Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Multi Graphics Inc CustomerVendor Form.pdf

Overview

General Information

Sample name:Multi Graphics Inc CustomerVendor Form.pdf
Analysis ID:1551325
MD5:7e0f535d80672f82314c73a1f931bf3c
SHA1:882a90fb46ea48b1cd5942aa8a72d84aacbcbb62
SHA256:915115b956b16cc8296eafc09e366c01e4fb7a7a00f5d2bb2918fcb4dc6e4fc8

Detection

HTMLPhisher
Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected phishing page
Yara detected HtmlPhish54
AI detected suspicious URL
Phishing site detected (based on favicon image match)
Phishing site detected (based on image similarity)
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML title does not match URL
Stores files to the Windows start menu directory

Classification

  • System is w10x64_ra
  • Acrobat.exe (PID: 7084 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Multi Graphics Inc CustomerVendor Form.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 4532 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
    • AcroCEF.exe (PID: 6392 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 4292 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1568,i,5999060609213128173,10641889952013807193,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
    • chrome.exe (PID: 7824 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://multigraphicsincopd1823.referralrock.com/l/MULTIGRAPH00/?_ga=2.138874480.2120574177.1730981329-581645623.1730981328 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
      • chrome.exe (PID: 2592 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1940,i,12023994173878091299,17431364142464804603,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • cleanup
SourceRuleDescriptionAuthorStrings
0.30.id.script.csvJoeSecurity_HtmlPhish_54Yara detected HtmlPhish_54Joe Security
    5.7.pages.csvJoeSecurity_HtmlPhish_54Yara detected HtmlPhish_54Joe Security
      No Sigma rule has matched
      No Suricata rule has matched

      Click to jump to signature section

      Show All Signature Results

      Phishing

      barindex
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueLLM: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'login.microsoftnote.click' does not match the legitimate domain 'microsoft.com'., The domain 'microsoftnote.click' includes an extra word 'note', which is suspicious and indicative of phishing., The use of the '.click' domain extension is unusual for a well-known brand like Microsoft, which typically uses '.com'., The presence of input fields for 'Email, phone, or Skype' is typical for Microsoft login pages, but the URL mismatch raises concerns. DOM: 6.11.pages.csv
      Source: Yara matchFile source: 0.30.id.script.csv, type: HTML
      Source: Yara matchFile source: 5.7.pages.csv, type: HTML
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueMatcher: Template: microsoft matched with high similarity
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueMatcher: Found strong image similarity, brand: MICROSOFT
      Source: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231&__cf_chl_tk=YRpgFegd9bX4293iEgF6A6Do8vJKrZ8YQo10BGbcA9U-1730993000-1.0.1.1-7aVgX7iwizPpdjsqKlirQufm1C_MRCMqNGc7WHF1jH0HTTP Parser: Number of links: 0
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0HTTP Parser: Number of links: 0
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueHTTP Parser: Number of links: 0
      Source: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....
      Source: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231&__cf_chl_tk=YRpgFegd9bX4293iEgF6A6Do8vJKrZ8YQo10BGbcA9U-1730993000-1.0.1.1-7aVgX7iwizPpdjsqKlirQufm1C_MRCMqNGc7WHF1jH0HTTP Parser: Title: Just a moment... does not match URL
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0HTTP Parser: Title: Redirecting does not match URL
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueHTTP Parser: Title: Sign in to your account does not match URL
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueHTTP Parser: Iframe src: https://live.microsoftnote.click/Me.htm?v=3
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueHTTP Parser: <input type="password" .../> found
      Source: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231HTTP Parser: No favicon
      Source: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231HTTP Parser: No favicon
      Source: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231HTTP Parser: No favicon
      Source: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231&__cf_chl_tk=YRpgFegd9bX4293iEgF6A6Do8vJKrZ8YQo10BGbcA9U-1730993000-1.0.1.1-7aVgX7iwizPpdjsqKlirQufm1C_MRCMqNGc7WHF1jH0HTTP Parser: No favicon
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0HTTP Parser: No favicon
      Source: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231&__cf_chl_tk=YRpgFegd9bX4293iEgF6A6Do8vJKrZ8YQo10BGbcA9U-1730993000-1.0.1.1-7aVgX7iwizPpdjsqKlirQufm1C_MRCMqNGc7WHF1jH0HTTP Parser: No <meta name="author".. found
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0HTTP Parser: No <meta name="author".. found
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueHTTP Parser: No <meta name="author".. found
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueHTTP Parser: No <meta name="author".. found
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueHTTP Parser: No <meta name="author".. found
      Source: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231&__cf_chl_tk=YRpgFegd9bX4293iEgF6A6Do8vJKrZ8YQo10BGbcA9U-1730993000-1.0.1.1-7aVgX7iwizPpdjsqKlirQufm1C_MRCMqNGc7WHF1jH0HTTP Parser: No <meta name="copyright".. found
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0HTTP Parser: No <meta name="copyright".. found
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueHTTP Parser: No <meta name="copyright".. found
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueHTTP Parser: No <meta name="copyright".. found
      Source: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638665898206136811.N2I2N2NiMjktZmQzNi00MDk1LTk5YzgtMzUzNDViZDEzYmQxZTNhODYxNjQtNDk4Ni00ZDFhLTlkNTktMTEwM2ZlMDk2NTUy&ui_locales=en-US&mkt=en-US&client-request-id=714e0157-adf3-43dd-9410-7dabfe27dd12&state=cMT6yvvPYZWP8lHm0oYjEmX6c9F2J7-zha2u7SeAqQkaXPHtcWuScg2Vc9bYz-_V610AogZZzGM0g1Yvgv9Wi0JceDPUROFHMK95vf1hhbxZgQW_v1DnylljJSH0bkUCQgggAkcxIqYsUSlsta0IUgL5TlX2mMUPeB_Myo0UF6IlLPxGTfzwuUgELIfYVr6-MTXRVDv3-VxWUnoAYj6_OkANj2WX6UxcoSAtDtI1drETc8s26LjJkmBNkwrB4FeEn-fVTQdmyy5a3gF7nmz33w&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueHTTP Parser: No <meta name="copyright".. found
      Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.18:49794 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 20.190.159.64:443 -> 192.168.2.18:49886 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 2.23.209.141:443 -> 192.168.2.18:49890 version: TLS 1.2
      Source: chrome.exeMemory has grown: Private usage: 1MB later: 31MB
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownTCP traffic detected without corresponding DNS query: 54.144.73.197
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: unknownTCP traffic detected without corresponding DNS query: 20.75.106.146
      Source: global trafficDNS traffic detected: DNS query: x1.i.lencr.org
      Source: global trafficDNS traffic detected: DNS query: www.google.com
      Source: global trafficDNS traffic detected: DNS query: login.microsoftnote.click
      Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
      Source: global trafficDNS traffic detected: DNS query: challenges.cloudflare.com
      Source: global trafficDNS traffic detected: DNS query: www.microsoftnote.click
      Source: global trafficDNS traffic detected: DNS query: aadcdn.msftauth.net
      Source: global trafficDNS traffic detected: DNS query: aadcdn.microsoftnote.click
      Source: global trafficDNS traffic detected: DNS query: live.microsoftnote.click
      Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
      Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49864
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49863
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
      Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49898 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49875 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
      Source: unknownNetwork traffic detected: HTTP traffic on port 49881 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
      Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
      Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
      Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
      Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49692 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49893 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
      Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
      Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
      Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
      Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
      Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
      Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
      Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49892 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
      Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
      Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
      Source: unknownNetwork traffic detected: HTTP traffic on port 49887 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
      Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49864 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49870 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
      Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
      Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
      Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
      Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
      Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
      Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49868 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
      Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49885 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49898
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49897
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49896
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49895
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
      Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49894
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49893
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49892
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49890
      Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49897 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49879 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49889
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49888
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49887
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49885
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
      Source: unknownNetwork traffic detected: HTTP traffic on port 49863 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49884
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49882
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49881
      Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49880
      Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49857 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49896 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49879
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49878
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49877
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49876
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49875
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49874
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49873
      Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49872
      Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49871
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
      Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49874 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49880 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
      Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
      Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49868
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
      Source: unknownNetwork traffic detected: HTTP traffic on port 49890 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49878 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49889 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49866 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49692
      Source: unknownNetwork traffic detected: HTTP traffic on port 49872 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49855 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49873 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
      Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
      Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
      Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49856 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49895 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49884 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49867 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
      Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
      Source: unknownNetwork traffic detected: HTTP traffic on port 49865 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
      Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49871 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49894 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
      Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
      Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49876 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
      Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49882 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
      Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
      Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
      Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49877 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49888 -> 443
      Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.18:49794 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 20.190.159.64:443 -> 192.168.2.18:49886 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 2.23.209.141:443 -> 192.168.2.18:49890 version: TLS 1.2
      Source: classification engineClassification label: mal68.phis.winPDF@47/43@28/213
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4060
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\A914u9oln_1ljqn8l_34s.tmp
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
      Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Multi Graphics Inc CustomerVendor Form.pdf"
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1568,i,5999060609213128173,10641889952013807193,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
      Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 61BC6C03A31EB79B06ABA6C04E7BB66E
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1568,i,5999060609213128173,10641889952013807193,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://multigraphicsincopd1823.referralrock.com/l/MULTIGRAPH00/?_ga=2.138874480.2120574177.1730981329-581645623.1730981328
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1940,i,12023994173878091299,17431364142464804603,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://multigraphicsincopd1823.referralrock.com/l/MULTIGRAPH00/?_ga=2.138874480.2120574177.1730981329-581645623.1730981328
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1940,i,12023994173878091299,17431364142464804603,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: Multi Graphics Inc CustomerVendor Form.pdfInitial sample: PDF keyword /JS count = 0
      Source: Multi Graphics Inc CustomerVendor Form.pdfInitial sample: PDF keyword /JavaScript count = 0
      Source: Multi Graphics Inc CustomerVendor Form.pdfInitial sample: PDF keyword stream count = 25
      Source: Multi Graphics Inc CustomerVendor Form.pdfInitial sample: PDF keyword /EmbeddedFile count = 0

