Edit tour

Windows Analysis Report
http://img1.wsimg.com/blobby/go/e817bb84-a239-4ab7-b799-a1a28b73e3bf/downloads/vibujoxupekumig.pdf

Overview

General Information

Sample URL:	http://img1.wsimg.com/blobby/go/e817bb84-a239-4ab7-b799-a1a28b73e3bf/downloads/vibujoxupekumig.pdf
Analysis ID:	1323052
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found potential malicious PDF (bad image similarity)

Stores files to the Windows start menu directory

Checks for available system drives (often done to infect USB drives)

Creates files inside the system directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4184 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2112,i,11896617920037136445,4751922825408255977,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5932 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://img1.wsimg.com/blobby/go/e817bb84-a239-4ab7-b799-a1a28b73e3bf/downloads/vibujoxupekumig.pdf MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

Acrobat.exe (PID: 8688 cmdline: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8596 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 432 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2204 --field-trial-handle=1564,i,16990901771295455395,1012609527637628534,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Spreading
• Networking
• System Summary
• Boot Survival
• Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\Downloads\27644e28-4f83-400a-b9eb-7f7c3cfc7da2.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\2cf0b46e-fe5c-4b1c-9ebe-ff5c0954bf8f.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\1154c74f-441c-4e0d-be32-802beef0a013.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\0e5cb5f7-7c0e-45da-bae5-057982727c07.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\053745c0-ee62-4174-9efe-41f725849e4e.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\28839db3-0322-4c76-98e2-00516a1e3257.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\35b7cbef-7585-47fd-9f98-3635ee69ff5f.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\3930d822-783e-4d9a-b25e-52ef47857f2f.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\092f6f55-149c-4787-b3db-dd6d05b8e771.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\054341f0-d7f0-4f89-a1ab-49feacc0d7fe.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\1f5caf68-71f0-4d26-b7b6-a75d94382cdd.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\0a753d6f-4d38-4a9c-91a8-acd8cc7a708f.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\056b2eb8-bfff-4e8f-ad14-3c4ce4f5b4ff.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\22cdb44a-4f46-4252-9d5e-dc343feabc47.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\0163d16a-f995-4ada-95ac-98bf8e1a68c8.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\1996f230-b8e3-42ad-8c33-288c708a9fc5.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\184a510c-c40d-4e2e-a9fa-8ac5aba9d219.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\1f53909a-9b3b-4c3b-ba40-f2296e264ded.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\05082a25-4e61-4440-8ba5-a723f5be17aa.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\1553c37a-ec78-4ecd-a2e2-513b8a3adafe.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\1e214cb2-cb14-4893-9c60-df0452c6e396.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\092be2f1-bdfa-4933-93fb-fa71e0e56049.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\33ad54fe-56dc-4981-96ae-d6ddf986d7d0.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2
Source: C:\Users\user\Downloads\1e11b344-9070-4987-812b-a9545744177e.tmp	Avira: detection malicious, Label: HTML/Malicious.PDF.Gen2

Source: http://img1.wsimg.com/blobby/go/e817bb84-a239-4ab7-b799-a1a28b73e3bf/downloads/vibujoxupekumig.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 72.247.100.147:443 -> 192.168.2.3:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 72.247.100.147:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.3:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.3:49741 version: TLS 1.2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: z:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: x:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: v:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: t:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: r:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: p:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: n:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: l:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: j:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: h:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: f:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: b:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: y:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: w:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: u:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: s:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: q:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: o:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: m:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: k:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: i:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: g:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: e:	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File opened: c:	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	File opened: a:	Jump to behavior

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.43
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.155
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.43
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.155
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.247.100.147
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.134Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.3448/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.3031&MK=xA8KrWEY9XlR3xy&MD=F6k2UB4X HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.3448/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.3031&MK=xA8KrWEY9XlR3xy&MD=F6k2UB4X HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000006B40F232AC HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 970e02fa-57d1-4240-a0ce-04ea7a641583x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br

Source: 27644e28-4f83-400a-b9eb-7f7c3cfc7da2.tmp.5.dr, d4343937-3d63-49ba-92e5-eb5091199a36.tmp.5.dr, 9c67641d-2cf4-4ab3-b985-217ab34fa7e0.tmp.5.dr, ee3f0f10-8973-4315-b5ab-1eaeace6d70b.tmp.5.dr, e1e5ab51-a453-4957-b6bd-60e616fb6d14.tmp.5.dr, e38059bc-c638-423e-84df-b8b79064c4d1.tmp.5.dr, 65445438-0556-4c95-a6d9-b94a564df508.tmp.5.dr, 2cf0b46e-fe5c-4b1c-9ebe-ff5c0954bf8f.tmp.5.dr, 1154c74f-441c-4e0d-be32-802beef0a013.tmp.5.dr, 74ef8cb9-113f-4dd0-80d8-89e61192972d.tmp.5.dr, 0e5cb5f7-7c0e-45da-bae5-057982727c07.tmp.5.dr, 053745c0-ee62-4174-9efe-41f725849e4e.tmp.5.dr, 862f858d-1367-40f0-b863-e856c00ffca2.tmp.5.dr, 28839db3-0322-4c76-98e2-00516a1e3257.tmp.5.dr, fa8e36c0-f71a-4c9f-ac5f-5fb17e25894f.tmp.5.dr, 35b7cbef-7585-47fd-9f98-3635ee69ff5f.tmp.5.dr, 762afc15-d781-4a2b-8893-86fe22756384.tmp.5.dr, 3930d822-783e-4d9a-b25e-52ef47857f2f.tmp.5.dr, 092f6f55-149c-4787-b3db-dd6d05b8e771.tmp.5.dr, cfe08b29-96f0-463c-98fd-19149ebdfb90.tmp.5.dr, b9a699af-1c39-4bfa-b1e1-aa3cf126913f.tmp.5.dr

String found in binary or memory: https://gitilojilajirig.lovig.co.za/157729196711736744?pomafutamutipejenuwira=lolobasitamoteteweriga

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2023-10-05-14; NID=511=OL3WgnA24QwPfMpspsItpZ2c_g7YXAAMilzUqiZdxG8z8Ka1c00AfG24ctRwvhPMrHVqO7oNbKVSwiOA0g2EzuMjPJIvQtOS7zZy99O8OkMoKSMKDFs-L1TjxHc_KVN5KBVb4BTfsPAzvlWsn_iACmkP3ulD50w_qpZ6JVqkr7w

Source: unknown	HTTPS traffic detected: 72.247.100.147:443 -> 192.168.2.3:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 72.247.100.147:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.3:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.3:49741 version: TLS 1.2

System Summary

Found potential malicious PDF (bad image similarity)

