52123	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:40.645037889 CEST	59420	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:40.707321882 CEST	53	59420	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:43.826235056 CEST	58784	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:43.886996984 CEST	53	58784	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:44.888362885 CEST	58784	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:44.925647974 CEST	63978	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:44.938487053 CEST	53	58784	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:44.980153084 CEST	62938	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:44.983550072 CEST	55708	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:44.993217945 CEST	53	63978	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:45.042342901 CEST	53	55708	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:45.049305916 CEST	53	62938	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:45.749238968 CEST	56803	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:45.813124895 CEST	53	56803	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:45.937753916 CEST	58784	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:45.997876883 CEST	53	58784	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:46.021346092 CEST	55708	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:46.079886913 CEST	53	55708	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:46.335987091 CEST	57145	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:46.403497934 CEST	53	57145	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:47.068310976 CEST	55708	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:47.127098083 CEST	53	55708	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:47.930043936 CEST	58784	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:47.988598108 CEST	53	58784	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:48.434787989 CEST	55359	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:48.479218960 CEST	58306	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:48.499056101 CEST	53	55359	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:48.547401905 CEST	53	58306	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:49.115597010 CEST	55708	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:49.167922974 CEST	53	55708	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:50.724638939 CEST	64124	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:50.787004948 CEST	53	64124	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:51.944402933 CEST	58784	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:52.005476952 CEST	53	58784	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:53.116153002 CEST	55708	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:53.176492929 CEST	53	55708	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:53.789433002 CEST	49361	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:53.852684975 CEST	53	49361	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:54.620053053 CEST	63150	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:54.650521994 CEST	53279	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:54.680588961 CEST	53	63150	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:54.712351084 CEST	53	53279	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:55.037878036 CEST	56881	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:55.099977016 CEST	53	56881	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:55.131294966 CEST	53642	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:55.195352077 CEST	53	53642	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:55.553441048 CEST	55667	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:55.623516083 CEST	53	55667	8.8.8.8	192.168.2.3
Jun 11, 2021 10:40:56.104893923 CEST	54833	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:40:56.168873072 CEST	53	54833	8.8.8.8	192.168.2.3
Jun 11, 2021 10:41:53.364530087 CEST	62476	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:41:53.426177025 CEST	53	62476	8.8.8.8	192.168.2.3
Jun 11, 2021 10:41:54.092619896 CEST	49705	53	192.168.2.3	8.8.8.8