      Persistence and Installation Behavior

      barindex
      Source: EmailJoeBoxAI: AI detected Brand spoofing attempt in URL: URL: https://login.microsoftnote.click
      Source: EmailJoeBoxAI: AI detected Typosquatting in URL: URL: https://login.microsoftnote.click
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information queried: ProcessInformation
      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire Infrastructure1
      Drive-by Compromise
      Windows Management Instrumentation1
      Browser Extensions
      1
      Process Injection
      1
      Masquerading
      OS Credential Dumping1
      Process Discovery
      Remote ServicesData from Local System2
      Encrypted Channel
      Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault AccountsScheduled Task/Job1
      Registry Run Keys / Startup Folder
      1
      Registry Run Keys / Startup Folder
      1
      Process Injection
      LSASS Memory1
      System Information Discovery
      Remote Desktop ProtocolData from Removable Media1
      Non-Application Layer Protocol
      Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
      Extra Window Memory Injection
      1
      Extra Window Memory Injection
      Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
      Application Layer Protocol
      Automated ExfiltrationData Encrypted for Impact

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand
      No Antivirus matches
      No Antivirus matches
      No Antivirus matches
      No Antivirus matches
      No Antivirus matches
      NameIPActiveMaliciousAntivirus DetectionReputation
      a.nel.cloudflare.com
      35.190.80.1
      truefalse
        high
        challenges.cloudflare.com
        104.18.95.41
        truefalse
          high
          sni1gl.wpc.omegacdn.net
          152.199.21.175
          truefalse
            high
            s-part-0017.t-0009.fb-t-msedge.net
            13.107.253.45
            truefalse
              high
              www.google.com
              142.250.186.164
              truefalse
                high
                www.microsoftnote.click
                188.114.96.3
                truefalse
                  unknown
                  live.microsoftnote.click
                  188.114.96.3
                  truefalse
                    unknown
                    login.microsoftnote.click
                    188.114.97.3
                    truetrue
                      unknown
                      x1.i.lencr.org
                      unknown
                      unknownfalse
                        high
                        aadcdn.msftauth.net
                        unknown
                        unknownfalse
                          high
                          aadcdn.microsoftnote.click
                          unknown
                          unknownfalse
                            unknown
                            NameMaliciousAntivirus DetectionReputation
                            https://multigraphicsincopd1823.referralrock.com/l/MULTIGRAPH00/?_ga=2.138874480.2120574177.1730981329-581645623.1730981328false
                              unknown
                              https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231&__cf_chl_tk=YRpgFegd9bX4293iEgF6A6Do8vJKrZ8YQo10BGbcA9U-1730993000-1.0.1.1-7aVgX7iwizPpdjsqKlirQufm1C_MRCMqNGc7WHF1jH0false
                                unknown
                                https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231false
                                  unknown
                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs
                                  IPDomainCountryFlagASNASN NameMalicious
                                  142.250.74.200
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  216.58.212.142
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  184.28.88.176
                                  unknownUnited States
                                  16625AKAMAI-ASUSfalse
                                  104.18.94.41
                                  unknownUnited States
                                  13335CLOUDFLARENETUSfalse
                                  64.233.166.84
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  162.159.61.3
                                  unknownUnited States
                                  13335CLOUDFLARENETUSfalse
                                  54.144.73.197
                                  unknownUnited States
                                  14618AMAZON-AESUSfalse
                                  142.250.186.131
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  142.250.186.110
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  35.190.80.1
                                  a.nel.cloudflare.comUnited States
                                  15169GOOGLEUSfalse
                                  172.217.18.10
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  172.217.18.110
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  199.232.210.172
                                  unknownUnited States
                                  54113FASTLYUSfalse
                                  1.1.1.1
                                  unknownAustralia
                                  13335CLOUDFLARENETUSfalse
                                  142.250.185.110
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  104.18.95.41
                                  challenges.cloudflare.comUnited States
                                  13335CLOUDFLARENETUSfalse
                                  142.250.185.136
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  2.23.197.184
                                  unknownEuropean Union
                                  1273CWVodafoneGroupPLCEUfalse
                                  20.75.106.146
                                  unknownUnited States
                                  8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  239.255.255.250
                                  unknownReserved
                                  unknownunknownfalse
                                  188.114.97.3
                                  login.microsoftnote.clickEuropean Union
                                  13335CLOUDFLARENETUStrue
                                  142.250.185.131
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  142.250.185.195
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  188.114.96.3
                                  www.microsoftnote.clickEuropean Union
                                  13335CLOUDFLARENETUSfalse
                                  142.250.186.164
                                  www.google.comUnited States
                                  15169GOOGLEUSfalse
                                  152.199.21.175
                                  sni1gl.wpc.omegacdn.netUnited States
                                  15133EDGECASTUSfalse
                                  142.250.184.234
                                  unknownUnited States
                                  15169GOOGLEUSfalse
                                  IP
                                  192.168.2.18
                                  Joe Sandbox version:41.0.0 Charoite
                                  Analysis ID:1551325
                                  Start date and time:2024-11-07 16:22:04 +01:00
                                  Joe Sandbox product:CloudBasic
                                  Overall analysis duration:
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                  Number of analysed new started processes analysed:23
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • EGA enabled
                                  Analysis Mode:stream
                                  Analysis stop reason:Timeout
                                  Sample name:Multi Graphics Inc CustomerVendor Form.pdf
                                  Detection:MAL
                                  Classification:mal68.phis.winPDF@47/43@28/213
                                  Cookbook Comments:
                                  • Found application associated with file extension: .pdf
                                  • Exclude process from analysis (whitelisted): dllhost.exe