Source: downloaded.pdf.crdownload.5.dr	Static PDF information: Image stream: 7
Source: e0f48191-c58e-4b49-81ec-f76287ba4475.tmp.5.dr	Static PDF information: Image stream: 7
Source: cb094c13-5d98-4cad-ae2e-2ebf01f708e0.tmp.5.dr	Static PDF information: Image stream: 7
Source: 624d2783-ccb2-4534-a5a2-0dd1144e2650.tmp.5.dr	Static PDF information: Image stream: 7
Source: 1996f230-b8e3-42ad-8c33-288c708a9fc5.tmp.5.dr	Static PDF information: Image stream: 7
Source: e1e5ab51-a453-4957-b6bd-60e616fb6d14.tmp.5.dr	Static PDF information: Image stream: 7
Source: b9a699af-1c39-4bfa-b1e1-aa3cf126913f.tmp.5.dr	Static PDF information: Image stream: 7
Source: 9d029239-2e51-4c12-81cd-8219916b96e7.tmp.5.dr	Static PDF information: Image stream: 7
Source: 1154c74f-441c-4e0d-be32-802beef0a013.tmp.5.dr	Static PDF information: Image stream: 7
Source: 4f766108-163f-4f3e-834e-4f1924d7d2cb.tmp.5.dr	Static PDF information: Image stream: 7
Source: 6d9821da-a97e-42b1-9c88-2abadd666cdd.tmp.5.dr	Static PDF information: Image stream: 7
Source: 053745c0-ee62-4174-9efe-41f725849e4e.tmp.5.dr	Static PDF information: Image stream: 7
Source: dd5f5d1a-6b33-4e84-ad98-83f78b1dd3b0.tmp.5.dr	Static PDF information: Image stream: 7
Source: 7aa6ef48-7375-4702-98fe-a648a475e33c.tmp.5.dr	Static PDF information: Image stream: 7
Source: 1e11b344-9070-4987-812b-a9545744177e.tmp.5.dr	Static PDF information: Image stream: 7
Source: 77586b20-f398-4fe2-a14d-749542221949.tmp.5.dr	Static PDF information: Image stream: 7
Source: 0e5cb5f7-7c0e-45da-bae5-057982727c07.tmp.5.dr	Static PDF information: Image stream: 7
Source: ed5df0a5-5211-418d-854c-76d6f447e083.tmp.5.dr	Static PDF information: Image stream: 7
Source: bdacef5e-66c3-4b35-a14d-737ec4173867.tmp.5.dr	Static PDF information: Image stream: 7
Source: 1f53909a-9b3b-4c3b-ba40-f2296e264ded.tmp.5.dr	Static PDF information: Image stream: 7
Source: 862f858d-1367-40f0-b863-e856c00ffca2.tmp.5.dr	Static PDF information: Image stream: 7
Source: cbe7eaf8-ac01-445c-870d-260c85e35135.tmp.5.dr	Static PDF information: Image stream: 7
Source: 28839db3-0322-4c76-98e2-00516a1e3257.tmp.5.dr	Static PDF information: Image stream: 7
Source: ee3f0f10-8973-4315-b5ab-1eaeace6d70b.tmp.5.dr	Static PDF information: Image stream: 7
Source: 056b2eb8-bfff-4e8f-ad14-3c4ce4f5b4ff.tmp.5.dr	Static PDF information: Image stream: 7
Source: b034f9a7-00ab-4f64-8538-f6a6a63da35b.tmp.5.dr	Static PDF information: Image stream: 7
Source: 7c5b2d10-171d-4f5d-9653-d44f2448d3bc.tmp.5.dr	Static PDF information: Image stream: 7
Source: c71dac73-4cc3-4797-9c47-14484e497f02.tmp.5.dr	Static PDF information: Image stream: 7
Source: ecfedc4f-f373-4d00-8f7c-be7ebb875323.tmp.5.dr	Static PDF information: Image stream: 7
Source: 559f6bf7-c20b-475d-82ef-1d7b5f215c4d.tmp.5.dr	Static PDF information: Image stream: 7
Source: 74ef8cb9-113f-4dd0-80d8-89e61192972d.tmp.5.dr	Static PDF information: Image stream: 7
Source: fa267f96-06b3-4d42-8a9e-ce1e30ed2ce5.tmp.5.dr	Static PDF information: Image stream: 7
Source: 27644e28-4f83-400a-b9eb-7f7c3cfc7da2.tmp.5.dr	Static PDF information: Image stream: 7
Source: 1553c37a-ec78-4ecd-a2e2-513b8a3adafe.tmp.5.dr	Static PDF information: Image stream: 7
Source: c6a49baa-7653-458b-9231-d523846a8330.tmp.5.dr	Static PDF information: Image stream: 7
Source: 969f3c0c-3247-4487-8b2a-16ed65461964.tmp.5.dr	Static PDF information: Image stream: 7
Source: 81026891-3c51-4b4f-81df-6ccf3782c978.tmp.5.dr	Static PDF information: Image stream: 7
Source: 46181df3-81d1-429a-9ccb-5d8212f5fbaf.tmp.5.dr	Static PDF information: Image stream: 7
Source: 8b7cbf1d-ec25-48fa-b563-5ed17368a772.tmp.5.dr	Static PDF information: Image stream: 7
Source: 1e214cb2-cb14-4893-9c60-df0452c6e396.tmp.5.dr	Static PDF information: Image stream: 7
Source: 1f5caf68-71f0-4d26-b7b6-a75d94382cdd.tmp.5.dr	Static PDF information: Image stream: 7
Source: d4343937-3d63-49ba-92e5-eb5091199a36.tmp.5.dr	Static PDF information: Image stream: 7
Source: 5a9d1141-6594-4047-bc4c-5d411b9f47b2.tmp.5.dr	Static PDF information: Image stream: 7
Source: 9686e8e2-e978-4fc8-aa0d-7487edc5642f.tmp.5.dr	Static PDF information: Image stream: 7
Source: 3930d822-783e-4d9a-b25e-52ef47857f2f.tmp.5.dr	Static PDF information: Image stream: 7
Source: 092be2f1-bdfa-4933-93fb-fa71e0e56049.tmp.5.dr	Static PDF information: Image stream: 7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_4184_1820262750

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-10 17-19-03-018.log

Jump to behavior

Source: 092be2f1-bdfa-4933-93fb-fa71e0e56049.tmp.5.dr

Initial sample: https://gitilojilajirig.lovig.co.za/157729196711736744?pomafutamutipejenuwira=lolobasitamotetewerigawukotawogazekovugaxikepuzakudixibexurokowunatalajezapujonekabanakoxeradekulurokepigikulotogimidudowomajefixugopukowaborefekitilosaxedigexixezelawalatenubasamitogixarusegifuwazaki&utm_term=how+to+set+up+a+vodafone+wifi+booster&gebodagawutesewifukevizuvoxawogakokidadilijuwijonazinimotiwujopofitilajosexux=gepabulolodomevidazudamogotipewinataxaviwifafixoxaniredakitabadowutukogevapalarefuvupetiwakugemesapabuxufilunezabugubozewulo

