IOC Report
Benefit Enrollment -wZ5nusm.pdf

loading gif

Files

File Path
Type
Category
Malicious
Benefit Enrollment -wZ5nusm.pdf
PDF document, version 1.4, 1 pages
initial sample
malicious
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1f67549f-dd2a-4daf-a0ae-f180b6d8076b.tmp
JSON data
modified
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)
JSON data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241119213916Z-185.bmp
PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D
Certificate, Version=3
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D
data
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
modified
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING
data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal
SQLite Rollback Journal
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin
data
dropped
C:\Users\user\AppData\Local\Temp\MSIde769.LOG
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-19 16-39-14-798.log
ASCII text, with very long lines (393)
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log
ASCII text, with very long lines (393), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\4e1cbd47-5683-44f9-b8e5-b6f01a53be91.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\549479f7-ea9b-4651-9834-99685e680f10.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\55242eca-b816-4cb3-9c92-8e629e9e7a4a.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\ee7ef40f-115e-4bd8-b66b-25ebb9623743.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 20:39:39 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 20:39:39 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 20:39:39 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 20:39:39 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 20:39:39 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 234
ASCII text, with very long lines (47671)
dropped
Chrome Cache Entry: 235
ASCII text, with very long lines (6737)
dropped
Chrome Cache Entry: 236
ASCII text, with very long lines (1597)
dropped
Chrome Cache Entry: 237
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 238
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 239
PNG image data, 1 x 92, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 240
MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
Chrome Cache Entry: 241
ASCII text, with very long lines (1959)
dropped
Chrome Cache Entry: 242
HTML document, ASCII text, with very long lines (1899)
dropped
Chrome Cache Entry: 243
ASCII text, with very long lines (1959)
downloaded
Chrome Cache Entry: 244
HTML document, ASCII text, with very long lines (1899)
downloaded
Chrome Cache Entry: 245
HTML document, ASCII text, with very long lines (3121)
downloaded
Chrome Cache Entry: 246
PNG image data, 21 x 21, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 247
HTML document, ASCII text, with very long lines (3121)
dropped
Chrome Cache Entry: 248
Web Open Font Format (Version 2), TrueType, length 39516, version 1.0
downloaded
Chrome Cache Entry: 249
ASCII text, with very long lines (47671)
downloaded
Chrome Cache Entry: 250
PNG image data, 1234 x 1468, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 251
PNG image data, 21 x 21, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 252
PNG image data, 144 x 144, 8-bit colormap, non-interlaced
dropped
Chrome Cache Entry: 253
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 254
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 255
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 256
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 257
MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
downloaded
Chrome Cache Entry: 258
PNG image data, 144 x 144, 8-bit colormap, non-interlaced
downloaded
Chrome Cache Entry: 259
HTML document, ASCII text, with very long lines (1899)
downloaded
Chrome Cache Entry: 260
PNG image data, 1234 x 1468, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 261
HTML document, Unicode text, UTF-8 text, with very long lines (1136)
dropped
Chrome Cache Entry: 262
Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
downloaded
Chrome Cache Entry: 263
ASCII text, with very long lines (1572)
downloaded
Chrome Cache Entry: 264
Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
downloaded
Chrome Cache Entry: 265
ASCII text, with very long lines (1597)
downloaded
Chrome Cache Entry: 266
PNG image data, 1 x 92, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 267
ASCII text
downloaded
Chrome Cache Entry: 268
ASCII text, with very long lines (6737)
downloaded
Chrome Cache Entry: 269
ASCII text, with very long lines (65536), with no line terminators
downloaded
There are 76 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Benefit Enrollment -wZ5nusm.pdf"
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1664,i,5851574856051630323,12664750612450497625,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://docs.google.com/presentation/d/143otlfFJgJZYae_WJ64QLs5yhOe5qn2oMXzwiK1lfdA/preview?pli=197701238882421788824217888242178882421788824217888242178882421788824217888242178882421788824217888242178882421788824217888242178882421788824217888242178882421788824217
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1904,i,2575195200606368416,13911781742009850812,262144 /prefetch:8