                                  • Excluded IPs from analysis (whitelisted): 2.16.164.131, 2.16.164.96, 2.16.164.97, 2.16.164.90, 2.16.164.115, 2.16.164.91, 2.16.164.98, 2.16.164.114, 2.16.164.113
                                  • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, a122.dscd.akamai.net, ctldl.windowsupdate.com, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com
                                  • Not all processes where analyzed, report is missing behavior information
                                  • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                  • VT rate limit hit for: Multi Graphics Inc CustomerVendor Form.pdf
                                  InputOutput
                                  URL: PDF document Model: claude-3-haiku-20240307
                                  ```json
                                  {
                                    "contains_trigger_text": true,
                                    "trigger_text": "Customer/Vendor Form",
                                    "prominent_button_name": "Progress",
                                    "text_input_field_labels": [
                                      "First Name",
                                      "Last Name",
                                      "Company Name",
                                      "Phone Number",
                                      "Email",
                                      "Street Address",
                                      "Street Address Line 2",
                                      "City",
                                      "State",
                                      "Zip Code",
                                      "Date"
                                    ],
                                    "pdf_icon_visible": false,
                                    "has_visible_captcha": false,
                                    "has_urgent_text": false,
                                    "has_visible_qrcode": false
                                  }
                                  URL: PDF document Model: claude-3-haiku-20240307
                                  ```json
                                  {
                                    "brands": [
                                      "Multi Graphics Inc"
                                    ]
                                  }
                                  URL: Model: claude-3-5-sonnet-latest
                                  {
                                      "typosquatting": false,
                                      "unusual_query_string": false,
                                      "suspicious_tld": false,
                                      "ip_in_url": false,
                                      "long_subdomain": true,
                                      "malicious_keywords": false,
                                      "encoded_characters": false,
                                      "redirection": false,
                                      "contains_email_address": false,
                                      "known_domain": false,
                                      "brand_spoofing_attempt": false,
                                      "third_party_hosting": true
                                  }
                                  URL: URL: https://multigraphicsincopd1823.referralrock.com
                                  URL: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231 Model: claude-3-haiku-20240307
                                  ```json
                                  {
                                    "contains_trigger_text": true,
                                    "trigger_text": "Verifying you are human. This may take a few seconds.",
                                    "prominent_button_name": "unknown",
                                    "text_input_field_labels": "unknown",
                                    "pdf_icon_visible": false,
                                    "has_visible_captcha": true,
                                    "has_urgent_text": false,
                                    "has_visible_qrcode": false
                                  }
                                  URL: Model: claude-3-5-sonnet-latest
                                  {
                                      "typosquatting": true,
                                      "unusual_query_string": false,
                                      "suspicious_tld": true,
                                      "ip_in_url": false,
                                      "long_subdomain": false,
                                      "malicious_keywords": true,
                                      "encoded_characters": false,
                                      "redirection": false,
                                      "contains_email_address": false,
                                      "known_domain": true,
                                      "brand_spoofing_attempt": true,
                                      "third_party_hosting": true
                                  }
                                  URL: URL: https://login.microsoftnote.click
                                  URL: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231 Model: claude-3-haiku-20240307
                                  ```json
                                  {
                                    "contains_trigger_text": true,
                                    "trigger_text": "Verifying you are human. This may take a few seconds.",
                                    "prominent_button_name": "unknown",
                                    "text_input_field_labels": "unknown",
                                    "pdf_icon_visible": false,
                                    "has_visible_captcha": true,
                                    "has_urgent_text": false,
                                    "has_visible_qrcode": false
                                  }
                                  URL: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231 Model: claude-3-haiku-20240307
                                  ```json
                                  {
                                    "brands": [
                                      "Microsoft",
                                      "Cloudflare"
                                    ]
                                  }
                                  URL: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231 Model: claude-3-haiku-20240307
                                  ```json
                                  {
                                    "contains_trigger_text": true,
                                    "trigger_text": "Verify you are human by completing the action below.",
                                    "prominent_button_name": "Verify you are human",
                                    "text_input_field_labels": "unknown",
                                    "pdf_icon_visible": false,
                                    "has_visible_captcha": true,
                                    "has_urgent_text": false,
                                    "has_visible_qrcode": false
                                  }
                                  URL: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231 Model: claude-3-haiku-20240307
                                  ```json
                                  {
                                    "brands": [
                                      "Cloudflare"
                                    ]
                                  }
                                  URL: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231 Model: claude-3-haiku-20240307
                                  ```json
                                  {
                                    "brands": [
                                      "Cloudflare"
                                    ]
                                  }
                                  URL: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231&__cf_chl_tk=YRpgFegd9bX4293iEgF Model: claude-3-haiku-20240307
                                  ```json
                                  {
                                    "contains_trigger_text": true,
                                    "trigger_text": "Verification successful",
                                    "prominent_button_name": "unknown",