Jun 11, 2021 10:41:54.156610966 CEST	53	49705	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 11, 2021 10:40:17.501697063 CEST	192.168.2.3	8.8.8.8	0x5c7e	Standard query (0)	page.adobespark-assets.com	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:17.793529034 CEST	192.168.2.3	8.8.8.8	0x6259	Standard query (0)	use.typekit.net	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:18.395910978 CEST	192.168.2.3	8.8.8.8	0x42be	Standard query (0)	s3.amazonaws.com	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:18.511737108 CEST	192.168.2.3	8.8.8.8	0x547b	Standard query (0)	p.typekit.net	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:40.645037889 CEST	192.168.2.3	8.8.8.8	0x5929	Standard query (0)	page.adobespark-assets.com	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:44.925647974 CEST	192.168.2.3	8.8.8.8	0xc010	Standard query (0)	xinviaoafinabatizx.us-south.cf.appdomain.cloud	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:45.749238968 CEST	192.168.2.3	8.8.8.8	0x4e3b	Standard query (0)	kifot.wancdnapp.page	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:46.335987091 CEST	192.168.2.3	8.8.8.8	0x96fb	Standard query (0)	rikapcndbn.web.app	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:48.434787989 CEST	192.168.2.3	8.8.8.8	0x9d1b	Standard query (0)	unpkg.com	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:53.789433002 CEST	192.168.2.3	8.8.8.8	0xa525	Standard query (0)	static.adobelogin.com	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:54.620053053 CEST	192.168.2.3	8.8.8.8	0x3f65	Standard query (0)	assets.adobedtm.com	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:54.650521994 CEST	192.168.2.3	8.8.8.8	0xc0d2	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:55.037878036 CEST	192.168.2.3	8.8.8.8	0x5fce	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:55.131294966 CEST	192.168.2.3	8.8.8.8	0x4bc3	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:56.104893923 CEST	192.168.2.3	8.8.8.8	0x5c64	Standard query (0)	api.demandbase.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 11, 2021 10:40:14.191540003 CEST	8.8.8.8	192.168.2.3	0xaf97	No error (0)	spark.adobeprojectm.com		13.225.74.22	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:14.191540003 CEST	8.8.8.8	192.168.2.3	0xaf97	No error (0)	spark.adobeprojectm.com		13.225.74.35	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:14.191540003 CEST	8.8.8.8	192.168.2.3	0xaf97	No error (0)	spark.adobeprojectm.com		13.225.74.123	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:14.191540003 CEST	8.8.8.8	192.168.2.3	0xaf97	No error (0)	spark.adobeprojectm.com		13.225.74.86	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:17.057204008 CEST	8.8.8.8	192.168.2.3	0x1bb	No error (0)	spark.adobeprojectm.com		13.225.74.123	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:17.057204008 CEST	8.8.8.8	192.168.2.3	0x1bb	No error (0)	spark.adobeprojectm.com		13.225.74.22	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:17.057204008 CEST	8.8.8.8	192.168.2.3	0x1bb	No error (0)	spark.adobeprojectm.com		13.225.74.86	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:17.057204008 CEST	8.8.8.8	192.168.2.3	0x1bb	No error (0)	spark.adobeprojectm.com		13.225.74.35	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:17.565608978 CEST	8.8.8.8	192.168.2.3	0x5c7e	No error (0)	page.adobespark-assets.com		13.224.195.109	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:17.565608978 CEST	8.8.8.8	192.168.2.3	0x5c7e	No error (0)	page.adobespark-assets.com		13.224.195.10	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:17.565608978 CEST	8.8.8.8	192.168.2.3	0x5c7e	No error (0)	page.adobespark-assets.com		13.224.195.74	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:17.565608978 CEST	8.8.8.8	192.168.2.3	0x5c7e	No error (0)	page.adobespark-assets.com		13.224.195.73	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:17.855024099 CEST	8.8.8.8	192.168.2.3	0x6259	No error (0)	use.typekit.net	use-stls.adobe.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 10:40:18.446257114 CEST	8.8.8.8	192.168.2.3	0x42be	No error (0)	s3.amazonaws.com		52.216.105.77	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:18.574915886 CEST	8.8.8.8	192.168.2.3	0x547b	No error (0)	p.typekit.net	p.typekit.net-v3.