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: classification engine

Classification label: mal56.win@153/128@12/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2112,i,11896617920037136445,4751922825408255977,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://img1.wsimg.com/blobby/go/e817bb84-a239-4ab7-b799-a1a28b73e3bf/downloads/vibujoxupekumig.pdf
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2204 --field-trial-handle=1564,i,16990901771295455395,1012609527637628534,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2112,i,11896617920037136445,4751922825408255977,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://img1.wsimg.com/blobby/go/e817bb84-a239-4ab7-b799-a1a28b73e3bf/downloads/vibujoxupekumig.pdf	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2204 --field-trial-handle=1564,i,16990901771295455395,1012609527637628534,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2204 --field-trial-handle=1564,i,16990901771295455395,1012609527637628534,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\crash_reporter.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Spearphishing Link	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	11 Peripheral Device Discovery	1 Replication Through Removable Media	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
1 Replication Through Removable Media	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://img1.wsimg.com/blobby/go/e817bb84-a239-4ab7-b799-a1a28b73e3bf/downloads/vibujoxupekumig.pdf	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Downloads\27644e28-4f83-400a-b9eb-7f7c3cfc7da2.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\2cf0b46e-fe5c-4b1c-9ebe-ff5c0954bf8f.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\1154c74f-441c-4e0d-be32-802beef0a013.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\0e5cb5f7-7c0e-45da-bae5-057982727c07.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\053745c0-ee62-4174-9efe-41f725849e4e.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\28839db3-0322-4c76-98e2-00516a1e3257.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\35b7cbef-7585-47fd-9f98-3635ee69ff5f.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\3930d822-783e-4d9a-b25e-52ef47857f2f.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\092f6f55-149c-4787-b3db-dd6d05b8e771.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\054341f0-d7f0-4f89-a1ab-49feacc0d7fe.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\1f5caf68-71f0-4d26-b7b6-a75d94382cdd.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\0a753d6f-4d38-4a9c-91a8-acd8cc7a708f.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\056b2eb8-bfff-4e8f-ad14-3c4ce4f5b4ff.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\22cdb44a-4f46-4252-9d5e-dc343feabc47.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\0163d16a-f995-4ada-95ac-98bf8e1a68c8.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\1996f230-b8e3-42ad-8c33-288c708a9fc5.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\184a510c-c40d-4e2e-a9fa-8ac5aba9d219.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\1f53909a-9b3b-4c3b-ba40-f2296e264ded.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\05082a25-4e61-4440-8ba5-a723f5be17aa.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\1553c37a-ec78-4ecd-a2e2-513b8a3adafe.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\1e214cb2-cb14-4893-9c60-df0452c6e396.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\092be2f1-bdfa-4933-93fb-fa71e0e56049.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\33ad54fe-56dc-4981-96ae-d6ddf986d7d0.tmp	100%	Avira	HTML/Malicious.PDF.Gen2
C:\Users\user\Downloads\1e11b344-9070-4987-812b-a9545744177e.tmp	100%	Avira	HTML/Malicious.PDF.Gen2

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.250.189.13	true	false	high
www.google.com	142.250.72.132	true	false	high
clients.l.google.com	142.250.72.174	true	false	high
img1.wsimg.com	unknown	unknown	false	high
clients1.google.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://img1.wsimg.com/blobby/go/e817bb84-a239-4ab7-b799-a1a28b73e3bf/downloads/vibujoxupekumig.pdf	false	high
file:///C:/Users/user/Downloads/downloaded.pdf	false	low
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false	high
https://clients1.google.com/tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000006B40F232AC	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://gitilojilajirig.lovig.co.za/157729196711736744?pomafutamutipejenuwira=lolobasitamoteteweriga	27644e28-4f83-400a-b9eb-7f7c3cfc7da2.tmp.5.dr, d4343937-3d63-49ba-92e5-eb5091199a36.tmp.5.dr, 9c67641d-2cf4-4ab3-b985-217ab34fa7e0.tmp.5.dr, ee3f0f10-8973-4315-b5ab-1eaeace6d70b.tmp.5.dr, e1e5ab51-a453-4957-b6bd-60e616fb6d14.tmp.5.dr, e38059bc-c638-423e-84df-b8b79064c4d1.tmp.5.dr, 65445438-0556-4c95-a6d9-b94a564df508.tmp.5.dr, 2cf0b46e-fe5c-4b1c-9ebe-ff5c0954bf8f.tmp.5.dr, 1154c74f-441c-4e0d-be32-802beef0a013.tmp.5.dr, 74ef8cb9-113f-4dd0-80d8-89e61192972d.tmp.5.dr, 0e5cb5f7-7c0e-45da-bae5-057982727c07.tmp.5.dr, 053745c0-ee62-4174-9efe-41f725849e4e.tmp.5.dr, 862f858d-1367-40f0-b863-e856c00ffca2.tmp.5.dr, 28839db3-0322-4c76-98e2-00516a1e3257.tmp.5.dr, fa8e36c0-f71a-4c9f-ac5f-5fb17e25894f.tmp.5.dr, 35b7cbef-7585-47fd-9f98-3635ee69ff5f.tmp.5.dr, 762afc15-d781-4a2b-8893-86fe22756384.tmp.5.dr, 3930d822-783e-4d9a-b25e-52ef47857f2f.tmp.5.dr, 092f6f55-149c-4787-b3db-dd6d05b8e771.tmp.5.dr, cfe08b29-96f0-463c-98fd-19149ebdfb90.tmp.5.dr, b9a699af-1c39-4bfa-b1e1-aa3cf126913f.tmp.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.72.238	unknown	United States	15169	GOOGLEUS	false
50.16.47.176	unknown	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.72.132	www.google.com	United States	15169	GOOGLEUS	false
142.250.189.13	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.72.174	clients.l.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.3

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1323052
Start date and time:	2023-10-10 17:16:43 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://img1.wsimg.com/blobby/go/e817bb84-a239-4ab7-b799-a1a28b73e3bf/downloads/vibujoxupekumig.pdf
Analysis system description:	Windows 10 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@153/128@12/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.12.131, 34.104.35.123, 23.15.241.80, 23.15.241.65, 142.250.68.67, 72.247.100.179, 162.159.61.3, 172.64.41.3, 3.219.243.226, 52.6.155.20, 3.233.129.217, 52.22.41.97, 23.72.90.12, 23.72.90.6
Excluded domains from analysis (whitelisted): www.bing.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e40258.g.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, clientservices.googleapis.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, global-wildcard.wsimg.com.sni-only.edgekey.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
VT rate limit hit for: http://img1.wsimg.com/blobby/go/e817bb84-a239-4ab7-b799-a1a28b73e3bf/downloads/vibujoxupekumig.pdf

