Windows Analysis Report
https://t3.service.hl.co.uk/r/?id=h33eb5959,aa246a3,aa298ce&e=dXRtX2NhbXBhaWduPUVPTDk2LUlHQ19tZW1iZXImdXRtX3NvdXJjZT1BZG9iZUNhbXBhaWduJnV0bV9tZWRpdW09ZW1haWwmdGhlU291cmNlPUVPTDk2JmVfY3RpPTUzNzYzNjcmZV9jdD1GJk92ZXJyaWRlPTE&s=NPQQQRi8c2SD9bjCqszMpXIxLAfmiAPvXAKV1zC8fWc

Overview

General Information

Sample URL: https://t3.service.hl.co.uk/r/?id=h33eb5959,aa246a3,aa298ce&e=dXRtX2NhbXBhaWduPUVPTDk2LUlHQ19tZW1iZXImdXRtX3NvdXJjZT1BZG9iZUNhbXBhaWduJnV0bV9tZWRpdW09ZW1haWwmdGhlU291cmNlPUVPTDk2JmVfY3RpPTUzNzYzNjcmZV
Analysis ID: 1523244
Infos:

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Drops files with a non-matching file extension (content does not match file extension)

Classification

Source: file:///C:/Users/user/Downloads/igc-report-2024.pdf HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/igc-report-2024.pdf HTTP Parser: No favicon
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: global traffic HTTP traffic detected: GET /r/?id=h33eb5959,aa246a3,aa298ce&e=dXRtX2NhbXBhaWduPUVPTDk2LUlHQ19tZW1iZXImdXRtX3NvdXJjZT1BZG9iZUNhbXBhaWduJnV0bV9tZWRpdW09ZW1haWwmdGhlU291cmNlPUVPTDk2JmVfY3RpPTUzNzYzNjcmZV9jdD1GJk92ZXJyaWRlPTE&s=NPQQQRi8c2SD9bjCqszMpXIxLAfmiAPvXAKV1zC8fWc HTTP/1.1Host: t3.service.hl.co.ukConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /__data/assets/pdf_file/0007/20167261/igc-report-2024.pdf?utm_campaign=EOL96-IGC_member&utm_source=AdobeCampaign&utm_medium=email&theSource=EOL96&e_cti=5376367&e_ct=F&Override=1&deliveryName=DM196562 HTTP/1.1Host: www.hl.co.ukConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AMCV_1B4022CE52783F160A490D4D%40AdobeOrg=MCMID%7C59341901470409687033098476543630901247; nlid=33eb5959|aa246a3
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dK9U128hp3sDKWh&MD=Frf6m2vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=dK9U128hp3sDKWh&MD=Frf6m2vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic DNS traffic detected: DNS query: t3.service.hl.co.uk
Source: global traffic DNS traffic detected: DNS query: www.hl.co.uk
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic DNS traffic detected: DNS query: x1.i.lencr.org
Source: unknown HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: 77EC63BDA74BD0D0E0426DC8F80085060.17.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: http://www.hl.co.uk/__data/assets/pdf_file/0011/7907348/Corporate-Terms-and-Conditions.pdf)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: http://www.hl.co.uk/igc)
Source: 2D85F72862B55C4EADD9E66E06947F3D0.17.dr String found in binary or memory: http://x1.i.lencr.org/
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://protect-eu.mimecast.com/s/qEGZCx1vNs932GCvn6FN?domain=hl.co.uk)
Source: ReaderMessages.16.dr String found in binary or memory: https://www.adobe.co
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.fca.org.uk/publications/policy-statements/ps22-9-new-consumer-duty
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.fscs.org.uk/)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.hl.co.uk/__data/assets/pdf_file/0003/20047503/2024-wpcc-illustrations-42.pdf)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.hl.co.uk/__data/assets/pdf_file/0004/20047504/2024-wpcc-illustrations-42-smb.pdf)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.hl.co.uk/__data/assets/pdf_file/0004/20047522/2024-wpcc-illustrations-20.pdf)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.hl.co.uk/__data/assets/pdf_file/0005/20047505/2024-wpcc-illustrations-35.pdf)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.hl.co.uk/__data/assets/pdf_file/0006/20047506/2024-wpcc-illustrations-30.pdf)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.hl.co.uk/__data/assets/pdf_file/0008/20047508/2024-wpcc-illustrations-17.pdf)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.hl.co.uk/__data/assets/pdf_file/0010/20047519/2024-wpcc-illustrations-40.pdf)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.hl.co.uk/__data/assets/pdf_file/0019/20047510/2024-wpcc-illustrations-15.pdf)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.hl.co.uk/__data/assets/pdf_file/0020/20047502/2024-wpcc-illustrations-45.pdf)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.hl.co.uk/__data/assets/pdf_file/0020/20047520/2024-wpcc-illustrations-25.pdf)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.hl.co.uk/charges-and-interest-rates)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.hl.co.uk/funds)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.hl.co.uk/security-centre/how-safe-is-your-investment)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.moneyhelper.org.uk/en/pensions-and-retirement/pension-wise?source=pw)
Source: 4c750c03-cedb-4545-ac8e-d2414eee8c21.tmp.0.dr, chromecache_211.2.dr, igc-report-2024.pdf.crdownload.0.dr String found in binary or memory: https://www.retirementlivingstandards.org.uk/)
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: classification engine Classification label: clean0.win@37/54@8/7
Source: chromecache_211.2.dr Initial sample: https://www.hl.co.uk/__data/assets/pdf_file/0019/20047510/2024-wpcc-illustrations-15.pdf