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 10:40:40.707321882 CEST	8.8.8.8	192.168.2.3	0x5929	No error (0)	page.adobespark-assets.com		13.224.195.10	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:40.707321882 CEST	8.8.8.8	192.168.2.3	0x5929	No error (0)	page.adobespark-assets.com		13.224.195.109	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:40.707321882 CEST	8.8.8.8	192.168.2.3	0x5929	No error (0)	page.adobespark-assets.com		13.224.195.74	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:40.707321882 CEST	8.8.8.8	192.168.2.3	0x5929	No error (0)	page.adobespark-assets.com		13.224.195.73	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:44.993217945 CEST	8.8.8.8	192.168.2.3	0xc010	No error (0)	xinviaoafinabatizx.us-south.cf.appdomain.cloud		169.47.124.25	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:44.993217945 CEST	8.8.8.8	192.168.2.3	0xc010	No error (0)	xinviaoafinabatizx.us-south.cf.appdomain.cloud		169.46.89.154	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:44.993217945 CEST	8.8.8.8	192.168.2.3	0xc010	No error (0)	xinviaoafinabatizx.us-south.cf.appdomain.cloud		169.62.254.82	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:45.813124895 CEST	8.8.8.8	192.168.2.3	0x4e3b	No error (0)	kifot.wancdnapp.page		172.67.145.59	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:45.813124895 CEST	8.8.8.8	192.168.2.3	0x4e3b	No error (0)	kifot.wancdnapp.page		104.21.47.62	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:46.403497934 CEST	8.8.8.8	192.168.2.3	0x96fb	No error (0)	rikapcndbn.web.app		151.101.1.195	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:46.403497934 CEST	8.8.8.8	192.168.2.3	0x96fb	No error (0)	rikapcndbn.web.app		151.101.65.195	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:48.499056101 CEST	8.8.8.8	192.168.2.3	0x9d1b	No error (0)	unpkg.com		104.16.123.175	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:48.499056101 CEST	8.8.8.8	192.168.2.3	0x9d1b	No error (0)	unpkg.com		104.16.122.175	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:48.499056101 CEST	8.8.8.8	192.168.2.3	0x9d1b	No error (0)	unpkg.com		104.16.126.175	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:48.499056101 CEST	8.8.8.8	192.168.2.3	0x9d1b	No error (0)	unpkg.com		104.16.125.175	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:48.499056101 CEST	8.8.8.8	192.168.2.3	0x9d1b	No error (0)	unpkg.com		104.16.124.175	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:53.852684975 CEST	8.8.8.8	192.168.2.3	0xa525	No error (0)	static.adobelogin.com	adobelogin-static.prod.ims.adobejanus.com		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 10:40:53.852684975 CEST	8.8.8.8	192.168.2.3	0xa525	No error (0)	adobelogin-static.prod.ims.adobejanus.com	dd20fzx9mj46f.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 10:40:53.852684975 CEST	8.8.8.8	192.168.2.3	0xa525	No error (0)	dd20fzx9mj46f.cloudfront.net		13.224.187.69	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:54.680588961 CEST	8.8.8.8	192.168.2.3	0x3f65	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 10:40:54.712351084 CEST	8.8.8.8	192.168.2.3	0xc0d2	No error (0)	cdn.cookielaw.org		104.16.148.64	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:54.712351084 CEST	8.8.8.8	192.168.2.3	0xc0d2	No error (0)	cdn.cookielaw.org		104.16.149.64	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:55.099977016 CEST	8.8.8.8	192.168.2.3	0x5fce	No error (0)	geolocation.onetrust.com		104.20.184.68	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:55.099977016 CEST	8.8.8.8	192.168.2.3	0x5fce	No error (0)	geolocation.onetrust.com		104.20.185.68	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:55.195352077 CEST	8.8.8.8	192.168.2.3	0x4bc3	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 10:40:55.195352077 CEST	8.8.8.8	192.168.2.3	0x4bc3	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 10:40:55.195352077 CEST	8.8.8.8	192.168.2.3	0x4bc3	No error (0)	edge-irl1.demdex.net	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 10:40:55.195352077 CEST	8.8.8.8	192.168.2.3	0x4bc3	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		63.33.31.50	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:55.195352077 CEST	8.8.8.8	192.168.2.3	0x4bc3	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		52.19.195.165	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:55.195352077 CEST	8.8.8.8	192.168.2.3	0x4bc3	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		18.200.233.208	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:55.195352077 CEST	8.8.8.8	192.168.2.3	0x4bc3	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		52.16.73.168	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:55.195352077 CEST	8.8.8.8	192.168.2.3	0x4bc3	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		34.243.47.58	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:55.195352077 