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2082093881876865
Encrypted:	false
SSDEEP:	6:kl/TVq2PWXp+N2nKuAl9OmbnIFUtU/SmSgZmwC/SmSIkwOWXp+N2nKuAl9OmbjLJ:kl/RvaHAahFUtUbX/CbF5fHAaSJ
MD5:	73648669FC1761931B49CDCEE9D1FC54
SHA1:	01F229429D4651C07D797BB6EC54E770E2C1D470
SHA-256:	C0870D6E6F1D91F81B109FE7EC34658BFEDE0D3FADF3624C1779AEFAB879E549
SHA-512:	6CE274B322215EFF7C71EDAC6A8CA686823402C0D149D51118702451F71579E61F3B44C7DB412F06AFEE38BB886390EBA987CA29DEC936D0B5A033C3DB170D9F
Malicious:	false
Reputation:	low
Preview:	2023/10/10-17:19:01.566 1870 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/10/10-17:19:01.567 1870 Recovering log #3.2023/10/10-17:19:01.567 1870 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 10 14:17:37 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9736324535377157
Encrypted:	false
SSDEEP:	48:8SZdzTTXAnHWidAKZdA1kLehwiZUklqehHy+3:8SHnA9oy
MD5:	6D253CD6818D41B80CAB22F502178D53
SHA1:	EDC7FD466A1ED1EE4703DD5A8AEF4FEA2692A021
SHA-256:	BBEB5584B5BB77D6F0B4C6AB85345CEE23C24F0AD4BE91ACCBC768F932C1C650
SHA-512:	70334B109B6B6C9803393B343D8EA00A2849E5E27801727C018C47637206F6B1A63E6E0DCAA1EE4DA0FB8576AF4A0CE201B1BFE133D030B6CE2A80196C8EF0AA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....."F......v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.q..PROGRA~1..t......O.IJW1z....B...............J.....o4_.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VJW1z....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.f..Chrome..>......CW.VJW1z....M.....................c...C.h.r.o.m.e.....`.1.....EW.f..APPLIC~1..H......CW.VJW1z...........................P..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VJW3z....O......................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........2.@k.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2023 17:17:31.654689074 CEST	49681	443	192.168.2.3	20.189.173.5
Oct 10, 2023 17:17:31.963541031 CEST	49681	443	192.168.2.3	20.189.173.5
Oct 10, 2023 17:17:32.572907925 CEST	49681	443	192.168.2.3	20.189.173.5
Oct 10, 2023 17:17:32.666651964 CEST	49676	443	192.168.2.3	104.98.116.138
Oct 10, 2023 17:17:32.666750908 CEST	49677	443	192.168.2.3	104.98.116.138
Oct 10, 2023 17:17:32.668863058 CEST	49674	443	192.168.2.3	173.222.162.43
Oct 10, 2023 17:17:32.668863058 CEST	49675	443	192.168.2.3	104.98.116.155
Oct 10, 2023 17:17:32.979243040 CEST	49671	443	192.168.2.3	204.79.197.203
Oct 10, 2023 17:17:33.073050022 CEST	49672	443	192.168.2.3	104.98.116.138
Oct 10, 2023 17:17:33.776139975 CEST	49681	443	192.168.2.3	20.189.173.5
Oct 10, 2023 17:17:36.182383060 CEST	49681	443	192.168.2.3	20.189.173.5
Oct 10, 2023 17:17:37.073199034 CEST	49713	443	192.168.2.3	142.250.72.174
Oct 10, 2023 17:17:37.073293924 CEST	443	49713	142.250.72.174	192.168.2.3
Oct 10, 2023 17:17:37.073374987 CEST	49713	443	192.168.2.3	142.250.72.174
Oct 10, 2023 17:17:37.073765039 CEST	49714	443	192.168.2.3	142.250.189.13
Oct 10, 2023 17:17:37.073848963 CEST	443	49714	142.250.189.13	192.168.2.3
Oct 10, 2023 17:17:37.073916912 CEST	49714	443	192.168.2.3	142.250.189.13
Oct 10, 2023 17:17:37.074079990 CEST	49713	443	192.168.2.3	142.250.72.174
Oct 10, 2023 17:17:37.074120045 CEST	443	49713	142.250.72.174	192.168.2.3
Oct 10, 2023 17:17:37.074318886 CEST	49714	443	192.168.2.3	142.250.189.13
Oct 10, 2023 17:17:37.074354887 CEST	443	49714	142.250.189.13	192.168.2.3
Oct 10, 2023 17:17:37.487890959 CEST	443	49714	142.250.189.13	192.168.2.3
Oct 10, 2023 17:17:37.488404036 CEST	49714	443	192.168.2.3	142.250.189.13
Oct 10, 2023 17:17:37.488464117 CEST	443	49714	142.250.189.13	192.168.2.3
Oct 10, 2023 17:17:37.488467932 CEST	443	49713	142.250.72.174	192.168.2.3
Oct 10, 2023 17:17:37.488749981 CEST	49713	443	192.168.2.3	142.250.72.174
Oct 10, 2023 17:17:37.488771915 CEST	443	49713	142.250.72.174	192.168.2.3
Oct 10, 2023 17:17:37.489293098 CEST	443	49713	142.250.72.174	192.168.2.3
Oct 10, 2023 17:17:37.489370108 CEST	49713	443	192.168.2.3	142.250.72.174
Oct 10, 2023 17:17:37.490386963 CEST	443	49713	142.250.72.174	192.168.2.3
Oct 10, 2023 17:17:37.490427971 CEST	443	49714	142.250.189.13	192.168.2.3
Oct 10, 2023 17:17:37.490453005 CEST	49713	443	192.168.2.3	142.250.72.174
Oct 10, 2023 17:17:37.490509987 CEST	49714	443	192.168.2.3	142.250.189.13
Oct 10, 2023 17:17:37.491436958 CEST	49713	443	192.168.2.3	142.250.72.174
Oct 10, 2023 17:17:37.491522074 CEST	443	49713	142.250.72.174	192.168.2.3
Oct 10, 2023 17:17:37.491684914 CEST	49714	443	192.168.2.3	142.250.189.13
Oct 10, 2023 17:17:37.491769075 CEST	49713	443	192.168.2.3	142.250.72.174
Oct 10, 2023 17:17:37.491775036 CEST	443	49714	142.250.189.13	192.168.2.3
Oct 10, 2023 17:17:37.491786957 CEST	443	49713	142.250.72.174	192.168.2.3
Oct 10, 2023 17:17:37.491866112 CEST	49714	443	192.168.2.3	142.250.189.13
Oct 10, 2023 17:17:37.491883993 CEST	443	49714	142.250.189.13	192.168.2.3
Oct 10, 2023 17:17:37.537341118 CEST	49713	443	192.168.2.3	142.250.72.174
Oct 10, 2023 17:17:37.631159067 CEST	49714	443	192.168.2.3	142.250.189.13
Oct 10, 2023 17:17:37.832926989 CEST	443	49713	142.250.72.174	192.168.2.3
Oct 10, 2023 17:17:37.833295107 CEST	443	49713	142.250.72.174	192.168.2.3
Oct 10, 2023 17:17:37.833385944 CEST	49713	443	192.168.2.3	142.250.72.174
Oct 10, 2023 17:17:37.834038019 CEST	49713	443	192.168.2.3	142.250.72.174
Oct 10, 2023 17:17:37.834081888 CEST	443	49713	142.250.72.174	192.168.2.3
Oct 10, 2023 17:17:37.876177073 CEST	443	49714	142.250.189.13	192.168.2.3
Oct 10, 2023 17:17:37.876542091 CEST	443	49714	142.250.189.13	192.168.2.3
Oct 10, 2023 17:17:37.876741886 CEST	49714	443	192.168.2.3	142.250.189.13
Oct 10, 2023 17:17:37.877904892 CEST	49714	443	192.168.2.3	142.250.189.13
Oct 10, 2023 17:17:37.877943993 CEST	443	49714	142.250.189.13	192.168.2.3
Oct 10, 2023 17:17:40.718988895 CEST	49725	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:17:40.719027042 CEST	443	49725	142.250.72.132	192.168.2.3
Oct 10, 2023 17:17:40.719098091 CEST	49725	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:17:40.719419003 CEST	49725	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:17:40.719430923 CEST	443	49725	142.250.72.132	192.168.2.3
Oct 10, 2023 17:17:40.983138084 CEST	49681	443	192.168.2.3	20.189.173.5
Oct 10, 2023 17:17:41.092348099 CEST	443	49725	142.250.72.132	192.168.2.3
Oct 10, 2023 17:17:41.092572927 CEST	49725	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:17:41.092596054 CEST	443	49725	142.250.72.132	192.168.2.3
Oct 10, 2023 17:17:41.094141006 CEST	443	49725	142.250.72.132	192.168.2.3
Oct 10, 2023 17:17:41.094202995 CEST	49725	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:17:41.095526934 CEST	49725	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:17:41.095670938 CEST	443	49725	142.250.72.132	192.168.2.3
Oct 10, 2023 17:17:41.143683910 CEST	49725	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:17:41.143695116 CEST	443	49725	142.250.72.132	192.168.2.3
Oct 10, 2023 17:17:41.194926023 CEST	49725	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:17:42.141225100 CEST	49726	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:42.141305923 CEST	443	49726	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:42.141403913 CEST	49726	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:42.143568993 CEST	49726	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:42.143682003 CEST	443	49726	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:42.271982908 CEST	49676	443	192.168.2.3	104.98.116.138
Oct 10, 2023 17:17:42.272078037 CEST	49674	443	192.168.2.3	173.222.162.43
Oct 10, 2023 17:17:42.272078991 CEST	49675	443	192.168.2.3	104.98.116.155
Oct 10, 2023 17:17:42.272093058 CEST	49677	443	192.168.2.3	104.98.116.138
Oct 10, 2023 17:17:42.491837025 CEST	443	49726	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:42.492073059 CEST	49726	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:42.578282118 CEST	49726	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:42.578318119 CEST	443	49726	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:42.579329967 CEST	443	49726	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:42.582421064 CEST	49671	443	192.168.2.3	204.79.197.203
Oct 10, 2023 17:17:42.631777048 CEST	49726	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:42.680032969 CEST	49672	443	192.168.2.3	104.98.116.138
Oct 10, 2023 17:17:42.715204000 CEST	49726	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:42.758519888 CEST	443	49726	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:42.879664898 CEST	443	49726	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:42.879826069 CEST	443	49726	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:42.880017996 CEST	49726	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:42.925481081 CEST	49726	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:42.925481081 CEST	49726	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:42.925542116 CEST	443	49726	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:42.925575972 CEST	443	49726	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:43.188854933 CEST	49727	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:43.188949108 CEST	443	49727	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:43.189033985 CEST	49727	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:43.189483881 CEST	49727	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:43.189518929 CEST	443	49727	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:43.532569885 CEST	443	49727	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:43.532663107 CEST	49727	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:43.533900023 CEST	49727	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:43.533920050 CEST	443	49727	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:43.534327984 CEST	443	49727	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:43.535536051 CEST	49727	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:43.578449965 CEST	443	49727	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:43.855539083 CEST	443	49727	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:43.855668068 CEST	443	49727	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:43.855755091 CEST	49727	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:43.993894100 CEST	49727	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:43.993952990 CEST	443	49727	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:43.993989944 CEST	49727	443	192.168.2.3	72.247.100.147
Oct 10, 2023 17:17:43.994007111 CEST	443	49727	72.247.100.147	192.168.2.3
Oct 10, 2023 17:17:44.055250883 CEST	443	49709	104.98.116.138	192.168.2.3
Oct 10, 2023 17:17:44.055470943 CEST	49709	443	192.168.2.3	104.98.116.138
Oct 10, 2023 17:17:50.718516111 CEST	49681	443	192.168.2.3	20.189.173.5
Oct 10, 2023 17:17:51.114351988 CEST	443	49725	142.250.72.132	192.168.2.3
Oct 10, 2023 17:17:51.114522934 CEST	443	49725	142.250.72.132	192.168.2.3
Oct 10, 2023 17:17:51.114602089 CEST	49725	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:17:51.142986059 CEST	49725	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:17:51.143038034 CEST	443	49725	142.250.72.132	192.168.2.3