URLs

Name
IP
Malicious
https://a2e99d6c.eab6dee9caec6702bc512ed3.workers.dev/favicon.ico
188.114.96.3
malicious
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8e535e1889e57289/1732052521565/5z9YjcSK4MQ3EK_
104.18.95.41
https://policies.google.com/terms?hl=en
unknown
https://support.google.com/docs/answer/1696717?hl=en
unknown
https://www.google.com/tools/feedback
unknown
https://lh7-rt.googleusercontent.com/slidesz/AGV_vUeLPoq76rObru35TPgTfwa2K4VSoQoIQMY8RUUfnDqkoRKBLWnxqsigR8eYirpM-lSj7dxjiHJLOAbvb-pMtX7jk6gSB04cWxa6ahK7DcpsSyVgJKT6oqZ-KZV1CWXtejs=s2048?key=SEShV20nT9X2QVMNVUZ35AHE
142.250.186.65
http://x1.i.lencr.org/
unknown
https://challenges.cloudflare.com/turnstile/v0/b/22755d9a86c9/api.js
104.18.95.41
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/996815153:1732049315:zk9hdAKFkruR4eCjwgFXFtg9gtA4I5yAPDUiFETkvJQ/8e535e1889e57289/g0lFC_fUPRmESr9A2wEBc5IumnK6jxfR_e9wTaHooMs-1732052519-1.1.1.1-4gdcWhHbGspa1Fe..WWONDvJsKGS.LHW8Iwa3QwdhHVmXAI6d631HYISLACfq2c9
104.18.95.41
https://a2e99d6c.eab6dee9caec6702bc512ed3.workers.dev/
https://support.google.com
unknown
https://play.google.com
unknown
https://docs.google.com/presentation/manifest.json
172.217.18.14
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8e535e1889e57289&lang=auto
104.18.95.41
https://play.google.com/log?format=json&hasfast=true&authuser=0
142.250.186.110
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/8e535e1889e57289/1732052521572/c148e10381c570ddeb5997a99b73e207d7ff16ca889714d4046b4b91d58877cf/Ed1JfybuxXklOFP
104.18.95.41
https://angular.dev/license
unknown
https://docs.google.com/static/presentation/client/css/2320960940-viewer_css_ltr.css
172.217.18.14
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
104.18.95.41
https://www.google.com/recaptcha/api.js?trustedtypes=true&render=
unknown
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
unknown
https://support.google.com/
unknown
https://www.google.com
unknown
https://www.youtube.com/iframe_api
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1
104.18.95.41
https://docs.google.com/static/presentation/client/js/1841671190-viewer_core.js
172.217.18.14
https://support.google.com/drive/?hl=en
unknown
https://docs.google.com/static/presentation/client/js/1385634762-punch_viewer_worker_binary_viewercore.js
172.217.18.14
https://docs.google.com/static/presentation/client/js/1908591497-viewer_app.js
172.217.18.14
https://docs.google.com/static/presentation/client/js/2049142854-viewer_help.js
172.217.18.14
https://policies.google.com/privacy?hl=en
unknown
https://docs.google.com/presentation/d/143otlfFJgJZYae_WJ64QLs5yhOe5qn2oMXzwiK1lfdA/preview?pli=197701238882421788824217888242178882421788824217888242178882421788824217888242178882421788824217888242178882421788824217888242178882421788824217888242178882421788824217&slide=id.p
https://docs.google.com/presentation/d/143otlfFJgJZYae_WJ64QLs5yhOe5qn2oMXzwiK1lfdA/preview?pli=197701238882421788824217888242178882421788824217888242178882421788824217888242178882421788824217888242178882421788824217888242178882421788824217888242178882421788824217
172.217.18.14
https://iuutytryrtserttytuiyiuoyutyrtyrtsdtyfyuguiguyftyfyugiouyuty.sbs/?ovsgbqtp
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/t0clq/0x4AAAAAAA0DCVK2ZhZ9Susl/auto/fbE/normal/auto/
104.18.95.41
https://fonts.google.com/license/googlerestricted
unknown
There are 26 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.214.172
docs.google.com
172.217.18.14
play.google.com
142.250.186.110
a2e99d6c.eab6dee9caec6702bc512ed3.workers.dev
188.114.96.3
challenges.cloudflare.com
104.18.95.41
www.google.com
142.250.186.68
x1.i.lencr.org
unknown

IPs

IP
Domain
Country
Malicious
192.168.2.5
unknown
unknown
malicious
142.250.186.68
www.google.com
United States
142.250.74.206
unknown
United States
172.217.18.14
docs.google.com
United States
142.250.186.110
play.google.com
United States
104.18.95.41
challenges.cloudflare.com
United States
239.255.255.250
unknown
Reserved
188.114.96.3
a2e99d6c.eab6dee9caec6702bc512ed3.workers.dev
European Union
172.217.16.193
unknown
United States
23.203.104.175
unknown
United States
142.250.186.65
unknown
United States
There are 1 hidden IPs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
aFS
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
tDIText
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
tFileName
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
tFileSource
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sFileAncestors
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sDI
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sDate
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
uFileSize
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
uPageCount
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sAssetId
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
bisSharedFile
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
aFS
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
tDIText
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
tFileName
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
sDI
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
sDate
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
uFileSize
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
uPageCount
There are 8 hidden registries, click here to show them.

DOM / HTML

URL
Malicious
https://docs.google.com/presentation/d/143otlfFJgJZYae_WJ64QLs5yhOe5qn2oMXzwiK1lfdA/preview?pli=197701238882421788824217888242178882421788824217888242178882421788824217888242178882421788824217888242178882421788824217888242178882421788824217888242178882421788824217&slide=id.p
https://docs.google.com/presentation/d/143otlfFJgJZYae_WJ64QLs5yhOe5qn2oMXzwiK1lfdA/preview?pli=197701238882421788824217888242178882421788824217888242178882421788824217888242178882421788824217888242178882421788824217888242178882421788824217888242178882421788824217&slide=id.p
https://a2e99d6c.eab6dee9caec6702bc512ed3.workers.dev/
https://a2e99d6c.eab6dee9caec6702bc512ed3.workers.dev/