Source: chromecache_211.2.dr Initial sample: https://www.hl.co.uk/__data/assets/pdf_file/0010/20047519/2024-wpcc-illustrations-40.pdf
Source: chromecache_211.2.dr Initial sample: https://protect-eu.mimecast.com/s/qegzcx1vns932gcvn6fn?domain=hl.co.uk
Source: chromecache_211.2.dr Initial sample: https://www.hl.co.uk/__data/assets/pdf_file/0004/20047504/2024-wpcc-illustrations-42-smb.pdf
Source: chromecache_211.2.dr Initial sample: https://www.hl.co.uk/__data/assets/pdf_file/0020/20047502/2024-wpcc-illustrations-45.pdf
Source: chromecache_211.2.dr Initial sample: https://www.fca.org.uk/publications/policy-statements/ps22-9-new-consumer-duty \r
Source: chromecache_211.2.dr Initial sample: http://www.hl.co.uk/__data/assets/pdf_file/0011/7907348/corporate-terms-and-conditions.pdf
Source: chromecache_211.2.dr Initial sample: https://www.hl.co.uk/__data/assets/pdf_file/0020/20047520/2024-wpcc-illustrations-25.pdf
Source: chromecache_211.2.dr Initial sample: https://www.hl.co.uk/funds
Source: chromecache_211.2.dr Initial sample: https://www.hl.co.uk/charges-and-interest-rates
Source: chromecache_211.2.dr Initial sample: https://protect-eu.mimecast.com/s/qEGZCx1vNs932GCvn6FN?domain=hl.co.uk
Source: chromecache_211.2.dr Initial sample: https://www.hl.co.uk/security-centre/how-safe-is-your-investment
Source: chromecache_211.2.dr Initial sample: http://www.hl.co.uk/__data/assets/pdf_file/0011/7907348/Corporate-Terms-and-Conditions.pdf
Source: chromecache_211.2.dr Initial sample: https://www.fscs.org.uk/
Source: chromecache_211.2.dr Initial sample: https://www.retirementlivingstandards.org.uk/
Source: chromecache_211.2.dr Initial sample: https://www.hl.co.uk/__data/assets/pdf_file/0005/20047505/2024-wpcc-illustrations-35.pdf
Source: chromecache_211.2.dr Initial sample: https://www.hl.co.uk/__data/assets/pdf_file/0008/20047508/2024-wpcc-illustrations-17.pdf
Source: chromecache_211.2.dr Initial sample: https://www.hl.co.uk/__data/assets/pdf_file/0003/20047503/2024-wpcc-illustrations-42.pdf
Source: chromecache_211.2.dr Initial sample: https://www.hl.co.uk/__data/assets/pdf_file/0006/20047506/2024-wpcc-illustrations-30.pdf
Source: chromecache_211.2.dr Initial sample: http://www.hl.co.uk/igc
Source: chromecache_211.2.dr Initial sample: https://www.hl.co.uk/__data/assets/pdf_file/0004/20047522/2024-wpcc-illustrations-20.pdf
Source: chromecache_211.2.dr Initial sample: https://www.moneyhelper.org.uk/en/pensions-and-retirement/pension-wise?source=pw
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\Downloads\d736c48d-d5f0-4e3b-a895-1108d53ac4fb.tmp Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 06-47-30-313.log Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2024,i,11346600625722737073,16332623496641183597,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t3.service.hl.co.uk/r/?id=h33eb5959,aa246a3,aa298ce&e=dXRtX2NhbXBhaWduPUVPTDk2LUlHQ19tZW1iZXImdXRtX3NvdXJjZT1BZG9iZUNhbXBhaWduJnV0bV9tZWRpdW09ZW1haWwmdGhlU291cmNlPUVPTDk2JmVfY3RpPTUzNzYzNjcmZV9jdD1GJk92ZXJyaWRlPTE&s=NPQQQRi8c2SD9bjCqszMpXIxLAfmiAPvXAKV1zC8fWc"
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\igc-report-2024.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1628,i,12773371779395078299,5747927069721577490,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2024,i,11346600625722737073,16332623496641183597,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1628,i,12773371779395078299,5747927069721577490,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\crash_reporter.cfg Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: Chrome Cache Entry: 211
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: Chrome Cache Entry: 211 Jump to dropped file
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1523244 URL: https://t3.service.hl.co.uk... Startdate: 01/10/2024 Architecture: WINDOWS Score: 0 22 x1.i.lencr.org 2->22 24 chrome.cloudflare-dns.com 2->24 7 chrome.exe 14 2->7         started        10 Acrobat.exe 18 70 2->10         started        12 chrome.exe 2->12         started        process3 dnsIp4 30 192.168.2.7, 123, 138, 443 unknown unknown 7->30 32 239.255.255.250 unknown Reserved 7->32 14 chrome.exe 7->14         started        17 AcroCEF.exe 90 10->17         started        process5 dnsIp6 34 www.google.com 142.250.184.196, 443, 49709, 49723 GOOGLEUS United States 14->34 36 d3c6vck7qm2wt.cloudfront.net 143.204.98.90, 443, 49708 AMAZON-02US United States 14->36 38 3 other IPs or domains 14->38 19 AcroCEF.exe 6 17->19         started        process7 dnsIp8 26 chrome.cloudflare-dns.com 172.64.41.3, 443, 49724, 49725 CLOUDFLARENETUS United States 19->26 28 23.46.224.162, 443, 49732 AKAMAI-ASUS United States 19->28
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.184.196
 www.google.com United States
15169 GOOGLEUS false
54.220.97.66
 hargreaveslansdo-mkt-prod3-fhw4x-526190265.eu-west-1.elb.amazonaws.com United States
16509 AMAZON-02US false
143.204.98.90
 d3c6vck7qm2wt.cloudfront.net United States
16509 AMAZON-02US false
239.255.255.250
 unknown Reserved
unknown unknown false
23.46.224.162
 unknown United States
16625 AKAMAI-ASUS false
172.64.41.3
 chrome.cloudflare-dns.com United States
13335 CLOUDFLARENETUS false