Oct 10, 2023 17:17:53.552397013 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:53.552478075 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:53.552577019 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:53.558793068 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:53.558868885 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:54.162679911 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:54.163064003 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:54.303025007 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:54.303138018 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:54.304110050 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:54.398780107 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:54.774041891 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:54.814527035 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:55.165992975 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:55.166054010 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:55.166071892 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:55.166214943 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:55.166270971 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:55.166291952 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:55.166316032 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:55.166316032 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:55.166316032 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:55.166353941 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:55.166393995 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:55.166393995 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:55.166397095 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:55.166414976 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:55.166416883 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:55.166477919 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:55.166492939 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:55.166534901 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:55.166534901 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:55.166549921 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:55.166599989 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:55.268587112 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:55.268649101 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:55.268701077 CEST	49729	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:17:55.268718958 CEST	443	49729	20.114.59.183	192.168.2.3
Oct 10, 2023 17:17:57.474458933 CEST	49709	443	192.168.2.3	104.98.116.138
Oct 10, 2023 17:17:57.474459887 CEST	49709	443	192.168.2.3	104.98.116.138
Oct 10, 2023 17:17:57.637595892 CEST	443	49709	104.98.116.138	192.168.2.3
Oct 10, 2023 17:17:57.637656927 CEST	443	49709	104.98.116.138	192.168.2.3
Oct 10, 2023 17:18:23.135200977 CEST	49708	80	192.168.2.3	23.64.190.239
Oct 10, 2023 17:18:23.135385990 CEST	49707	443	192.168.2.3	104.106.49.52
Oct 10, 2023 17:18:23.298537016 CEST	443	49707	104.106.49.52	192.168.2.3
Oct 10, 2023 17:18:23.298589945 CEST	443	49707	104.106.49.52	192.168.2.3
Oct 10, 2023 17:18:23.298753023 CEST	49707	443	192.168.2.3	104.106.49.52
Oct 10, 2023 17:18:23.298988104 CEST	49707	443	192.168.2.3	104.106.49.52
Oct 10, 2023 17:18:23.300307989 CEST	80	49708	23.64.190.239	192.168.2.3
Oct 10, 2023 17:18:23.300523996 CEST	49708	80	192.168.2.3	23.64.190.239
Oct 10, 2023 17:18:24.934045076 CEST	80	49710	209.197.3.8	192.168.2.3
Oct 10, 2023 17:18:24.934261084 CEST	49710	80	192.168.2.3	209.197.3.8
Oct 10, 2023 17:18:28.037172079 CEST	49711	80	192.168.2.3	192.229.211.108
Oct 10, 2023 17:18:28.037219048 CEST	49710	80	192.168.2.3	209.197.3.8
Oct 10, 2023 17:18:28.200226068 CEST	80	49711	192.229.211.108	192.168.2.3
Oct 10, 2023 17:18:28.200280905 CEST	80	49710	209.197.3.8	192.168.2.3
Oct 10, 2023 17:18:28.200436115 CEST	49711	80	192.168.2.3	192.229.211.108
Oct 10, 2023 17:18:28.200563908 CEST	49710	80	192.168.2.3	209.197.3.8
Oct 10, 2023 17:18:32.334722042 CEST	49741	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:18:32.334800959 CEST	443	49741	20.114.59.183	192.168.2.3
Oct 10, 2023 17:18:32.334883928 CEST	49741	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:18:32.337171078 CEST	49741	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:18:32.337203979 CEST	443	49741	20.114.59.183	192.168.2.3
Oct 10, 2023 17:18:32.946464062 CEST	443	49741	20.114.59.183	192.168.2.3
Oct 10, 2023 17:18:32.946724892 CEST	49741	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:18:32.967827082 CEST	49741	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:18:32.967870951 CEST	443	49741	20.114.59.183	192.168.2.3
Oct 10, 2023 17:18:32.968813896 CEST	443	49741	20.114.59.183	192.168.2.3
Oct 10, 2023 17:18:32.970060110 CEST	49741	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:18:33.014467955 CEST	443	49741	20.114.59.183	192.168.2.3
Oct 10, 2023 17:18:33.529145956 CEST	443	49741	20.114.59.183	192.168.2.3
Oct 10, 2023 17:18:33.529211044 CEST	443	49741	20.114.59.183	192.168.2.3
Oct 10, 2023 17:18:33.529256105 CEST	443	49741	20.114.59.183	192.168.2.3
Oct 10, 2023 17:18:33.529408932 CEST	49741	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:18:33.529443026 CEST	443	49741	20.114.59.183	192.168.2.3
Oct 10, 2023 17:18:33.529527903 CEST	443	49741	20.114.59.183	192.168.2.3
Oct 10, 2023 17:18:33.529664993 CEST	443	49741	20.114.59.183	192.168.2.3
Oct 10, 2023 17:18:33.529685020 CEST	49741	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:18:33.529752970 CEST	49741	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:18:33.608566046 CEST	49741	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:18:33.608608961 CEST	443	49741	20.114.59.183	192.168.2.3
Oct 10, 2023 17:18:33.608639002 CEST	49741	443	192.168.2.3	20.114.59.183
Oct 10, 2023 17:18:33.608659029 CEST	443	49741	20.114.59.183	192.168.2.3
Oct 10, 2023 17:18:40.605730057 CEST	49746	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:18:40.605811119 CEST	443	49746	142.250.72.132	192.168.2.3
Oct 10, 2023 17:18:40.606125116 CEST	49746	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:18:40.606245041 CEST	49746	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:18:40.606273890 CEST	443	49746	142.250.72.132	192.168.2.3
Oct 10, 2023 17:18:40.966028929 CEST	443	49746	142.250.72.132	192.168.2.3
Oct 10, 2023 17:18:40.966481924 CEST	49746	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:18:40.966542006 CEST	443	49746	142.250.72.132	192.168.2.3
Oct 10, 2023 17:18:40.968017101 CEST	443	49746	142.250.72.132	192.168.2.3
Oct 10, 2023 17:18:40.968270063 CEST	49746	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:18:40.968765020 CEST	49746	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:18:40.968888998 CEST	443	49746	142.250.72.132	192.168.2.3
Oct 10, 2023 17:18:41.114828110 CEST	49746	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:18:41.114886045 CEST	443	49746	142.250.72.132	192.168.2.3
Oct 10, 2023 17:18:41.224169970 CEST	49746	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:18:45.807166100 CEST	49746	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:18:45.807410955 CEST	443	49746	142.250.72.132	192.168.2.3
Oct 10, 2023 17:18:45.807524920 CEST	49746	443	192.168.2.3	142.250.72.132
Oct 10, 2023 17:19:07.360963106 CEST	49760	443	192.168.2.3	142.250.72.238
Oct 10, 2023 17:19:07.360997915 CEST	443	49760	142.250.72.238	192.168.2.3
Oct 10, 2023 17:19:07.361151934 CEST	49760	443	192.168.2.3	142.250.72.238
Oct 10, 2023 17:19:07.361394882 CEST	49760	443	192.168.2.3	142.250.72.238
Oct 10, 2023 17:19:07.361413956 CEST	443	49760	142.250.72.238	192.168.2.3
Oct 10, 2023 17:19:07.719918013 CEST	443	49760	142.250.72.238	192.168.2.3
Oct 10, 2023 17:19:07.784579992 CEST	49760	443	192.168.2.3	142.250.72.238
Oct 10, 2023 17:19:07.784596920 CEST	443	49760	142.250.72.238	192.168.2.3
Oct 10, 2023 17:19:07.785315037 CEST	443	49760	142.250.72.238	192.168.2.3
Oct 10, 2023 17:19:07.785334110 CEST	443	49760	142.250.72.238	192.168.2.3
Oct 10, 2023 17:19:07.785706997 CEST	49760	443	192.168.2.3	142.250.72.238
Oct 10, 2023 17:19:07.786335945 CEST	443	49760	142.250.72.238	192.168.2.3
Oct 10, 2023 17:19:07.786451101 CEST	49760	443	192.168.2.3	142.250.72.238
Oct 10, 2023 17:19:07.792057991 CEST	49760	443	192.168.2.3	142.250.72.238
Oct 10, 2023 17:19:07.792150974 CEST	443	49760	142.250.72.238	192.168.2.3
Oct 10, 2023 17:19:07.797271013 CEST	49760	443	192.168.2.3	142.250.72.238
Oct 10, 2023 17:19:07.797281981 CEST	443	49760	142.250.72.238	192.168.2.3
Oct 10, 2023 17:19:08.006469965 CEST	443	49760	142.250.72.238	192.168.2.3
Oct 10, 2023 17:19:08.006829023 CEST	49760	443	192.168.2.3	142.250.72.238
Oct 10, 2023 17:19:08.110722065 CEST	443	49760	142.250.72.238	192.168.2.3
Oct 10, 2023 17:19:08.111382008 CEST	443	49760	142.250.72.238	192.168.2.3
Oct 10, 2023 17:19:08.111521006 CEST	49760	443	192.168.2.3	142.250.72.238
Oct 10, 2023 17:19:08.202321053 CEST	49760	443	192.168.2.3	142.250.72.238
Oct 10, 2023 17:19:08.202359915 CEST	443	49760	142.250.72.238	192.168.2.3
Oct 10, 2023 17:19:09.937230110 CEST	49764	443	192.168.2.3	50.16.47.176
Oct 10, 2023 17:19:09.937311888 CEST	443	49764	50.16.47.176	192.168.2.3
Oct 10, 2023 17:19:09.937401056 CEST	49764	443	192.168.2.3	50.16.47.176
Oct 10, 2023 17:19:09.937849045 CEST	49764	443	192.168.2.3	50.16.47.176
Oct 10, 2023 17:19:09.937886953 CEST	443	49764	50.16.47.176	192.168.2.3
Oct 10, 2023 17:19:10.401288033 CEST	443	49764	50.16.47.176	192.168.2.3
Oct 10, 2023 17:19:10.401690006 CEST	49764	443	192.168.2.3	50.16.47.176
Oct 10, 2023 17:19:10.401748896 CEST	443	49764	50.16.47.176	192.168.2.3
Oct 10, 2023 17:19:10.402697086 CEST	443	49764	50.16.47.176	192.168.2.3
Oct 10, 2023 17:19:10.402776003 CEST	49764	443	192.168.2.3	50.16.47.176
Oct 10, 2023 17:19:10.402792931 CEST	443	49764	50.16.47.176	192.168.2.3
Oct 10, 2023 17:19:10.402848959 CEST	49764	443	192.168.2.3	50.16.47.176
Oct 10, 2023 17:19:10.403139114 CEST	49764	443	192.168.2.3	50.16.47.176
Oct 10, 2023 17:19:10.403247118 CEST	443	49764	50.16.47.176	192.168.2.3
Oct 10, 2023 17:19:10.403435946 CEST	49764	443	192.168.2.3	50.16.47.176
Oct 10, 2023 17:19:10.403462887 CEST	443	49764	50.16.47.176	192.168.2.3
Oct 10, 2023 17:19:10.512562037 CEST	49764	443	192.168.2.3	50.16.47.176
Oct 10, 2023 17:19:10.953701019 CEST	443	49764	50.16.47.176	192.168.2.3
Oct 10, 2023 17:19:10.953731060 CEST	443	49764	50.16.47.176	192.168.2.3
Oct 10, 2023 17:19:10.953738928 CEST	443	49764	50.16.47.176	192.168.2.3
Oct 10, 2023 17:19:10.953758001 CEST	443	49764	50.16.47.176	192.168.2.3
Oct 10, 2023 17:19:10.953764915 CEST	443	49764	50.16.47.176	192.168.2.3
Oct 10, 2023 17:19:10.953813076 CEST	49764	443	192.168.2.3	50.16.47.176
Oct 10, 2023 17:19:10.953830957 CEST	443	49764	50.16.47.176	192.168.2.3
Oct 10, 2023 17:19:10.953850031 CEST	49764	443	192.168.2.3	50.16.47.176
Oct 10, 2023 17:19:10.953872919 CEST	49764	443	192.168.2.3	50.16.47.176
Oct 10, 2023 17:19:10.957684994 CEST	49764	443	192.168.2.3	50.16.47.176
Oct 10, 2023 17:19:10.957722902 CEST	443	49764	50.16.47.176	192.168.2.3