                                    "text_input_field_labels": "unknown",
                                    "pdf_icon_visible": false,
                                    "has_visible_captcha": false,
                                    "has_urgent_text": false,
                                    "has_visible_qrcode": false
                                  }
                                  URL: https://login.microsoftnote.click/PEtydrdw?RR_WCID=B59C4D13-FE3E-4AE9-B640-DF5767769971&RR_WCID_TTL=396&REFERRALCODE=MULTIGRAPH00&_ga=2.138874480.2120574177.1730981329-581645623.1730981328&utm_campaign=Referral+Program+%231&__cf_chl_tk=YRpgFegd9bX4293iEgF Model: claude-3-haiku-20240307
                                  ```json
                                  {
                                    "brands": [
                                      "Microsoft",
                                      "Cloudflare"
                                    ]
                                  }
                                  URL: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2F Model: claude-3-haiku-20240307
                                  ```json
                                  {
                                    "contains_trigger_text": true,
                                    "trigger_text": "Trying to sign you in",
                                    "prominent_button_name": "Cancel",
                                    "text_input_field_labels": "unknown",
                                    "pdf_icon_visible": false,
                                    "has_visible_captcha": false,
                                    "has_urgent_text": false,
                                    "has_visible_qrcode": false
                                  }
                                  URL: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2F Model: claude-3-haiku-20240307
                                  ```json
                                  {
                                    "brands": [
                                      "Microsoft"
                                    ]
                                  }
                                  URL: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2F Model: claude-3-haiku-20240307
                                  ```json
                                  {
                                    "contains_trigger_text": true,
                                    "trigger_text": "Sign in",
                                    "prominent_button_name": "Next",
                                    "text_input_field_labels": [
                                      "Email, phone, or Skype"
                                    ],
                                    "pdf_icon_visible": false,
                                    "has_visible_captcha": false,
                                    "has_urgent_text": false,
                                    "has_visible_qrcode": false
                                  }
                                  URL: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2F Model: claude-3-haiku-20240307
                                  ```json
                                  {
                                    "brands": [
                                      "Microsoft"
                                    ]
                                  }
                                  URL: https://login.microsoftnote.click/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2F Model: gpt-4o
                                  ```json{  "legit_domain": "microsoft.com",  "classification": "wellknown",  "reasons": [    "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.",    "The URL 'login.microsoftnote.click' does not match the legitimate domain 'microsoft.com'.",    "The domain 'microsoftnote.click' includes an extra word 'note', which is suspicious and indicative of phishing.",    "The use of the '.click' domain extension is unusual for a well-known brand like Microsoft, which typically uses '.com'.",    "The presence of input fields for 'Email, phone, or Skype' is typical for Microsoft login pages, but the URL mismatch raises concerns."  ],  "riskscore": 9}
                                  Google indexed: False
                                  URL: login.microsoftnote.click
                                              Brands: Microsoft
                                              Input Fields: Email, phone, or Skype
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):476
                                  Entropy (8bit):4.963041986058256
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:13457FDBB80F2D8107FE33DFFA731B06
                                  SHA1:1DE7DEDA5DA8B7F70DDEA85FE622B142568FFD0E
                                  SHA-256:3BC2C278532B408B2A66CB542BA3898F24E9FEA50443AE3DEA4304907372D4F3
                                  SHA-512:8BB2A9639C2461F42A251CB17E5E4E42D500BA05DA04DE5B4030DB45B64340FE744B55AE5EBEB8114CFD89DB45F3EC30D4DF290404A304FFDDE71C489A2A6A3B
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13375552978513826","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":254333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.18","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):0
                                  Entropy (8bit):0.0
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:13457FDBB80F2D8107FE33DFFA731B06
                                  SHA1:1DE7DEDA5DA8B7F70DDEA85FE622B142568FFD0E
                                  SHA-256:3BC2C278532B408B2A66CB542BA3898F24E9FEA50443AE3DEA4304907372D4F3
                                  SHA-512:8BB2A9639C2461F42A251CB17E5E4E42D500BA05DA04DE5B4030DB45B64340FE744B55AE5EBEB8114CFD89DB45F3EC30D4DF290404A304FFDDE71C489A2A6A3B
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13375552978513826","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":254333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.18","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
                                  Category:dropped
                                  Size (bytes):65110
                                  Entropy (8bit):0.5505636500096269
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:EC16F7CE2768ED6508E4D02D98EBB148
                                  SHA1:E438BDBAD8788FAB9BB493FDC3591F523A0F211D
                                  SHA-256:726BAC8FFCAAFD2C2E91B96CADED7C3433C9DA778F322011F6F46035CC759CBA
                                  SHA-512:4F79636B2A6281B8CFFDECCAC268309C6BEA92A788C8B113E15EDE2899885A1B2209D8FB2834BDAC565ED9664BA700506B8E11D31C7EF2E885BED82C2302D6A2
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
                                  Category:dropped
                                  Size (bytes):86016
                                  Entropy (8bit):4.444826087251212
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:785C2799B7CB7F19E42373E6F8C61C42
                                  SHA1:FA389013D467FA96FCD1328F13E3762811BF76AE
                                  SHA-256:D2A529565E2F4F2919A2D30D54899C75A65458355E9D5317BC343880B5514A8F
                                  SHA-512:E8DF6B64B4DC27F16116A2B99E015CBB57CB7DE6002F039FE8E61B16852CC859E21C6842E318DB0D7AE6A58CE73DA15D9F43092AC9C3B02A9E38A3BEF753D3EC
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:SQLite Rollback Journal
                                  Category:dropped
                                  Size (bytes):8720
                                  Entropy (8bit):3.7741551932839696
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:220B220DCC4F6F07E5E204F57B5697EE
                                  SHA1:3486EEA45F933BAA889A859C6FF42BD643360659
                                  SHA-256:30A2F86A02EDCC814F2AE035F667599736AEF4B3164B141F4569B1589C7A3AC9
                                  SHA-512:5EE431CAF74452C6388AD27959FD41744E15BA6F5A385ECDAC58B0344807EA5D56523D8267C0FC3FED5C68CD634F0C089C9EF8997FC9548A5F7B3B7BB9B5E76C
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:.... .c.....h..Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                  File Type:Certificate, Version=3
                                  Category:dropped
                                  Size (bytes):1391
                                  Entropy (8bit):7.705940075877404