Private

IP
192.168.2.7

Contacted Domains

Name IP Active
chrome.cloudflare-dns.com 172.64.41.3 true
d3c6vck7qm2wt.cloudfront.net 143.204.98.90 true
hargreaveslansdo-mkt-prod3-fhw4x-526190265.eu-west-1.elb.amazonaws.com 54.220.97.66 true
www.google.com 142.250.184.196 true
x1.i.lencr.org unknown unknown
www.hl.co.uk unknown unknown
t3.service.hl.co.uk unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.hl.co.uk/__data/assets/pdf_file/0007/20167261/igc-report-2024.pdf?utm_campaign=EOL96-IGC_member&utm_source=AdobeCampaign&utm_medium=email&theSource=EOL96&e_cti=5376367&e_ct=F&Override=1&deliveryName=DM196562 false
    		unknown
    file:///C:/Users/user/Downloads/igc-report-2024.pdf false
      		unknown
      https://chrome.cloudflare-dns.com/dns-query false
      • URL Reputation: safe
      		 unknown
      https://t3.service.hl.co.uk/r/?id=h33eb5959,aa246a3,aa298ce&e=dXRtX2NhbXBhaWduPUVPTDk2LUlHQ19tZW1iZXImdXRtX3NvdXJjZT1BZG9iZUNhbXBhaWduJnV0bV9tZWRpdW09ZW1haWwmdGhlU291cmNlPUVPTDk2JmVfY3RpPTUzNzYzNjcmZV9jdD1GJk92ZXJyaWRlPTE&s=NPQQQRi8c2SD9bjCqszMpXIxLAfmiAPvXAKV1zC8fWc false
        		unknown