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2023 17:17:36.904505014 CEST	58922	53	192.168.2.3	1.1.1.1
Oct 10, 2023 17:17:36.904802084 CEST	60521	53	192.168.2.3	1.1.1.1
Oct 10, 2023 17:17:36.905229092 CEST	49788	53	192.168.2.3	1.1.1.1
Oct 10, 2023 17:17:36.905473948 CEST	61049	53	192.168.2.3	1.1.1.1
Oct 10, 2023 17:17:37.002827883 CEST	53	59548	1.1.1.1	192.168.2.3
Oct 10, 2023 17:17:37.067998886 CEST	53	58922	1.1.1.1	192.168.2.3
Oct 10, 2023 17:17:37.068057060 CEST	53	60521	1.1.1.1	192.168.2.3
Oct 10, 2023 17:17:37.068089962 CEST	53	49788	1.1.1.1	192.168.2.3
Oct 10, 2023 17:17:37.068644047 CEST	53	61049	1.1.1.1	192.168.2.3
Oct 10, 2023 17:17:38.040384054 CEST	53	49410	1.1.1.1	192.168.2.3
Oct 10, 2023 17:17:38.457969904 CEST	50793	53	192.168.2.3	1.1.1.1
Oct 10, 2023 17:17:38.458344936 CEST	57005	53	192.168.2.3	1.1.1.1
Oct 10, 2023 17:17:39.873682976 CEST	64679	53	192.168.2.3	1.1.1.1
Oct 10, 2023 17:17:39.873939991 CEST	65435	53	192.168.2.3	1.1.1.1
Oct 10, 2023 17:17:40.554548979 CEST	63700	53	192.168.2.3	1.1.1.1
Oct 10, 2023 17:17:40.554728031 CEST	54000	53	192.168.2.3	1.1.1.1
Oct 10, 2023 17:17:40.717700958 CEST	53	54000	1.1.1.1	192.168.2.3
Oct 10, 2023 17:17:40.717777014 CEST	53	63700	1.1.1.1	192.168.2.3
Oct 10, 2023 17:17:55.374350071 CEST	53	60710	1.1.1.1	192.168.2.3
Oct 10, 2023 17:18:14.617288113 CEST	53	52760	1.1.1.1	192.168.2.3
Oct 10, 2023 17:18:35.348440886 CEST	138	138	192.168.2.3	192.168.2.255
Oct 10, 2023 17:18:36.316597939 CEST	53	53787	1.1.1.1	192.168.2.3
Oct 10, 2023 17:18:37.389231920 CEST	53	62296	1.1.1.1	192.168.2.3
Oct 10, 2023 17:19:07.193254948 CEST	56785	53	192.168.2.3	1.1.1.1
Oct 10, 2023 17:19:07.193763971 CEST	59217	53	192.168.2.3	1.1.1.1
Oct 10, 2023 17:19:07.357001066 CEST	53	56785	1.1.1.1	192.168.2.3
Oct 10, 2023 17:19:07.358377934 CEST	53	59217	1.1.1.1	192.168.2.3
Oct 10, 2023 17:19:08.501647949 CEST	53	58010	1.1.1.1	192.168.2.3