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                                  SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                                  SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                                  SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                  File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                                  Category:dropped
                                  Size (bytes):71954
                                  Entropy (8bit):7.996617769952133
                                  Encrypted:true
                                  SSDEEP:
                                  MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                                  SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                                  SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                                  SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):192
                                  Entropy (8bit):2.7464849065063075
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:94777BFCF92BCF57C515E79B8399A977
                                  SHA1:A67BED80EBB31548FEAFBE1D102D558DEFF95CEB
                                  SHA-256:EDF603BD39454353FC3CA53BF0456E7800BEE405BAAE57CAC861098FA33AE5F8
                                  SHA-512:70BB20AC296F6B50AA43AB8468A44B24424F152B664FAD04AE074E2747EEA75E2AA6762F920A032DFC08DEBCD5BC79BD9DC6662EDAE1ABD03960D42881BF272D
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:p...... ..........w.(1..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                  File Type:data
                                  Category:modified
                                  Size (bytes):328
                                  Entropy (8bit):3.2310997727285145
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:81FB9305BEECE1474E83783942D47723
                                  SHA1:53E498B234E480B2E694BB53B0EDBF19CA0BD4A2
                                  SHA-256:BFC061C036C063F0E42C1ACA16E05910856615CF9DBE9A64C9BCD368057357C8
                                  SHA-512:7337074765606BE10A898C82AD16B982B81513EDC80F6C6540D30AD55DC769886EA00B10B86DFB0D9E539326A3BDDE2EB698AE50DA106006AD1062288CE7884B
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:p...... ........ ...(1..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:PostScript document text
                                  Category:dropped
                                  Size (bytes):0
                                  Entropy (8bit):0.0
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:8BA9D8BEBA42C23A5DB405994B54903F
                                  SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                                  SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                                  SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:PostScript document text
                                  Category:dropped
                                  Size (bytes):1233
                                  Entropy (8bit):5.233980037532449
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:8BA9D8BEBA42C23A5DB405994B54903F
                                  SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                                  SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                                  SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:PostScript document text
                                  Category:dropped
                                  Size (bytes):0
                                  Entropy (8bit):0.0
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:8BA9D8BEBA42C23A5DB405994B54903F
                                  SHA1:FC1B1646EC8A7015F492AA17ADF9712B54858361
                                  SHA-256:862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
                                  SHA-512:26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:PostScript document text
                                  Category:dropped
                                  Size (bytes):0
                                  Entropy (8bit):0.0
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:B60EE534029885BD6DECA42D1263BDC0
                                  SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                                  SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                                  SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:PostScript document text
                                  Category:dropped
                                  Size (bytes):10880
                                  Entropy (8bit):5.214360287289079
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:B60EE534029885BD6DECA42D1263BDC0
                                  SHA1:4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
                                  SHA-256:B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
                                  SHA-512:52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):295
                                  Entropy (8bit):5.375151029215099
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:5AF27B80196F7BD51B754C7A9A3593CC
                                  SHA1:58BF40F5EFCE1B60ADCD662412C8610297A6F334
                                  SHA-256:52E449D07E486EFBF2E62EFA1C65B888EC29D1836BDD3F0D1E04283359ACA1A2
                                  SHA-512:A8177B4E4464B8BD57D50B4F9555F44271F3DE62A74D3D5FDB63F7284D860A58256C138B977C11B9B0D14F3FDC905636AA7A01A9886A5FA4D5C964F70C46E604
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):294
                                  Entropy (8bit):5.323013138891791
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:2EC01FBBE17DE850BCF3489ECE41A9DA
                                  SHA1:F98D2F035C01885F6CD0B3F1C1A3DAEBD1A67BBD
                                  SHA-256:3E2CE22075964A8F2CF15C93F25059E6276B18D56157FD4AC8B84B169C3B26EC
                                  SHA-512:786BE2988E5F74104DCD7BA4F305633A06D5B799959C9E6600A3CB82D0FE5DA47BBF327AB76881A19EF16CBD06E2C2CEE5EC2FAFCF529EC61D41CA1DB2DF43DB
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):294
                                  Entropy (8bit):5.301561455417796
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:A44097109BB3E4406E66220FAD477ACD
                                  SHA1:5973B54C6BA4BCBF8DAB0D12A1B407594D067A39
                                  SHA-256:5C3CC9CDDF37F87F596BD1A2D19AA77F26B3C0678AC917E6DD1F909B1016D909
                                  SHA-512:3D4E133D6B4983CED3894EF6A98E9733A97E1D942AC73F80DC6396A41E46F879EB6EB2E0AC3E5B6AD0FB0E6004F60C3DB5C02059307185718E921DD3105C944E
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):285
                                  Entropy (8bit):5.365954288638201
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:4DD831A203AFFD6CE70AFCA0D6E17254
                                  SHA1:42EC84D965F98AC669B05388F10BC7E50849908C
                                  SHA-256:60A9CD5CB6F93CCE2412238E8F3F5125718B90E3FDCB13D3C0BD0FB50856C31B
                                  SHA-512:F6092321D55D255EC1647DAB9513C722053691E08D38D38BBD6827B7553E58C74C7D038FFDC5988F11A2425F647EB4FA96C439BD3E39093F21903D101E4B77CA
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):1123
                                  Entropy (8bit):5.693306566688643
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:546B7B87158D13046D5AE81D51842F56
                                  SHA1:3F48249FE26DA5C5CEC5E46BA8044ACBE03B1E66
                                  SHA-256:202BDB91E11530468EDE52B3B3188C9B9EAFADF641D72CB505CAB02DBB06D7D6
                                  SHA-512:8FBFEEADB8BCBCE91CD6F181CFB7DD00708C72590BD7D31F3C4AEE1E76DFE7C285C49977B1FDBA72FA7A56CF7D549E25906842FA9877990EC97DB215A108ABDE
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):1122
                                  Entropy (8bit):5.687432521985599
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:9ED06F3BA004F0FD7A7B3F4CACAD8557
                                  SHA1:567832B4431688F4997E61D29686B97D5F4181DA
                                  SHA-256:C491182EFA2822BDE0860CECF1A54F02822ABDD3F70EFC7B0B233610C1D82DCB
                                  SHA-512:24FD33131F3AEFD4571FF24E79DA3BB3FC03EDFD8F16670E40883325BEF19E8FA74D6CA0137419BB2848D2577C85D3A308D5B2866CEA23C92C9AD34657D16881
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_0","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"1aad653c-ef44-43f7-be1c-3a2ba2cf2cfc","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuIFBERiBmb3JtcyAmIGFncmVlbWVudHMuIn0sInRjY
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):292
                                  Entropy (8bit):5.3132065061684965
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:DE3CE64A30387243C3F367EB26D91C9E
                                  SHA1:C1C80767E68133868F7E8893A7D51A3DDEF046C9
                                  SHA-256:F4D9A105B7C1512BCF751EED53D1955F870CDCDD00A6F62EFB9F20715EFB1D8B
                                  SHA-512:992AC250674B5C8A66F758310B3A996C5F8B8A2D2E6B9E5A5B3A8572B7D83DB096C647870BE6E842B4F1105C55E0A36EB909E08087EA9ACC33E5C9E2B2A58F13
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):1102
                                  Entropy (8bit):5.673402156259056
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:FF131B6F8823F0F7AA6B376EB5595FAA
                                  SHA1:3A8428BEC3688AB27881241906BD376ACEBBA2AF
                                  SHA-256:9A817E1A42C97D1E8BA2AC5D7FFB1983FC900EE79AD09D726DA85766FD489D2A
                                  SHA-512:EBDBBD93661592C5C804917D53770E964B0C2DA7CA8CC319D48100EA11261DDB7300D56FE0A226D23FC77113CB9281F28C39E529A5D3AD5959CF1E76C8817C71
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_1","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"533ab5eb-b236-4889-89a5-ac002261d71e","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkVkaXRQREZSZHJBcHBGdWxsIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTRweCIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTJweCIsImZvbnRfc3R5bGUiOiItMSJ9LCJ0aXRsZSI6bnVsbCwiZGVzY3JpcHRpb24iOiJFZGl0IHRleHQsIGltYWdlcywgcGFnZXMsIGFuZCBtb3JlLiJ9LCJ0Y2F0SWQiOm51bGx9","da
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):1164
                                  Entropy (8bit):5.7017276097023375
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:2F09289BDBD1FD702D7B4134E5B19955
                                  SHA1:880B5B2531EF8F7E2769E7C6C303FB03E17041B5
                                  SHA-256:324933AEC4A5346BC84D1C764C055403828F4FD9B286E28760AFF0571C94B399
                                  SHA-512:50FEB20EB9182A135A70D639CFCEE0D95DE39920F61ABADCE6D67A295ACF9882391E0A8D8B808CF3B7A015DAD15639D54C3242A30C67C105C8BFA29C847E232B
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):289
                                  Entropy (8bit):5.318448154234337
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:8DC9ABBF7AC5C0FD0276E24265D9E1A4
                                  SHA1:19F39ECBD0CD9471E73B39B456E8DAB75913CCC8
                                  SHA-256:9ECDFDA269AEE36E0A8582BD8D8999BA29D61D464DED0091DEF43FADAE2ED40E
                                  SHA-512:B127C4FB4EC58E610E919D21BFC6282F34F82FA42DC378DE47A16F8C94212418B6813063F8070DA9E6AB4ECDC0F54E0D0A806194ABEB4792340631532DB4B094
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):1395
                                  Entropy (8bit):5.777692079384509
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:919258A30020D6A553A9F7E997E1CC43
                                  SHA1:ECFF92996C2BFAC73D87EB4C7759FE226C53289F
                                  SHA-256:6A79E64F8608542EB90314EA7D4BA0410CD94AE8B91450C4D9EA70D0E7468EC4
                                  SHA-512:088EAE434B21E362C35F3E65A78649E924D71E25F1E5B2FCF9E6244F89EF89B731041067D788BDFC9C30B1B68F97ACAF956154F6746BE40EC0D5F7BACEF04D52
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):291
                                  Entropy (8bit):5.301868460470163
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:DF3FAF891DBE71EAB6822C548D867CC7
                                  SHA1:AD0C872968A8E102C4BD8772CE445D03B41E2FBD
                                  SHA-256:EF65EEDC3648C239D6F209B5182D1D7F4251CC6669A3E6397D2F607515A5BF8A
                                  SHA-512:05ADE26BA21C84DE543A0BF5DA663110579376A7ECEF5D5AFD8AF5F601D09921A8219999B85E9BDFEF183FA7492C021171565B7BF3554635A6671F52D48A3462
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):287
                                  Entropy (8bit):5.305190750176776
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:22692AAB7DB9DC7BF312E33E51AAB156
                                  SHA1:BFFEB20232DED3904E61D7BF2B7AACDE7B11F15F
                                  SHA-256:2B25F14869C8E04A9602BC9EDA49038653FE9B91173C751CADD42843DEC363E9
                                  SHA-512:E6DBA3264B2E3F6163141837F9278732E0E4C336E8400EBB09346570098B3F5CC31D992099A7A4EBEDD032B046D48EBC17833EBB5CE3071A125FFC2467DC1841
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):1090
                                  Entropy (8bit):5.671388526353916
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:0CE6492413924AF274F55049B069AE15
                                  SHA1:6A56640FDCF33F011D037E0ACAB3330E727BB763
                                  SHA-256:6F86E500D7793C60CF27A51D496BA43FC8718645C10897A95E062747CD0ECD35
                                  SHA-512:F5B2A659DDF9759BEFED9A82BD66EA9A1A870C31520783D41C9DFCC175721706FCE47FE1046175A50B55FEA8A968ADA4F6787D2107F5EDCDE80CB4030D4D2804
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):286
                                  Entropy (8bit):5.280362321734449
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:51A94E7BED4D45586AFEC931AD62783F
                                  SHA1:806BB664FD4137978091D4D56CF97C585863CAA1
                                  SHA-256:A73B4CF9FB7BE9CBA6E48D45AFDC0DD2403A8AC005569204D9E87C8130D96FE3
                                  SHA-512:B9BBD7E69EE7DBB9B30D34BA302B79BD06E29DD103666F91CD8158390E5C1C8047D343E258B5C1EC724690D2C5AD47D4DE299187754B1BF4FCFEC477B7689785
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):782
                                  Entropy (8bit):5.379876618210442
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:D23A2E8E645897006BE03DFE013651B5
                                  SHA1:55D37CB5939DE9D11CEA5AC6E16410DFEA4798A1
                                  SHA-256:FAA67535F0D5783FD454AF20683EE0B5AB2D7877112551CCD48046C4653E4668
                                  SHA-512:96ADA7600F15D96746239FF80568526DE80E888013813106587029DCBA24EE29369788B993C00EF5101C4BED217B1FE863FF8D0C13626AD8CB66C6262791C87A
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"analyticsData":{"responseGUID":"d4201ccb-e057-4fda-b499-14b2d658f08e","sophiaUUID":"6E6CF47D-878E-41D8-BE92-CB1D7BE5FFE6"},"encodingScheme":true,"expirationDTS":1731170911264,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1730992981294}}}}
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):4
                                  Entropy (8bit):0.8112781244591328
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                                  SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                                  SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                                  SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:....
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):2818
                                  Entropy (8bit):5.124626062269041
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:D3982BA3264672DA0EEF8587634E8A8F
                                  SHA1:436E1EF9413AAB4E7874E9A9A5341B1B7005EF3A
                                  SHA-256:431E78D11850C1EBDCDACB3EAD78547ABDA8BA0A6E3C12BC2A7A4495CF8A4035
                                  SHA-512:0239229325D7EC9AC6A913E1C886EF29F53C1B31E4D8C377A59436F977BF897ACBD7E9B28EA5AEAAA787E78BD89AFE466C5CA08F5930E8D61C041CFC4A6A75E1
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"6fa03be17c9b07292d72c527432e913a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1122,"ts":1730992980000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"6c6d0b2676c9e74d7c91546ecb16d474","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1730992980000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"171b149a91b128f372d2ee6b0abad6fa","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1730992980000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b26a94d44f764c5d1c40aa09647d82fd","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1730992980000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"e7cd439c66878a5d383573d2be6a6c5c","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1102,"ts":1730992980000},{"id":"Edit_InApp_Aug2020","info":{"dg":"49bfed486dd5580ae382ea0183be61d1","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28
                                  Category:dropped
                                  Size (bytes):12288
                                  Entropy (8bit):1.459449852565074
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:9030EB1189581341EF42BE893E4BDC3C
                                  SHA1:89B6A89841D71EC4817EB6EABF3849DCFE980097
                                  SHA-256:0592BF8724955A24919869831378A8B05E40CAD00B23BF3DCF50206701F18F54
                                  SHA-512:F223180271045A02D0BA0DF5E62B1BE7A966EE1FCEE86CD82DA746A9ADB549F53503EC314C95D23796A567D2824F790EAE495BB6C79338B44A39220BFCF1D7AE
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:SQLite Rollback Journal
                                  Category:dropped
                                  Size (bytes):8720
                                  Entropy (8bit):1.9622163154713461
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:8DECE88E1D8E52D0561622B29F31C7F2
                                  SHA1:473911E49A319971ADA85BEF9F4F8E273C21317D
                                  SHA-256:BE53D8767E82C940FD4BAC700E7179264A99D5A0CF75103AEA6612A645C01EFD
                                  SHA-512:059556805D3A781C01C4DD83EED25CBFE81FC245890A366ADA9062F963A9689D4D381055F9F3B9ACEF00722438135B74448F5D7661B4674E224150C4F0C79270
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:.... .c.......u...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):66726
                                  Entropy (8bit):5.392739213842091
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:C83787EDA0049E714B6368ED5D4A4B9B
                                  SHA1:F8AD8063B9998B22B951D50B67B8823BCC14BA80
                                  SHA-256:B62E44E2BAFB53C3B467D16D3766D1BBBE2A48349B2D39E49E595524BA79C246
                                  SHA-512:C53469F729B4E109AA500FC8C2F86F4BD7E9B54C3AE817F5F6F64A9B9F1171C29A12670A5E7547D3C34BEF94872CFAF6348CE005292C98425E92237922039E67
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):246
                                  Entropy (8bit):3.5097251598291805
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:ED6A235727B33A4A2714E226E080924F
                                  SHA1:E37ACA95DDF49B68B5B158AE22E5F94EE94E8F14
                                  SHA-256:7BED587F3F483C978EB123B1AA0265C5E1E45B37185362DACEE593E59E04004F
                                  SHA-512:618F6DBD7F90165872EDE54D785254A0367D4AAC088C2361441FC4BB6E1DF8C742A52022C52B8F2FCD93E447312BDBF786AE7F4996102F03792145FE64945AAB
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.7./.1.1./.2.0.2.4. . .1.0.:.2.2.:.5.6. .=.=.=.....
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:PDF document, version 1.6, 0 pages
                                  Category:dropped
                                  Size (bytes):358
                                  Entropy (8bit):5.063915677844034
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:E9E9A436F3668344900589518CF2CFAE
                                  SHA1:51AEF60E63C19F84C98AE2F38FC376041DCF8722
                                  SHA-256:73DEA4D2467216B502B3B1D4D5739B1803EA96C5CF7BC05946BBB7428D091A96
                                  SHA-512:A4F9B429FE9B734B30825A343C760098C5FB72DF190F8F5A83950AE1C9C49327FE71C7C014889D85ADF8B17C7AAB80A72BFBAF09912162C2B278847EF93E8689
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<8F984F03EE3FFA4B840EA8EB746B3DD7><8F984F03EE3FFA4B840EA8EB746B3DD7>]>>..startxref..127..%%EOF..
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:ASCII text, with very long lines (393)
                                  Category:dropped
                                  Size (bytes):16525
                                  Entropy (8bit):5.352085917943317
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:E89CDF7025B70E5A72FFC801BADFB345
                                  SHA1:2C55C26FD5231BEBD6531BDB7962D12BE288A1BB
                                  SHA-256:2A90DFB97133E5C0219784D1C4A94C0DC45AE4787C40CFE6894A59D94C4FB88C
                                  SHA-512:22621DFF9C688C4B0BB3237350959B4357C65D1796834FC23E6636B4975BE942A969F7DB05E8FC10102DEBF93ED662BE28FC649B2456EB4B659EC84BF8E93621
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:SessionID=47371133-08fd-4d2c-bf7b-052dd86a3818.1696588820356 Timestamp=2023-10-06T12:40:20:356+0200 ThreadID=1312 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=47371133-08fd-4d2c-bf7b-052dd86a3818.1696588820356 Timestamp=2023-10-06T12:40:20:356+0200 ThreadID=1312 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=47371133-08fd-4d2c-bf7b-052dd86a3818.1696588820356 Timestamp=2023-10-06T12:40:20:356+0200 ThreadID=1312 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=47371133-08fd-4d2c-bf7b-052dd86a3818.1696588820356 Timestamp=2023-10-06T12:40:20:356+0200 ThreadID=1312 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=47371133-08fd-4d2c-bf7b-052dd86a3818.1696588820356 Timestamp=2023-10-06T12:40:20:356+0200 ThreadID=1312 Component=ngl-lib_NglAppLib Description="SetConfig:
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                  File Type:ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):35721
                                  Entropy (8bit):5.405496991359609
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:E9B4DA5D967CE6D061C1D3EF18F37082
                                  SHA1:0A5D6015B96C03580A0898DC5736A2A4F70406F4
                                  SHA-256:07BFBF557E76434018D5A1D6CEEB07407126E6D52FEB3643523858DC00D01FDF
                                  SHA-512:9FE1F7A8FD31FD33462F632B7B9890F9ECFCDB6D953DB785F8FF505EA05291CF0D60A7DC47D14C7FF01C0E322E09C52A891AEB4B7033085FBEE51E9AC21063DD
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:06-10-2023 12:14:34:.---2---..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 12:14:34:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 12:14:34:.Closing File..06-10-
                                  Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                  File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 605160
                                  Category:dropped
                                  Size (bytes):91640
                                  Entropy (8bit):7.973988065379142
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:A3749EA15A9123F0E003AE3C3A039902
                                  SHA1:53C6A515C3B1C0239F0E0D194487060126B2DA2F
                                  SHA-256:4232811E3CFDA326A083150EE8150D374AF0A7310A4B7A7C428F7AA015410561
                                  SHA-512:D9A9C06E17258D662D6A5055BE28D8E621701378C6717759D8118F0EB1A3C5027F04E9AED83D3FFE2329C830E1E83603FD75E176765F4D06A17180DA6893F3E3
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 7 14:23:14 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2675
                                  Entropy (8bit):3.9810615822413618
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:D8082207EEB0C0265ED6B81539F512C2
                                  SHA1:D37A827453B0B7201C0850340469BA8DEFCE517B
                                  SHA-256:4A8FFE816DAC264E8DEA573704B7BEFDA01BF0E3BEF49164F33CBD4D7C878106
                                  SHA-512:A429FD02D398BF111BE4A19DB0B18E562D67C63C30873C951A9D0C0A707619F377FD9F6117B46535772F1D380EBAC0D31EC00D2601BE91E8AF99635C2EAB5171
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,....;~..(1......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.IgY.z....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VgY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.VgY.z....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.VgY.z...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VgY.z.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............".8.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 7 14:23:14 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2677
                                  Entropy (8bit):3.9974284778276785
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:EB11971D1B2AE613C8CA800812192A48