CEST	8.8.8.8	192.168.2.3	0x4bc3	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		52.211.62.226	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:55.195352077 CEST	8.8.8.8	192.168.2.3	0x4bc3	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		52.209.141.237	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:55.195352077 CEST	8.8.8.8	192.168.2.3	0x4bc3	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		52.30.135.179	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:55.623516083 CEST	8.8.8.8	192.168.2.3	0x88a4	No error (0)	adobe.com.ssl.d1.sc.omtrdc.net		15.236.176.210	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:55.623516083 CEST	8.8.8.8	192.168.2.3	0x88a4	No error (0)	adobe.com.ssl.d1.sc.omtrdc.net		15.188.95.229	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:55.623516083 CEST	8.8.8.8	192.168.2.3	0x88a4	No error (0)	adobe.com.ssl.d1.sc.omtrdc.net		13.36.218.177	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:56.168873072 CEST	8.8.8.8	192.168.2.3	0x5c64	No error (0)	api.demandbase.com		13.225.74.37	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:56.168873072 CEST	8.8.8.8	192.168.2.3	0x5c64	No error (0)	api.demandbase.com		13.225.74.58	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:56.168873072 CEST	8.8.8.8	192.168.2.3	0x5c64	No error (0)	api.demandbase.com		13.225.74.124	A (IP address)	IN (0x0001)
Jun 11, 2021 10:40:56.168873072 CEST	8.8.8.8	192.168.2.3	0x5c64	No error (0)	api.demandbase.com		13.225.74.112	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jun 11, 2021 10:40:17.177321911 CEST	13.225.74.123	443	192.168.2.3	49736	CN=spark.adobe.com, OU=IT, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Jun 05 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Fri Jun 10 14:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	3faf2df7ab96c36419c31725cb1fa7d6
Jun 11, 2021 10:40:17.177321911 CEST	13.225.74.123	443	192.168.2.3	49736	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		3faf2df7ab96c36419c31725cb1fa7d6
Jun 11, 2021 10:40:17.184060097 CEST	13.225.74.123	443	192.168.2.3	49735	CN=spark.adobe.com, OU=IT, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Jun 05 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Fri Jun 10 14:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	3faf2df7ab96c36419c31725cb1fa7d6
Jun 11, 2021 10:40:17.184060097 CEST	13.225.74.123	443	192.168.2.3	49735	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		3faf2df7ab96c36419c31725cb1fa7d6
Jun 11, 2021 10:40:17.714442968 CEST	13.224.195.109	443	192.168.2.3	49741	CN=spark.adobe.com, OU=IT, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Jun 05 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Fri Jun 10 14:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:17.714442968 CEST	13.224.195.109	443	192.168.2.3	49741	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:17.718247890 CEST	13.224.195.109	443	192.168.2.3	49740	CN=spark.adobe.com, OU=IT, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Jun 05 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Fri Jun 10 14:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:17.718247890 CEST	13.224.195.109	443	192.168.2.3	49740	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:17.719372034 CEST	13.224.195.109	443	192.168.2.3	49739	CN=spark.adobe.com, OU=IT, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Jun 05 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Fri Jun 10 14:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:17.719372034 CEST	13.224.195.109	443	192.168.2.3	49739	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:17.719419956 CEST	13.224.195.109	443	192.168.2.3	49738	CN=spark.adobe.com, OU=IT, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Jun 05 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Fri Jun 10 14:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:17.719419956 CEST	13.224.195.109	443	192.168.2.3	49738	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:17.721640110 CEST	13.224.195.109	443	192.168.2.3	49737	CN=spark.adobe.com, OU=IT, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Jun 05 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Fri Jun 10 14:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:17.721640110 CEST	13.224.195.109	443	192.168.2.3	49737	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:18.729166985 CEST	52.216.105.77	443	192.168.2.3	49744	CN=s3.amazonaws.com, O="Amazon.com, Inc.", L=Seattle, ST=Washington, C=US CN=DigiCert Baltimore CA-2 G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Baltimore CA-2 G2, OU=www.digicert.com, O=DigiCert Inc, C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Aug 04 02:00:00 CEST 2020 Tue Dec 08 13:05:07 CET 2015	Mon Aug 09 14:00:00 CEST 2021 Sat May 10 14:00:00 CEST 2025	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	3faf2df7ab96c36419c31725cb1fa7d6
Jun 11, 2021 10:40:18.729166985 CEST	52.216.105.77	443	192.168.2.3	49744	CN=DigiCert Baltimore CA-2 G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Dec 08 13:05:07 CET 2015	Sat May 10 14:00:00 CEST 2025		3faf2df7ab96c36419c31725cb1fa7d6
Jun 11, 2021 10:40:18.732147932 CEST	52.216.105.77	443	192.168.2.3	49745	CN=s3.amazonaws.com, O="Amazon.com, Inc.", L=Seattle, ST=Washington, C=US CN=DigiCert Baltimore CA-2 G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Baltimore CA-2 G2, OU=www.digicert.com, O=DigiCert Inc, C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Aug 04 02:00:00 CEST 2020 Tue Dec 08 13:05:07 CET 2015	Mon Aug 09 14:00:00 CEST 2021 Sat May 10 14:00:00 CEST 2025	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	3faf2df7ab96c36419c31725cb1fa7d6
Jun 11, 2021 10:40:18.732147932 CEST	52.216.105.77	443	192.168.2.3	49745	CN=DigiCert Baltimore CA-2 G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Dec 08 13:05:07 CET 2015	Sat May 10 14:00:00 CEST 2025		3faf2df7ab96c36419c31725cb1fa7d6
Jun 11, 2021 10:40:45.335684061 CEST	169.47.124.25	443	192.168.2.3	49758	CN=*.us-south.cf.appdomain.cloud, OU=IBM Cloud, O=International Business Machines Corporation, L=Armonk, ST=New York, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 27 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Wed Sep 01 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:45.335684061 CEST	169.47.124.25	443	192.168.2.3	49758	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:45.336956978 CEST	169.47.124.25	443	192.168.2.3	49759	CN=*.us-south.cf.appdomain.cloud, OU=IBM Cloud, O=International Business Machines Corporation, L=Armonk, ST=New York, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 27 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Wed Sep 01 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:45.336956978 CEST	169.47.124.25	443	192.168.2.3	49759	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:45.908082962 CEST	172.67.145.59	443	192.168.2.3	49761	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Thu Mar 11 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Fri Mar 11 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:45.908082962 CEST	172.67.145.59	443	192.168.2.3	49761	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:45.910037041 CEST	172.67.145.59	443	192.168.2.3	49762	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Thu Mar 11 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Fri Mar 11 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:45.910037041 CEST	172.67.145.59	443	192.168.2.3	49762	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:46.501624107 CEST	151.101.1.195	443	192.168.2.3	49764	CN=web.app CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Wed May 19 23:19:33 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Tue Aug 17 23:19:32 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1D4, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028
Jun 11, 2021 10:40:46.517654896 CEST	151.101.1.195	443	192.168.2.3	49763	CN=web.app CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Wed May 19 23:19:33 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Tue Aug 17 23:19:32 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1D4, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028
Jun 11, 2021 10:40:48.593715906 CEST	104.16.123.175	443	192.168.2.3	49766	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Sun Aug 02 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Mon Aug 02 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:48.593715906 CEST	104.16.123.175	443	192.168.2.3	49766	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:48.597836971 CEST	104.16.123.175	443	192.168.2.3	49765	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Sun Aug 02 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Mon Aug 02 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:48.597836971 CEST	104.16.123.175	443	192.168.2.3	49765	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:53.990483046 CEST	13.224.187.69	443	192.168.2.3	49770	CN=static.adobelogin.com, OU=IT, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Sep 18 02:00:00 CEST 2019 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Wed Sep 22 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Jun 11, 2021 10:40:53.994195938 CEST	13.224.187.69	443	192.168.2.3	49771	CN=static.adobelogin.com, OU=IT, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Sep 18 02:00:00 CEST 2019 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Wed Sep 22 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Jun 11, 2021 10:40:54.870266914 CEST	104.16.148.64	443	192.168.2.3	49774	CN=cookielaw.org, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Jun 01 02:00:00 CEST 2021 Mon Jan 27 13:48:08 CET 2020	Wed Jun 01 01:59:59 CEST 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:54.870266914 CEST	104.16.148.64	443	192.168.2.3	49774	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:54.871398926 CEST	104.16.148.64	443	192.168.2.3	49775	CN=cookielaw.org, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Jun 01 02:00:00 CEST 2021 Mon Jan 27 13:48:08 CET 2020	Wed Jun 01 01:59:59 CEST 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:54.871398926 CEST	104.16.148.64	443	192.168.2.3	49775	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:55.191051006 CEST	104.20.184.68	443	192.168.2.3	49776	CN=onetrust.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri Feb 12 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Sat Feb 12 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:55.191051006 CEST	104.20.184.68	443	192.168.2.3	49776	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:55.192495108 CEST	104.20.184.68	443	192.168.2.3	49777	CN=onetrust.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri Feb 12 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Sat Feb 12 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:55.192495108 CEST	104.20.184.68	443	192.168.2.3	49777	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 11, 2021 10:40:55.334273100 CEST	63.33.31.50	443	192.168.2.3	49778	CN=*.demdex.net, OU=Digital Marketing, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Dec 02 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020 Fri Nov 10 01:00:00 CET 2006	Mon Jan 03 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Jun 11, 2021 10:40:55.334438086 CEST	63.33.31.50	443	192.168.2.3	49779	CN=*.demdex.net, OU=Digital Marketing, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Dec 02 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020 Fri Nov 10 01:00:00 CET 2006	Mon Jan 03 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Jun 11, 2021 10:40:55.752432108 CEST	15.236.176.210	443	192.168.2.3	49780	CN=sstats.adobe.com, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon May 18 02:00:00 CEST 2020 Tue Oct 22 14:00:00 CEST 2013	Wed Aug 25 14:00:00 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	3faf2df7ab96c36419c31725cb1fa7d6
Jun 11, 2021 10:40:55.752432108 CEST	15.236.176.210	443	192.168.2.3	49780	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		3faf2df7ab96c36419c31725cb1fa7d6
Jun 11, 2021 10:40:55.753108025 CEST	15.236.176.210	443	192.168.2.3	49781	CN=sstats.adobe.com, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon May 18 02:00:00 CEST 2020 Tue Oct 22 14:00:00 CEST 2013	Wed Aug 25 14:00:00 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	3faf2df7ab96c36419c31725cb1fa7d6
Jun 11, 2021 10:40:55.753108025 CEST	15.236.176.210	443	192.168.2.3	49781	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		3faf2df7ab96c36419c31725cb1fa7d6
Jun 11, 2021 10:40:56.271931887 CEST	13.225.74.37	443	192.168.2.3	49782	CN=api.demandbase.com, O="Demandbase, Inc.", L=San Francisco, ST=California, C=US, SERIALNUMBER=C3920817, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Fri Oct 09 23:16:41 CEST 2020 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Thu Oct 28 02:17:28 CEST 2021 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034
Jun 11, 2021 10:40:56.272965908 CEST	13.225.74.37	443	192.168.2.3	49783	CN=api.demandbase.com, O="Demandbase, Inc.", L=San Francisco, ST=California, C=US, SERIALNUMBER=C3920817, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Fri Oct 09 23:16:41 CEST 2020 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Thu Oct 28 02:17:28 CEST 2021 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: AcroRd32.exe PID: 5092 Parent PID: 5708

General

Start time:	10:39:06
Start date:	11/06/2021
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\Tribeca Investment Partners - Funds.pdf'
Imagebase:	0x2c0000
File size:	2571312 bytes
MD5 hash:	B969CF0C7B2C443A99034881E8C8740A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: AcroRd32.exe PID: 5960 Parent PID: 5092

General

Start time:	10:39:07
Start date:	11/06/2021
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\Tribeca Investment Partners - Funds.pdf'
Imagebase:	0x2c0000
File size:	2571312 bytes
MD5 hash:	B969CF0C7B2C443A99034881E8C8740A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: RdrCEF.exe PID: 3340 Parent PID: 5092

General

Start time:	10:39:14
Start date:	11/06/2021
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043
Imagebase:	0xba0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: RdrCEF.exe PID: 4952 Parent PID: 3340

General

Start time:	10:39:16
Start date:	11/06/2021
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=18176514141952179124 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=18176514141952179124 --renderer-client-id=2 --mojo-platform-channel-handle=1664 --allow-no-sandbox-job /prefetch:1
Imagebase:	0xba0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: RdrCEF.exe PID: 4944 Parent PID: 3340

General

Start time:	10:39:18
Start date:	11/06/2021
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=14323790637429607960 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2
Imagebase:	0xba0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: RdrCEF.exe PID: 3260 Parent PID: 3340

General

Start time:	10:39:20
Start date:	11/06/2021
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=15500690304138507742 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=15500690304138507742 --renderer-client-id=4 --mojo-platform-channel-handle=1868 --allow-no-sandbox-job /prefetch:1
Imagebase:	0xba0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: RdrCEF.exe PID: 6328 Parent PID: 3340

General

Start time:	10:39:24
Start date:	11/06/2021
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4408287619177528861 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4408287619177528861 --renderer-client-id=5 --mojo-platform-channel-handle=1872 --allow-no-sandbox-job /prefetch:1
Imagebase:	0xba0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: RdrCEF.exe PID: 6492 Parent PID: 3340

General

Start time:	10:39:25
Start date:	11/06/2021
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4271642722203936314 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4271642722203936314 --renderer-client-id=6 --mojo-platform-channel-handle=2204 --allow-no-sandbox-job /prefetch:1
Imagebase:	0xba0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: iexplore.exe PID: 1968 Parent PID: 5092

General

Start time:	10:40:13
Start date:	11/06/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' https://spark.adobe.com/page/GG8mUEsjQvSUh/
Imagebase:	0x7ff698cb0000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: iexplore.exe PID: 5624 Parent PID: 1968

General

Start time:	10:40:14
Start date:	11/06/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1968 CREDAT:17410 /prefetch:2
Imagebase:	0x9c0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\Tribeca Investment Partners - Funds.pdf'
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\Tribeca Investment Partners - Funds.pdf'
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=18176514141952179124 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=18176514141952179124 --renderer-client-id=2 --mojo-platform-channel-handle=1664 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=14323790637429607960 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=15500690304138507742 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=15500690304138507742 --renderer-client-id=4 --mojo-platform-channel-handle=1868 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4408287619177528861 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4408287619177528861 --renderer-client-id=5 --mojo-platform-channel-handle=1872 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4271642722203936314 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4271642722203936314 --renderer-client-id=6 --mojo-platform-channel-handle=2204 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' https://spark.adobe.com/page/GG8mUEsjQvSUh/
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1968 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\Tribeca Investment Partners - Funds.pdf'
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' https://spark.adobe.com/page/GG8mUEsjQvSUh/
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=18176514141952179124 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=18176514141952179124 --renderer-client-id=2 --mojo-platform-channel-handle=1664 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=14323790637429607960 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=15500690304138507742 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=15500690304138507742 --renderer-client-id=4 --mojo-platform-channel-handle=1868 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4408287619177528861 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4408287619177528861 --renderer-client-id=5 --mojo-platform-channel-handle=1872 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1696,14583101347345561594,418495030725437647,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4271642722203936314 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4271642722203936314 --renderer-client-id=6 --mojo-platform-channel-handle=2204 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1968 CREDAT:17410 /prefetch:2

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to elicit sensitive information and/or gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
Tactics:	Initial Access
Data Sources:	DNS records, Detonation chamber, Email gateway, Mail server, Packet capture, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Tribeca Investment Partners - Funds.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Dropped Files

Sigma Overview

Signature Overview

AV Detection:

Phishing:

Compliance:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PDF Info

General

Keywords Statistics

Image Streams

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: AcroRd32.exe PID: 5092 Parent PID: 5708

General

Analysis Process: AcroRd32.exe PID: 5960 Parent PID: 5092

General

Analysis Process: RdrCEF.exe PID: 3340 Parent PID: 5092

General

Analysis Process: RdrCEF.exe PID: 4952 Parent PID: 3340

General