Timestamp	kBytes transferred	Direction	Data
2023-10-10 15:17:37 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2023-10-05-14; NID=511=OL3WgnA24QwPfMpspsItpZ2c_g7YXAAMilzUqiZdxG8z8Ka1c00AfG24ctRwvhPMrHVqO7oNbKVSwiOA0g2EzuMjPJIvQtOS7zZy99O8OkMoKSMKDFs-L1TjxHc_KVN5KBVb4BTfsPAzvlWsn_iACmkP3ulD50w_qpZ6JVqkr7w
2023-10-10 15:17:37 UTC	1	OUT	Data Raw: 20 Data Ascii:

Timestamp	kBytes transferred	Direction	Data
2023-10-10 15:19:10 UTC	59	IN	HTTP/1.1 200 Server: openresty Date: Tue, 10 Oct 2023 15:19:10 GMT Content-Type: application/json;charset=UTF-8 Content-Length: 11126 Connection: close x-request-id: evEjnoumYe1UJ0gNERqVpZg7RyJfj3ru vary: accept-encoding Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Authorization,Content-Type,X-Api-Key,cache-control,User-Agent,If-None-Match,x-adobe-uuid,x-adobe-uuid-type, X-Request-Id Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: x-request-id
2023-10-10 15:19:10 UTC	59	IN	Data Raw: 7b 22 73 75 72 66 61 63 65 73 22 3a 7b 22 44 43 5f 52 65 61 64 65 72 5f 52 48 50 5f 42 61 6e 6e 65 72 22 3a 7b 22 63 6f 6e 74 61 69 6e 65 72 73 22 3a 5b 7b 22 63 6f 6e 74 61 69 6e 65 72 49 64 22 3a 31 2c 22 63 6f 6e 74 61 69 6e 65 72 4c 61 62 65 6c 22 3a 22 4a 53 4f 4e 20 66 6f 72 20 52 65 61 64 65 72 20 44 43 20 52 48 50 20 42 61 6e 6e 65 72 22 2c 22 64 61 74 61 54 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 2c 22 64 61 74 61 22 3a 22 65 79 4a 6a 64 47 45 69 4f 6e 73 69 64 48 6c 77 5a 53 49 36 49 6d 4a 31 64 48 52 76 62 69 49 73 49 6e 52 6c 65 48 51 69 4f 69 4a 47 63 6d 56 6c 49 44 63 74 52 47 46 35 49 46 52 79 61 57 46 73 49 69 77 69 5a 32 39 66 64 58 4a 73 49 6a 6f 69 61 48 52 30 63 48 4d 36 4c 79 39 68 59 33 4a 76 59 6d 46 30 Data Ascii: {"surfaces":{"DC_Reader_RHP_Banner":{"containers":[{"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","dataType":"application/json","data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0