                                  SHA1:229D70685A661FAEA347847CDF3F30D9574B17FC
                                  SHA-256:401DF4A2E1B5BA480632AE8BFF2EAED46000032C368C6367B301E2613DA560B8
                                  SHA-512:DFB3099A5025A0321197ABFA0F5CA7EEA1B1135B9407E64D4DDE5CC07B83D5635B36020DAE3628F19D8286DAB54D02C167B74D60868B647AB4747D08D0B45245
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,.......(1......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.IgY.z....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VgY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.VgY.z....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.VgY.z...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VgY.z.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............".8.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2691
                                  Entropy (8bit):4.005574802013401
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:63F2B31907C96AD18B73013AB72E7CA4
                                  SHA1:FEA8EA183C3F24FD7D334C09BC2BE1F8473D337D
                                  SHA-256:56DD0497B41E14AF0DBD9F8290E036CD328A9EAD3935D6DE1FF7ADC676BD6FF1
                                  SHA-512:0CB08FBF91A01F84513008D7ECD8B4DFA5B96B33A3153BC688BFC5CDA9983119C1CF86CF45964492445E2051A8FAE3381BF1AD611C5903588EF44C1E6BF88E26
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,....?.4 ?.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.IgY.z....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VgY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.VgY.z....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.VgY.z...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.R.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............".8.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 7 14:23:14 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2679
                                  Entropy (8bit):3.9929215727395375
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:7869D58E2C53C609A86410C86EE4EFBE
                                  SHA1:51B43D517E2B1747C5D4DF36765D739644D5AACE
                                  SHA-256:733F121B62157053DCDE2D375A56239D8F2354E690CF5E463D794105AAE11D1D
                                  SHA-512:8B8E151608624C6D56870237386CEE0945AC28DC39FFDBAEC42DB0AE9A492880BA066490C8313D361080DD762C6CAB76FCDAC5E7167E841B224322499203AE03
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,........(1......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.IgY.z....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VgY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.VgY.z....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.VgY.z...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VgY.z.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............".8.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 7 14:23:14 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2679
                                  Entropy (8bit):3.9856469227379465
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:A4A88C88031AC28222F5C719ED67CEB3
                                  SHA1:BC87A18E9F3E37AA7ECAFDF2DFA24ABC5D2A5FF8
                                  SHA-256:676CEC691586F6CB3B0379C6ADC093C27A34826E50CEA7D768CB46F775A74165
                                  SHA-512:FDD8FF7064688BDC0ED12C9919A41B57FCEFBFA688B023A2EA1BC5E1538B5952F3987051EF4C22FB54C48B0D27959C90F3DE75C12BC4125DA145E03303287D28
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,.......(1......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.IgY.z....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VgY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.VgY.z....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.VgY.z...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VgY.z.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............".8.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 7 14:23:14 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2681
                                  Entropy (8bit):3.9965418486887105
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:34E2D35BEEE89C24CD22D192E8760670
                                  SHA1:02541CBC3FB835B9E97F449BFF456E13141BDC9D
                                  SHA-256:6945CBED0579F49DA86086A33B2442DC5B81DCB8FC4EAF431766B6B67A7BA547
                                  SHA-512:C87F0434D33A2A67D02789573897E68CEE502AFBA8D05DA1DBAB9C0062C29A8899CD60A74FEF6EE016C8B5F1C4A451953051D4FBDC6A16C371FB3A392104152A
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,.......(1......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.IgY.z....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VgY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.VgY.z....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.VgY.z...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VgY.z.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............".8.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                  File type:PDF document, version 1.5
                                  Entropy (8bit):7.811831983078629
                                  TrID:
                                  • Adobe Portable Document Format (5005/1) 100.00%
                                  File name:Multi Graphics Inc CustomerVendor Form.pdf
                                  File size:19'435 bytes
                                  MD5:7e0f535d80672f82314c73a1f931bf3c
                                  SHA1:882a90fb46ea48b1cd5942aa8a72d84aacbcbb62
                                  SHA256:915115b956b16cc8296eafc09e366c01e4fb7a7a00f5d2bb2918fcb4dc6e4fc8
                                  SHA512:50baeea13ae555059f7b9f832231d00de0e8e7c381a17b59f91eb735adab6c2604e6a20ed863719d4da91867ae8ebf5c5e72ef3d3183cfc36e7fe4e5b84185da
                                  SSDEEP:384:3o/IyThiJYPw+t0lfjUp0k5vg2aTjUQyt:aIyTqX7Cg2aTjUrt
                                  TLSH:B1927DA9F939809D884DCAC4E52D22C1C5DCC0F35619293A343CCA923D58EB2BD655FA
                                  File Content Preview:%PDF-1.5.%.....2 0 obj.<<./Type /Catalog./Pages 4 0 R./Version /1#2E5./AcroForm 5 0 R.>>.endobj.22 0 obj.<<./Filter /FlateDecode./Length 10.>>.stream..x.+......|..endstream.endobj.23 0 obj.<<./Filter /FlateDecode./Length 478.>>.stream..x..._O.0....|.{dHMl
                                  Icon Hash:62cc8caeb29e8ae0

                                  General

                                  Header:%PDF-1.5
                                  Total Entropy:7.811832
                                  Total Bytes:19435
                                  Stream Entropy:7.968099
                                  Stream Bytes:15821
                                  Entropy outside Streams:5.093460
                                  Bytes outside Streams:3614
                                  Number of EOF found:1
                                  Bytes after EOF:
                                  NameCount
                                  obj28
                                  endobj28
                                  stream25
                                  endstream25
                                  xref0
                                  trailer0
                                  startxref1
                                  /Page0
                                  /Encrypt0
                                  /ObjStm2
                                  /URI0
                                  /JS0
                                  /JavaScript0
                                  /AA0
                                  /OpenAction0
                                  /AcroForm1
                                  /JBIG2Decode0
                                  /RichMedia0
                                  /Launch0
                                  /EmbeddedFile0

                                  Image Streams

                                  IDDHASHMD5Preview
                                  100000000000000000073acd0b4a2391d4bbd9765aca5db19dc
                                  1012b43c4caeafa5986970a88aa2a083750a4f6aa6c568f06d0
                                  119000000000000000017b3e19593efeb4c09a755092de9d245
                                  12100000000000000002524414a7a3da57b1d3656227f4fc326