Timestamp	kBytes transferred	Direction	Data
2023-10-10 15:17:37 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-5xIuzvDDCFkFai5JOQovHQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 10 Oct 2023 15:17:37 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6126 X-Daystart: 29857 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-10 15:17:37 UTC	2	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 32 36 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 39 38 35 37 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6126" elapsed_seconds="29857"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-10-10 15:17:37 UTC	2	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-10-10 15:17:37 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-10-10 15:17:37 UTC	2	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 10 Oct 2023 15:17:37 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-r13b8edjinR1bQMqDqbIJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-10 15:17:37 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-10-10 15:17:37 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-10-10 15:17:42 UTC	4	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-10-10 15:17:42 UTC	4	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: Kestrel X-CID: 11 Cache-Control: public, max-age=79244 Date: Tue, 10 Oct 2023 15:17:42 GMT Connection: close X-CID: 2

Timestamp	kBytes transferred	Direction	Data
2023-10-10 15:17:43 UTC	5	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-10-10 15:17:43 UTC	5	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0Fz4RYwAAAACZW8dCTzveR7lI76J6Z2l5U0pDRURHRTA1MTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=79348 Date: Tue, 10 Oct 2023 15:17:43 GMT Content-Length: 55 Connection: close X-CID: 2
2023-10-10 15:17:43 UTC	5	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	kBytes transferred	Direction	Data
2023-10-10 15:17:54 UTC	5	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.3448/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.3031&MK=xA8KrWEY9XlR3xy&MD=F6k2UB4X HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-10-10 15:17:55 UTC	6	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: c27e222d-dd91-40fd-8a2a-ac2aa122bdeb MS-RequestId: b8466c72-c57a-47f1-acac-2f5d0d5922c7 MS-CV: VIVLMBvdMkyc8vYK.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 10 Oct 2023 15:17:54 GMT Connection: close Content-Length: 24490
2023-10-10 15:17:55 UTC	6	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-10-10 15:17:55 UTC	22	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	kBytes transferred	Direction	Data
2023-10-10 15:18:32 UTC	30	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.3448/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.3031&MK=xA8KrWEY9XlR3xy&MD=F6k2UB4X HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-10-10 15:18:33 UTC	30	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 243b569c-81f2-46db-a4f7-4835c6fc2c1b MS-RequestId: 0402ae5e-921b-42b6-b03f-7472d390516b MS-CV: Mo06FAmDj0eB9Zbh.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 10 Oct 2023 15:18:32 GMT Connection: close Content-Length: 25457
2023-10-10 15:18:33 UTC	31	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-10-10 15:18:33 UTC	46	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Timestamp	kBytes transferred	Direction	Data
2023-10-10 15:19:08 UTC	56	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-fsjDrAKbX1wYE8rhIujJ_Q' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Security-Policy: script-src 'report-sample' 'nonce-jmuuqXDt3m8Cct0qzVA1ig' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Type: text/plain; charset=utf-8 Content-Length: 220 Date: Tue, 10 Oct 2023 15:19:07 GMT Expires: Tue, 10 Oct 2023 15:19:07 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-10-10 15:19:08 UTC	57	IN	Data Raw: 72 6c 7a 43 31 3a 20 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 37 39 0a 72 6c 7a 43 32 3a 20 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 37 39 0a 72 6c 7a 43 37 3a 20 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 37 39 0a 64 63 63 3a 20 0a 73 65 74 5f 64 63 63 3a 20 43 31 3a 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 37 39 2c 43 32 3a 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 37 39 2c 43 37 3a 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 37 39 0a 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 2c 43 31 53 2c 43 37 53 0a 73 74 61 74 65 66 75 6c 2d 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 0a 63 72 63 33 32 3a 20 66 64 61 34 39 62 30 66 0a Data Ascii: rlzC1: 1C1ONGR_enUS1079rlzC2: 1C2ONGR_enUS1079rlzC7: 1C7ONGR_enUS1079dcc: set_dcc: C1:1C1ONGR_enUS1079,C2:1C2ONGR_enUS1079,C7:1C7ONGR_enUS1079events: C1I,C2I,C7I,C1S,C7Sstateful-events: C1I,C2I,C7Icrc32: fda49b0f

Target ID:	5
Start time:	17:17:32
Start date:	10/10/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff7c89f0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	7
Start time:	17:17:34
Start date:	10/10/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2112,i,11896617920037136445,4751922825408255977,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7c89f0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	8
Start time:	17:17:37
Start date:	10/10/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "http://img1.wsimg.com/blobby/go/e817bb84-a239-4ab7-b799-a1a28b73e3bf/downloads/vibujoxupekumig.pdf
Imagebase:	0x7ff7c89f0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	14
Start time:	17:18:55
Start date:	10/10/2023
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf
Imagebase:	0x7ff752410000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	15
Start time:	17:19:00
Start date:	10/10/2023
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff7fd640000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	16
Start time:	17:19:01
Start date:	10/10/2023
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2204 --field-trial-handle=1564,i,16990901771295455395,1012609527637628534,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff7fd640000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to elicit sensitive information and/or gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
Tactics:	Initial Access
Data Sources:	DNS records, Detonation chamber, Email gateway, Mail server, Packet capture, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://img1.wsimg.com/blobby/go/e817bb84-a239-4ab7-b799-a1a28b73e3bf/downloads/vibujoxupekumig.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b411c059-4935-4d21-9627-0ce8d9e007e9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-231010151905Z-262.bmp

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Windows Analysis Report
http://img1.wsimg.com/blobby/go/e817bb84-a239-4ab7-b799-a1a28b73e3bf/downloads/vibujoxupekumig.pdf

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre