Windows Analysis Report
URBAN CORPS.pdf

Overview

General Information

Sample name:	URBAN CORPS.pdf
Analysis ID:	1467212
MD5:	ae7cb9463b29e62eca0e9e0e03bb6fb5
SHA1:	785afd91cc7bfe3e1a8339154d602f0c66bbf9cc
SHA256:	a8cf6092efd02a772c56a3ab265844c3fb329b165ad901d1c6ffc2d52040a1e1
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

AV Detection

Antivirus detection for URL or domain

Source: https://forms.office.com/pages/responsepage.aspx?id=m-YY3RuX2UeS4svj8aYQ3DeXDZSh651OljSHQ-HNcj5UQ0c1Q1hRTEZFWFRLODJTUkRXS1pQNVU2MS4u

SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

Phishing

AI detected phishing page

Source: https://assets-usa.mkt.dynamics.com

LLM: Score: 7 brands: Microsoft Dynamics Reasons: The URL 'https://assets-usa.mkt.dynamics.com' appears suspicious due to the use of multiple subdomains ('assets-usa.mkt'). While 'dynamics.com' is a legitimate domain associated with Microsoft Dynamics, the additional subdomains could be an attempt to mislead users. The page prominently features a CAPTCHA and a button labeled 'Review Document,' which is a common tactic used in phishing to prompt user interaction. The presence of social engineering techniques, such as the CAPTCHA and the prompt to review a document, further raises suspicion. Therefore, this site is likely a phishing site. DOM: 1.3.pages.csv

Source: https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499	HTTP Parser: No favicon
Source: https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499	HTTP Parser: No favicon
Source: https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499	HTTP Parser: No favicon
Source: https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499	HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49800 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:49801 version: TLS 1.2

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60
Source: Joe Sandbox View	IP Address: 20.49.124.158 20.49.124.158
Source: Joe Sandbox View	IP Address: 52.146.76.30 52.146.76.30
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49800 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eOC3AR1WH78oNKD&MD=fbg56d3d HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499 HTTP/1.1Host: assets-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/FormLoader/FormLoader.bundle.js HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://assets-usa.mkt.dynamics.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/forms/ed6cc479-cc38-ef11-8409-7c1e520ba499 HTTP/1.1Host: assets-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: text/plainsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/FormLoader/public/locales/en-us/translation.json HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://assets-usa.mkt.dynamics.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://assets-usa.mkt.dynamics.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: assets-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/forms/ed6cc479-cc38-ef11-8409-7c1e520ba499 HTTP/1.1Host: assets-usa.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/script?fid=b105fd92-33cc-447c-b000-df58cfaf4e89&type=visual&rnd=c3b6d445-c55a-490e-a171-56d758d0beaf&mkt=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/FormLoader/public/locales/en-us/translation.json HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/Captcha/Images/icon_err.gif?vv=100 HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=b105fd92-33cc-447c-b000-df58cfaf4e89&rnd=48c46033440a4adcaad070e562fb0a2c&market=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/Captcha/Images/hig_progcircle_animated.gif?vv=100 HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/Captcha/Images/icon_err.gif?vv=100 HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/Captcha/Images/hig_progcircle_animated.gif?vv=100 HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=b105fd92-33cc-447c-b000-df58cfaf4e89&rnd=48c46033440a4adcaad070e562fb0a2c&market=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/forms/ed6cc479-cc38-ef11-8409-7c1e520ba499/visits HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eOC3AR1WH78oNKD&MD=fbg56d3d HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/script?fid=bbf60dad-072f-44d9-a6e7-e0931f50c482&type=visual&rnd=2de0e11d-da42-446f-a718-00c44672625d&mkt=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=bbf60dad-072f-44d9-a6e7-e0931f50c482&rnd=457e8b8c9dd1497ba62a5c55b5b0b82d&market=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/forms/ed6cc479-cc38-ef11-8409-7c1e520ba499/visits HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=bbf60dad-072f-44d9-a6e7-e0931f50c482&rnd=457e8b8c9dd1497ba62a5c55b5b0b82d&market=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/script?dc=EastUS&mkt=en&fid=bbf60dad-072f-44d9-a6e7-e0931f50c482&type=visual&c=1&rnd=0.5199867511130329 HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=bbf60dad-072f-44d9-a6e7-e0931f50c482&rnd=bfb5869cd5d147faa63611d80225b568&market=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=bbf60dad-072f-44d9-a6e7-e0931f50c482&rnd=bfb5869cd5d147faa63611d80225b568&market=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: forms.office.com
Source: global traffic	DNS traffic detected: DNS query: cdn.forms.office.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: lists.office.com
Source: global traffic	DNS traffic detected: DNS query: c.office.com
Source: global traffic	DNS traffic detected: DNS query: assets-usa.mkt.dynamics.com
Source: global traffic	DNS traffic detected: DNS query: public-usa.mkt.dynamics.com

Source: unknown

HTTP traffic detected: POST /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/forms/ed6cc479-cc38-ef11-8409-7c1e520ba499/visits HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-aliveContent-Length: 153sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://assets-usa.mkt.dynamics.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 19:17:23 GMTContent-Type: text/htmlContent-Length: 548Connection: closeStrict-Transport-Security: max-age=2592000; preloadx-azure-ref: 20240703T191723Z-157bfc59976pjpd267bfvppp200000000ff0000000005fuwx-fd-int-roxy-purgeid: 72378317X-Cache: TCP_MISS
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 03 Jul 2024 19:17:26 GMTContent-Length: 0Connection: closex-ms-trace-id: 3a757724eac03d86c6071ba177122c6dStrict-Transport-Security: max-age=2592000; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 03 Jul 2024 19:18:26 GMTContent-Length: 0Connection: closex-ms-trace-id: 08b06769535da11a1dffe787e15c6c7aStrict-Transport-Security: max-age=2592000; preload

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: chromecache_254.9.dr	String found in binary or memory: https://aka.ms/FormsConsumerElite.
Source: chromecache_297.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/dll-dompurify.min.bcf1a85.js.map/4ee7b161
Source: chromecache_277.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.1ds.a8079b3.js.
Source: chromecache_255.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_cover.9b66b
Source: chromecache_281.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_ext.1918055
Source: chromecache_292.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_groupnote.f
Source: chromecache_290.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_post.boot.4
Source: chromecache_301.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_saverespons
Source: chromecache_276.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.officebrowserfe
Source: chromecache_273.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.sw.a6ac500.js.m
Source: chromecache_252.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.utel.508f317.js
Source: chromecache_258.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.utel_1ds.625545
Source: chromecache_280.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.min.32c356c.js.map/0c
Source: chromecache_283.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/sw.js.map/29290e03f931b88dc228d32a0295c7a
Source: chromecache_284.9.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/forms/ed6cc47
Source: chromecache_298.9.dr	String found in binary or memory: https://cdn.forms.office.net/forms/images/pwa/forms-pwa-logo-192.png
Source: chromecache_298.9.dr	String found in binary or memory: https://cdn.forms.office.net/forms/images/pwa/forms-pwa-logo-256.png
Source: chromecache_298.9.dr	String found in binary or memory: https://cdn.forms.office.net/forms/images/pwa/forms-pwa-logo-512.png
Source: chromecache_284.9.dr	String found in binary or memory: https://cxppusa1formui01cdnsa01-endpoint.azureedge.net/usa/FormLoader/FormLoader.bundle.js
Source: chromecache_268.9.dr, chromecache_300.9.dr	String found in binary or memory: https://doni2.r.ag.d.sendibm3.com/mk/cl/f/sh/OycZvHuFo1eQtVYsQwMXO2o3/Y3fF0MGRoEKk
Source: URBAN CORPS.pdf	String found in binary or memory: https://forms.office.com/r/4i3EYM0R1S)
Source: chromecache_284.9.dr	String found in binary or memory: https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpagefo
Source: URBAN CORPS.pdf	String found in binary or memory: https://urldefense.com/v3/__http:/www.urbancorpscharter.com/__;
Source: URBAN CORPS.pdf	String found in binary or memory: https://urldefense.com/v3/__http:/www.urbancorpssd.org/__;
Source: URBAN CORPS.pdf	String found in binary or memory: https://urldefense.com/v3/__http:/www.urbancorpssd.org/index.html__;

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:49801 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.winPDF@42/137@36/6

Source: URBAN CORPS.pdf	Initial sample: https://urldefense.com/v3/__http:/www.urbancorpssd.org/index.html__;!!e_4xu6-vwmwk-q!smymy4aqrbnmri2yfq3eb2yn77t90x16dffzyk-8owpndxasgjfvxq2lwin0zq6hoqcn46qjc81xcljfeqpz-gaugmvw$
Source: URBAN CORPS.pdf	Initial sample: https://urldefense.com/v3/__http:/www.urbancorpssd.org/__;!!E_4xU6-vwMWK-Q!smYMY4aqRbNMRI2yFQ3Eb2yN77T90x16dFfzyK-8OwPNDXAsGjFVxQ2lwIN0ZQ6hoQcN46QjC81xclJfEQpZ-ubQ6WrD$
Source: URBAN CORPS.pdf	Initial sample: https://urldefense.com/v3/__http:/www.urbancorpssd.org/index.html__;!!E_4xU6-vwMWK-Q!smYMY4aqRbNMRI2yFQ3Eb2yN77T90x16dFfzyK-8OwPNDXAsGjFVxQ2lwIN0ZQ6hoQcN46QjC81xclJfEQpZ-gAUgMvw$
Source: URBAN CORPS.pdf	Initial sample: https://forms.office.com/r/4i3eym0r1s
Source: URBAN CORPS.pdf	Initial sample: mailto:kfreeland@urbancorps.com
Source: URBAN CORPS.pdf	Initial sample: https://forms.office.com/r/4i3EYM0R1S
Source: URBAN CORPS.pdf	Initial sample: https://urldefense.com/v3/__http:/www.urbancorpssd.org/__;!!e_4xu6-vwmwk-q!smymy4aqrbnmri2yfq3eb2yn77t90x16dffzyk-8owpndxasgjfvxq2lwin0zq6hoqcn46qjc81xcljfeqpz-ubq6wrd$
Source: URBAN CORPS.pdf	Initial sample: https://urldefense.com/v3/__http:/www.urbancorpscharter.com/__;!!e_4xu6-vwmwk-q!smymy4aqrbnmri2yfq3eb2yn77t90x16dffzyk-8owpndxasgjfvxq2lwin0zq6hoqcn46qjc81xcljfeqpz-tqkcyxn$
Source: URBAN CORPS.pdf	Initial sample: https://urldefense.com/v3/__http:/www.urbancorpscharter.com/__;!!E_4xU6-vwMWK-Q!smYMY4aqRbNMRI2yFQ3Eb2yN77T90x16dFfzyK-8OwPNDXAsGjFVxQ2lwIN0ZQ6hoQcN46QjC81xclJfEQpZ-tQKCyxN$

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 15-16-43-460.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\URBAN CORPS.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1740,i,16772849399050595403,9305864139534860805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://forms.office.com/r/4i3EYM0R1S"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1988,i,14556554370102153334,10441946139869340800,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1740,i,16772849399050595403,9305864139534860805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1988,i,14556554370102153334,10441946139869340800,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: URBAN CORPS.pdf	Initial sample: PDF keyword /JS count = 0
Source: URBAN CORPS.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A918q8in7_ninilq_3g0.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A918q8in7_ninilq_3g0.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: URBAN CORPS.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: URBAN CORPS.pdf

Initial sample: PDF keyword obj count = 60

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.49.124.158	prdia888wus0aks.mkt.dynamics.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.146.76.30	prdia888eus0aks.mkt.dynamics.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

Contacted Domains

Name	IP	Active
s-part-0014.t-0009.t-msedge.net	13.107.246.42	true
bg.microsoft.map.fastly.net	199.232.214.172	true
www.google.com	142.250.186.164	true
prdia888eus0aks.mkt.dynamics.com	52.146.76.30	true
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true
prdia888wus0aks.mkt.dynamics.com	20.49.124.158	true
public-usa.mkt.dynamics.com	unknown	unknown
forms.office.com	unknown	unknown
assets-usa.mkt.dynamics.com	unknown	unknown
c.office.com	unknown	unknown
cdn.forms.office.net	unknown	unknown
lists.office.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/forms/ed6cc479-cc38-ef11-8409-7c1e520ba499/visits	false	Avira URL Cloud: safe	unknown
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/script?fid=b105fd92-33cc-447c-b000-df58cfaf4e89&type=visual&rnd=c3b6d445-c55a-490e-a171-56d758d0beaf&mkt=en	false	Avira URL Cloud: safe	unknown
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=b105fd92-33cc-447c-b000-df58cfaf4e89&rnd=48c46033440a4adcaad070e562fb0a2c&market=en	false	Avira URL Cloud: safe	unknown
https://assets-usa.mkt.dynamics.com/favicon.ico	true	Avira URL Cloud: safe	unknown
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/script?dc=EastUS&mkt=en&fid=bbf60dad-072f-44d9-a6e7-e0931f50c482&type=visual&c=1&rnd=0.5199867511130329	false	Avira URL Cloud: safe	unknown
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/forms/ed6cc479-cc38-ef11-8409-7c1e520ba499	false	Avira URL Cloud: safe	unknown
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=bbf60dad-072f-44d9-a6e7-e0931f50c482&rnd=457e8b8c9dd1497ba62a5c55b5b0b82d&market=en	false	Avira URL Cloud: safe	unknown
https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499	true		unknown
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=bbf60dad-072f-44d9-a6e7-e0931f50c482&rnd=bfb5869cd5d147faa63611d80225b568&market=en	false	Avira URL Cloud: safe	unknown
https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/forms/ed6cc479-cc38-ef11-8409-7c1e520ba499	true	Avira URL Cloud: safe	unknown
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/script?fid=bbf60dad-072f-44d9-a6e7-e0931f50c482&type=visual&rnd=2de0e11d-da42-446f-a718-00c44672625d&mkt=en	false	Avira URL Cloud: safe	unknown
https://forms.office.com/pages/responsepage.aspx?id=m-YY3RuX2UeS4svj8aYQ3DeXDZSh651OljSHQ-HNcj5UQ0c1Q1hRTEZFWFRLODJTUkRXS1pQNVU2MS4u	true	SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	FC994460537DB6163649FA837207A91B	C608092096CE5D6102CDC7338210676AA634C186	85971453DCFED238A105078F29C3C6BC8CB2A78470C8D5DF47E4293E2C2C89A3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	FC994460537DB6163649FA837207A91B	C608092096CE5D6102CDC7338210676AA634C186	85971453DCFED238A105078F29C3C6BC8CB2A78470C8D5DF47E4293E2C2C89A3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	84816A86D852C544988021C250B90B52	7D0C9150A9DF58716357ABC4FB73F89D1A920655	370E21B30BF230C1C2B2F3D790DE16146E86708491E74217BF412061E92ACC1A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	84816A86D852C544988021C250B90B52	7D0C9150A9DF58716357ABC4FB73F89D1A920655	370E21B30BF230C1C2B2F3D790DE16146E86708491E74217BF412061E92ACC1A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	5D01E8C65DE4074F26A4405BCF62617F	7B840E03DE9C9EBDF08AAE9AA092B63E7A18E5CC	E90F4F66B4B81BC434F55F0173E8EABC9848988C66F9C02F7123B2428CCAB5B9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ea986e22-4085-4271-b273-72c08f55dec0.tmp	JSON data	5D01E8C65DE4074F26A4405BCF62617F	7B840E03DE9C9EBDF08AAE9AA092B63E7A18E5CC	E90F4F66B4B81BC434F55F0173E8EABC9848988C66F9C02F7123B2428CCAB5B9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	A18BF94EE16832DB06B05BF873C4A522	7D4428B400794F02ACE90381F6834BA3A2D1381F	15DBFB07A6C69DD3CBAA55BD42B19B20DEF1CBCD6E599475012D6665737710D8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	A40BA86F2283452C39102521B7893947	56168EA7D7FA54BF7F3BE58A4E2013E2F1206300	9F96A52C07040332985F07BFF5EB13E1CB726C278DFF363C50DC98B524A64BB2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	A40BA86F2283452C39102521B7893947	56168EA7D7FA54BF7F3BE58A4E2013E2F1206300	9F96A52C07040332985F07BFF5EB13E1CB726C278DFF363C50DC98B524A64BB2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240703191645Z-157.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	3AA0A0D807C2E242DE2464222CB7B93A	E954AD7F403083ACDD779FC3729B776FF3DCDB8D	CDA3F48E57C25D970A5B0122619618F60D9CA237F6993BD056EF301372C477B7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	2981CADB643F41296141BA61D60CA0C2	138876575E583EBCF6C2F199A9B446D73FEC9046	B1BDB3E4A35B316EC645322B18DBC83FC71B930385BCAA149C0C7826F12BDD3E
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	A0E0EBF11F8AD5CCBB8199DBD76A13FA	2198914F072E87984E5A025C5942E27CED555B4E	D4D2C3F0E7E6D1C16A090A078E773040D9E9AA0DD008CE5D4636B4DAF0E81CC5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	87EDBEE38F56C20298F25D5D3D4D1B5C	7F904E9615AC3186A87472EF366DD8202855B0B7	A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	1A9D081E8618E9B1CEEE2666B21F192E	DFDC2B5A1B9DA7ECFA490A948F67E2E9ED196679	3F4BEFA191CFE98A6D1E7C8B7AB45CD12C0BB1C6B890602890A52EC8CAE78E1C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	FD7A778A86030C799A66827D582698FF	FC4F90D68D542CF8C7C9F841D57251836E65F3EF	3CD1C7A8864FA6F350C45BC9ACFA7619DEC7895041B01256656F7A7A1B170C27
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	4565793C4ABAB0E977F1FD43EEC43430	3836D3CEF897B87E365ED195E89FDE8A97CB20C5	D50B8086A664F941FD980D6F991BAE950F2184D946BFF30E164C64D4A219726D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	78581D92251A2590BF0518AB09B79D31	7A8CCEF0290773615BA5F967A86D71851E5D3713	2E1485E558DB1451EC30DE637B2B82EA4E1A1554363AF3F7DB91803958C08CA1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	639989E0620A5A422B0B25263EED5F4B	111FD930400F31E480B00A231D9A0585219501CB	2C6DA9FD0D6B1C714C276338E72048399CDB03E0ACA020CB5B2C796186C17879
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	FDAEED65F7847F14D2A6B09B5ADB3CB4	AEDCB4F8461BC9BCE9FDA110D9C10A53EC180E20	5B42A493CBB831505BF41D66FEADD6C764A7784E2C62BFA8ADB05DAF03155C9B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	D9998594E787F9F026CF98074C5D8BB0	563B11DAFDE97A722385DDCC3E5484B926785345	121CF8634043389174B18C6373B5D9C28DC4AAF50E517687F6027B015FA8D78A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	0EA7F8E45A6531B5FCE69DF9ECA5B776	CAEB16F97F59B93F228BAE7BEFFB07EB79F82B00	5CA490A9E8AA2C22FB357662D64092B71F9F5F701874276A0939921366AFD189
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	B6D7A53FA4242485FD7B486353634F52	A88620E0082BC91803D7614017C9C30B40950637	244EDA44131AED75A152FA86AF13441D09AA8BE42AB5382837159B044BF62337
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	48E7BD7D39720B720B3634A5388074D7	6A6624BE5B871D4E9C884204086D8A13B324C8EE	7BC424CD9A43A6C848D25F67F696A298992BFDF2C1F248C1C93772510C44FB30
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	F08DF20414EB546C61B56E4C2B584FBF	B95CAF63612F747023DEE8E6713B0678261C7AD8	A6636498A2539B256F3EF5ECEAB8CCDEDA4572D71C1D340552A91DB22B85DCE9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	CA3083C484692EB4334681CB90F3A59B	792EE707B2B3EE69D86259E1A2E7D0C8FF4A5C6A	CF5B86C9F68248D46BB31B6F52B4A706A2DA3B0B8B3DAE13B58F772E1F7C9E11
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	69EFED5B494EA6E1E21B6B1479448EF4	44847B32E1B3719BF26F3D9C508755D5E59C0202	35536CDD5D86489E013A99B754125D0C41A51F78C5FC4B52C7C786A926BB83DF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	9BBFAF868B12A5D75008B1752F5A6215	3439C10FAE1D8DB413A896807C155A0781E12E84	E7EA9ADB794692CEF3CCE3473F186003BD96ADD57BD611A523257D70E01648D9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	264601B2BB2C82332C3D9B14ED993A95	F702C3F82CC873027D577E5D96CD0D4DDE4347C7	E04E13514EB8A1AC3E9B31553866D4E8E63F93B22DFD38D6B25DEFCE9939364D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	FCF8C25F27C9427E915D3F8A137A2AA5	0CE9EE52B7513E4DF1AF98BEAC71FAD32FA6C5F2	4B71FDBBA2B8DBF94210E8D13749911FD46A8B5B3AA694F2717C39E7C496B258
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	C3ED7C28C1871E12C9BA7C61F73D50BC	DF82AD6FCC305AD32F8D4B5810D41231D53F29F7	DE85EE41E9FC8D5728FBA54B00DE4D9ED69BB127858FB0A475FFC81C9C8CAE11
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	3E08477A4824DB0CAAF70B394F00E08F	D877866F75169FA5D6CCBB787C03753679A57456	5269BB2AC5BE593DA02E65BA32A06D9A7BE6B64E60FC98571F6A4DD7F789F33E
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	06DF64B5EA9C6FEC95EB3EC7105D519C	1EDF8A40A00909117406AB3EC290D79CCBE9D146	52BBFFC957D648CDC841DC49DC31E7200021F10E0BA94A464D799675E45C407B
C:\Users\user\AppData\Local\Temp\MSI71eea.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	62EFE7D855050520A0F78D6BEF8887C2	8D64826AA731946E28F2626F187B6B6A0E77389E	7A02D8D9107100EF69B565DD696E54FE71577F76F7AE02AF16F8E43A6FAD548D
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A918q8in7_ninilq_3g0.tmp	PDF document, version 1.6, 0 pages	ADAD67338AEEEFA032514A9896586695	7D2EA9E531AD598CFD3F51A113B0F835872750C3	FB68668147BE9A45A7A3EABAB4CE6147DF20EA1394DC96F81E8BC780B20E2AD4
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 15-16-43-460.log	ASCII text, with very long lines (393)	1336667A75083BF81E2632FABAA88B67	46E40800B27D95DAED0DBB830E0D0BA85C031D40	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (392), with CRLF line terminators	39952F98933CE765E120753C44FA1185	CF2EB79FA8EBA791561003B66E59F8A5B7F0629D	2F5718A96D3A60007D385916600F2C9412560A3DC84A221B890CA2F3861D6013
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	96495C72ED37C6851DAE8E144F908A73	A03D0C378EA1A70771E46324CFC699D386F9726D	0D0D756EEDF0F7901ECBBE819535A0EACB4FD9B0CD196FD26F5A4FC57B5DADFB
C:\Users\user\AppData\Local\Temp\acrocef_low\379a2e62-3256-4fc6-a26b-5bb1eeedaafa.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\38ee6027-ee42-4ae8-af0a-4eeb0c036a51.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	22B260CB8C51C0D68C6550E4B061E25A	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
C:\Users\user\AppData\Local\Temp\acrocef_low\58c66d0b-0be7-4612-9afe-0bf3954343dc.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837	96E2EE6506759519A5E3E5E550F28388	477522A699526F3EC2270AD0B3D3B8D6609F8BBB	D135FEF8231B87D1F758B3D31FC5467BC933321F7E8EACB316F933DBA36474D5
C:\Users\user\AppData\Local\Temp\acrocef_low\a101ce50-11dd-4fcb-8220-fbd8ab7ef473.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 18:17:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E80962F6E968830C3D1FB3A314A5D88B	40589DF39DF5864FBEE34DECDA10D7F48787E1A6	2B9B7FBB0E536EE307F64A0037A0D21734BAA027E0487005044D73EE8551F22A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 18:17:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1C41F9ECDB315E496CC75593E22DD091	9016D1DE0695D9F29463A6DADDEC87AC53507216	39E48512FAB17A4E9C91D4A1E0646F899393AE19AFD1C59A7998A73155E1A360
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	FE26B791C426E06B0999EF715BF77B23	CA0AE2ED972E7D65861ECF8A286A756469BE1A6A	26DBC857EEEF32C846386EA1B794062D379F437BBD955FC52E22F10CE20BA6CF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 18:17:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	297E8E7E9983A78DEBCA075D7676C250	AE1CC2DA58CB1DFF43574AB7D654D54081730A9C	2EC0AAF22FACCF85300720E07CCFD12F722AC3BCE9AB8EBF395E1A3A17D7E496
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 18:17:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	2E54E260E177B99E45206C7EB58BB57E	C1EEA7A5182DBEE531DACBCB888723DAD82B96E9	9EC845BDAE71BDB93166BE4FE573B519848B8DE1B9951DDBE09A3AF90767C193
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 18:17:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	0BA194A9BDE743FC50FA073D07A8AEB3	A4BA92948581A678736DCEA7A0A6F941A58DF341	A3C2C6659972964F5D2B8D47C4C7AF591EF163D3F2CF68F45D7B3FAAC7ED2D36
Chrome Cache Entry: 252	ASCII text, with very long lines (35861)	2E0A5366524D9DADF705A10837C5DE13	374F79CE5A27CF1A54F69BAB7F082E18B9C223CC	F2C85AF65952BDE6EABBE92BC9B40D3C17B6B2CC06A9F368AB06434F97A660A8
Chrome Cache Entry: 253	PNG image data, 206 x 58, 8-bit/color RGBA, non-interlaced	FEFA2B103737887F3ED6FDE7E449E499	F3E0CDDE45D6FD735E3ED6CC961221C360D21A6B	D514AA1BF3E028EF40CB35BB0879CD2560427F7522F2C6C66B3D6AD33C1DB0E8
Chrome Cache Entry: 254	Unicode text, UTF-8 text, with very long lines (36828), with no line terminators	990801662534EE1721B5E13CBCE22204	FACFC3E0BCE8E3D852182ECC04B09C65B1A76107	F8C726307112A55E1B8FF867A36FBCFB3B1B2AB1CC9D3FEEECEDD17773099624
Chrome Cache Entry: 255	ASCII text, with very long lines (65536), with no line terminators	5E1393F1D8E2D999381C350E48B84E8D	3DFB10E14F6DAABB3A2E4C8A4263826DF86B587E	49028E4782067D8002FD116DBC201033C2B111F4D34FF317630374EE5C70CE6F
Chrome Cache Entry: 256	SVG Scalable Vector Graphics image	DF1CD3F2DAAEE5F629C10FBC609CAC35	7C4EADD1001AFA795442C3CA06B645CFC4831BC8	C04BC4EE3D822B90BA1A8562DF69FC44E199E8E36D2FDAD3F3787FCF9C5163DD
Chrome Cache Entry: 257	PNG image data, 490 x 180, 8-bit/color RGBA, non-interlaced	311274C8C9C66E894F5AFA51FACD72CD	386D1FA0B2924DF2C21545CF2FF1DDE2CD985D33	BC3C029408DAB6B5CB676B990B2E21BDD474E4B2E45DAF87E70210539390BF49
Chrome Cache Entry: 258	ASCII text, with very long lines (34041)	69B53C08ACFD81CB8659BB5193E96BBA	439AE06C71C6CE8C01AF6599E3F7CEB7C96900CF	78537CEE7626C092BBB0ABE5749C3D07FC0C03FDDB3ECF770EBFDA6EAE395BD6
Chrome Cache Entry: 259	JSON data	8D30025E69BC896ACC2064D1791F5A88	1F14560FD3D30F0A2C291CE503CCB490C94E0C3E	769442A29597F6DB303853931D749780EF46D2855412843431DAC07A9D72CCB0
Chrome Cache Entry: 260	ASCII text, with no line terminators	C79ACB86AFB721AC49A511937F416F7A	08A998839C183DEBD73B820BF4DFE3D32523488B	F7A08A0606E5A0C0657ED109900A6C2F29807852FB9EEB1EF582B007A72F4711
Chrome Cache Entry: 261	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 216x96, components 3	ACAD113FB1986EE9A02C1AA64EC5BAE6	DF2BF56ED38DBFDBF4F371485561EF773D9CBD0B	75329C904364D41E578EF5CA6227B201429343D63100CBADB54BF236C6520961
Chrome Cache Entry: 262	ASCII text, with very long lines (23130), with no line terminators	95C44936028D789DAF396F121565D63F	0DBE534E84555F92EECBFE75BFE4DC43E570C4CB	BC505727B22AAB0EE031D6FA43D5A0DF29220C350CCE23775863FC2648D3B52B
Chrome Cache Entry: 263	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	9425D8E9313A692BB3F022E8055FAB82	EDDCF3EA767D4C3042D01AC88594D7E795D8615C	F2A1ABCF12EBD0F329E5B66B811B0BD76C8E954CB283CE3B61E72FBF459EF6F1
Chrome Cache Entry: 264	GIF image data, version 89a, 20 x 20	563A41948AA94C4FF6D5E918D846C488	803C01DE983417650B6780269699191D5AC73357	20765C1AA45654ABA95D64A80B64434ED8F8FFBD77371E660291A7FB6AAEFB7A
Chrome Cache Entry: 265	ASCII text, with very long lines (23130), with no line terminators	10A12385BCC4132E01EA03BCEFAB021C	E9BF7FD17737A38FA7641EAFF7ABB85853AE9AD1	F2728B3945FF02DF1BBE21472927D65C3E7B8573ED930D34A8B9F1A49E059274
Chrome Cache Entry: 266	HTML document, ASCII text, with very long lines (5844), with CRLF line terminators	56F9CD8A07135E776326431C8560F8F2	FCFF27C475A9FB014661B045B59C8BB4799A0392	0E1D105D6EE902B7279AEFD9E8AF21AB3E5D0CF058332A2A0E53A351524C75E6
Chrome Cache Entry: 267	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 216x96, components 3	055839615F10371686A6416EEF493B1D	0C83A80C720CAC3F75C614ABF9D6DF2DBDC24283	5DDFCD4BF4F95132BDA3C3C42A3D4A75B38F7F373C5FA7C2E78DB22050213117
Chrome Cache Entry: 268	HTML document, ASCII text, with very long lines (20912)	FE0FDF3F5E52AB00FE9768809883DA4B	3322AA15DF09583A690DA1AD69D9DBAD7E6B13A2	00A51DD7ED6F71E0FB2BEDAE92C429D5CA27E2708AC44B229950CE89DF98C8AE
Chrome Cache Entry: 269	PNG image data, 192 x 192, 8-bit colormap, non-interlaced	4150A5D4F2B0284A9E62D247929DD2AA	97CA2D9ECE8F0855B2A93E6BFDFC4883685C51CB	F058653DCBA7E8B00D4BDB9409E06817F098AB18125CE5A5821520F04030D176
Chrome Cache Entry: 270	HTML document, ASCII text, with CRLF line terminators	370E16C3B7DBA286CFF055F93B9A94D8	65F3537C3C798F7DA146C55AEF536F7B5D0CB943	D465172175D35D493FB1633E237700022BD849FA123164790B168B8318ACB090
Chrome Cache Entry: 271	PNG image data, 192 x 192, 8-bit colormap, non-interlaced	4150A5D4F2B0284A9E62D247929DD2AA	97CA2D9ECE8F0855B2A93E6BFDFC4883685C51CB	F058653DCBA7E8B00D4BDB9409E06817F098AB18125CE5A5821520F04030D176
Chrome Cache Entry: 272	JSON data	8D30025E69BC896ACC2064D1791F5A88	1F14560FD3D30F0A2C291CE503CCB490C94E0C3E	769442A29597F6DB303853931D749780EF46D2855412843431DAC07A9D72CCB0
Chrome Cache Entry: 273	ASCII text, with very long lines (917)	436A7BC82156A644ED0206BFBC3A67BD	189C49265A47CBD4DDA7D86E785C9E9970C41F7E	5E18809EF5C2DFEB8B35CB5CD230ED8C64CD04A564090761F24E5FB8F628C6CA
Chrome Cache Entry: 274	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 216x96, components 3	18A03EB67AC67B96BDB599F3C631B6EE	BB35B2639261C8A2D08AE4DF5D07915791AF159A	764402E63A011E381D14AB813CA7EF305B9827108158ED1588317B41DF2C6610
Chrome Cache Entry: 275	GIF image data, version 89a, 16 x 16	4A4AC4A62EA5F3E19022F354AE737B0A	EF7FBABD1745A73D05650CC76643980AC496B323	97AADED71C0575ACE10FABD282FBA4CFA72352C70349D86FB5F2F297A84834B1
Chrome Cache Entry: 276	ASCII text, with very long lines (65381)	672B4F23E0AD4EEA01AE3CCD3929BCD3	954D395D2572BE93E9756BD1F3DEE7C7A726CFCC	D9ED2DCE9869EA81DA750F4BD6FD0011DDABB61F35C54AC8B9C871F590438124
Chrome Cache Entry: 277	Java source, ASCII text, with very long lines (17610)	07B98765F2550D83EEAEF5CB36A2E6A1	4F5CB9D05789079FA605E58546015C8A6969FFA6	E86B0BF07871186DD32B20C7B4FD8E8729C717EABE73763847BE9CB091D348F7
Chrome Cache Entry: 278	JSON data	0F6125D6420BBC10484A54641DEE8D6E	A5B587218C1D3CEF411C1F658E8C28C351F15D2A	08C73971B4D4EBDC4818AAFE4A8BA3D864E1C7EF6E5C41AF0D1FC36A4D703A78
Chrome Cache Entry: 279	ASCII text, with very long lines (23130), with no line terminators	D21208938AFFFC832741D24C74CB2FA4	81753B54582F109CDAAF5E6E77A4DC569EFE36E0	B40173196EEC75669B82EB2DCF28FF5F8C347C81716DD4CA1DA14A02D68C39FB
Chrome Cache Entry: 280	ASCII text, with very long lines (38720)	908089000E55B48012AB0E475B7771D9	07D305BF20FA5E7B6C6139D8B9C5C8FFD420746B	1F35D8332F429059754FC9AE3A9BE14A47EDA039EB4DD8871E7C39B627752375
Chrome Cache Entry: 281	Unicode text, UTF-8 text, with very long lines (64406), with no line terminators	6BB00815891EE192ACBA9D800DADF77D	E3B8D03955DA6BB85A9F83D9C60E52F0336AB27F	496C86EAA4F4950D7935A105D98A06723D46F3C0FAA0B2F1B104792140E4AF93
Chrome Cache Entry: 282	JSON data	0F6125D6420BBC10484A54641DEE8D6E	A5B587218C1D3CEF411C1F658E8C28C351F15D2A	08C73971B4D4EBDC4818AAFE4A8BA3D864E1C7EF6E5C41AF0D1FC36A4D703A78
Chrome Cache Entry: 283	ASCII text, with very long lines (43631)	72BC74DBD7E2D7EC8098628569C7C8D1	CF83D74066EF9F807DB72B7985522E44A9DBE68E	6DD99733E4AF8728ABF32904C57D8B884D75D3424011EC2C9AA255D942A8BFF6
Chrome Cache Entry: 284	HTML document, ASCII text	B4AFEF5020940379C6501CCF9B08719A	1F9FE8FA1F2F02B5DCC40756F41E3AF509DF6115	332D29A9B8A67F7B455765DE9A53A99C2EF0BE9CA2DB36D3BD941400FB7BD9F9
Chrome Cache Entry: 285	JSON data	9E576E34B18E986347909C29AE6A82C6	532C767978DC2B55854B3CA2D2DF5B4DB221C934	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
Chrome Cache Entry: 286	GIF image data, version 89a, 20 x 20	563A41948AA94C4FF6D5E918D846C488	803C01DE983417650B6780269699191D5AC73357	20765C1AA45654ABA95D64A80B64434ED8F8FFBD77371E660291A7FB6AAEFB7A
Chrome Cache Entry: 287	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	9425D8E9313A692BB3F022E8055FAB82	EDDCF3EA767D4C3042D01AC88594D7E795D8615C	F2A1ABCF12EBD0F329E5B66B811B0BD76C8E954CB283CE3B61E72FBF459EF6F1
Chrome Cache Entry: 288	JSON data	9E576E34B18E986347909C29AE6A82C6	532C767978DC2B55854B3CA2D2DF5B4DB221C934	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
Chrome Cache Entry: 289	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 216x96, components 3	5FD66948E58DDBD23D04F45DB94A52FE	D5A5B202CA22144D85530A264E4D557B1E899C71	901322389631CB994D2CF862985C1C54EC9D516B804422A36FAF1EBBF02BC717
Chrome Cache Entry: 290	ASCII text, with very long lines (15444)	7C8A1F58ECF768F500C9A7C390480410	7E51AC97662B68A3DED9A36FD012BD8A0EEFB2AB	ED6CB71AC205AA299C61293A1090825B437F985FC2500F152C34D5E869F7F200
Chrome Cache Entry: 291	PNG image data, 490 x 180, 8-bit/color RGBA, non-interlaced	311274C8C9C66E894F5AFA51FACD72CD	386D1FA0B2924DF2C21545CF2FF1DDE2CD985D33	BC3C029408DAB6B5CB676B990B2E21BDD474E4B2E45DAF87E70210539390BF49
Chrome Cache Entry: 292	ASCII text, with very long lines (4357)	2951C1ABC1AACF76A3C41D188D03D5DE	1904DC8FF6AB1701C6C07C481C0F8B1627CBE159	7FC8882A07B8AB721E55531EE407AD28735A55A123ADB4520CCAD1AFBC4BCB6A
Chrome Cache Entry: 293	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 216x96, components 3	08F1F7C59CA2C9734F2F762F16852C07	881007CA8C946883D19A5AC247B8DE73578FEF61	63757A566DF61A4E622F9D08B05E85152A592AEE37770B45C898FA2443366F93
Chrome Cache Entry: 294	GIF image data, version 89a, 16 x 16	4A4AC4A62EA5F3E19022F354AE737B0A	EF7FBABD1745A73D05650CC76643980AC496B323	97AADED71C0575ACE10FABD282FBA4CFA72352C70349D86FB5F2F297A84834B1
Chrome Cache Entry: 295	PNG image data, 206 x 58, 8-bit/color RGBA, non-interlaced	FEFA2B103737887F3ED6FDE7E449E499	F3E0CDDE45D6FD735E3ED6CC961221C360D21A6B	D514AA1BF3E028EF40CB35BB0879CD2560427F7522F2C6C66B3D6AD33C1DB0E8
Chrome Cache Entry: 296	ASCII text, with very long lines (65461)	545A1BBC31581E3D1B1EB383DD3E9B98	09249350A3B3EA2665724E0A789096BBA27E0E16	C3D9901D45BE8548749013D46A5FD17A564495A52DF6E265668E0D2401915165
Chrome Cache Entry: 297	ASCII text, with very long lines (16094)	F85DF0DB3B351E61F18DD9CA98A3C999	055AB43C220151E0C8B521A39D40DC54C50F988D	5BEA34A1B8999FB53F5B3B8541BE6A2C6F8C75A8932BCB7A05E3FD5B91D78608
Chrome Cache Entry: 298	JSON data	4D945878F36DCBBF35C41B5BB6E5513E	786EDE7740452B1C38B1FFA47C28F4E70140EC5F	19DADB739E9886DBDDC79E9E916B753AC53A2C8C1A9560EF14AF28B400C234E0
Chrome Cache Entry: 299	SVG Scalable Vector Graphics image	DF1CD3F2DAAEE5F629C10FBC609CAC35	7C4EADD1001AFA795442C3CA06B645CFC4831BC8	C04BC4EE3D822B90BA1A8562DF69FC44E199E8E36D2FDAD3F3787FCF9C5163DD
Chrome Cache Entry: 300	HTML document, ASCII text, with very long lines (20912)	FE0FDF3F5E52AB00FE9768809883DA4B	3322AA15DF09583A690DA1AD69D9DBAD7E6B13A2	00A51DD7ED6F71E0FB2BEDAE92C429D5CA27E2708AC44B229950CE89DF98C8AE
Chrome Cache Entry: 301	ASCII text, with very long lines (32830)	A37D839AC70099E3BFFF93C7AB5C0389	9D5BF9F441C13C5016A0E53ABCF12AF3549AE0A3	7F3B08D7908F9E4F36F7DE5ACA9DB5AADCD3098F0C7E081DCB96255C830B1B02
Chrome Cache Entry: 302	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 216x96, components 3	2B3AB61E12FB447D62493755A5B4C10C	9B2768B90D9A425DCBDD738B272D7AD4286DD4A4	B8F0F51F80EF711C18D7109529A138E754E17D3AAEDC78FDF0B7F01F43A85E13

AV Detection

Antivirus detection for URL or domain

Source: https://forms.office.com/pages/responsepage.aspx?id=m-YY3RuX2UeS4svj8aYQ3DeXDZSh651OljSHQ-HNcj5UQ0c1Q1hRTEZFWFRLODJTUkRXS1pQNVU2MS4u

SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

Phishing

AI detected phishing page

Source: https://assets-usa.mkt.dynamics.com

Source: https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499	HTTP Parser: No favicon
Source: https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499	HTTP Parser: No favicon
Source: https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499	HTTP Parser: No favicon
Source: https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499	HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49800 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:49801 version: TLS 1.2

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60
Source: Joe Sandbox View	IP Address: 20.49.124.158 20.49.124.158
Source: Joe Sandbox View	IP Address: 52.146.76.30 52.146.76.30
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49800 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eOC3AR1WH78oNKD&MD=fbg56d3d HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499 HTTP/1.1Host: assets-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/FormLoader/FormLoader.bundle.js HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://assets-usa.mkt.dynamics.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/forms/ed6cc479-cc38-ef11-8409-7c1e520ba499 HTTP/1.1Host: assets-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: text/plainsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/FormLoader/public/locales/en-us/translation.json HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://assets-usa.mkt.dynamics.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://assets-usa.mkt.dynamics.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: assets-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/forms/ed6cc479-cc38-ef11-8409-7c1e520ba499 HTTP/1.1Host: assets-usa.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/script?fid=b105fd92-33cc-447c-b000-df58cfaf4e89&type=visual&rnd=c3b6d445-c55a-490e-a171-56d758d0beaf&mkt=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/FormLoader/public/locales/en-us/translation.json HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/Captcha/Images/icon_err.gif?vv=100 HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=b105fd92-33cc-447c-b000-df58cfaf4e89&rnd=48c46033440a4adcaad070e562fb0a2c&market=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/Captcha/Images/hig_progcircle_animated.gif?vv=100 HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/Captcha/Images/icon_err.gif?vv=100 HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/Captcha/Images/hig_progcircle_animated.gif?vv=100 HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=b105fd92-33cc-447c-b000-df58cfaf4e89&rnd=48c46033440a4adcaad070e562fb0a2c&market=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/forms/ed6cc479-cc38-ef11-8409-7c1e520ba499/visits HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eOC3AR1WH78oNKD&MD=fbg56d3d HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/script?fid=bbf60dad-072f-44d9-a6e7-e0931f50c482&type=visual&rnd=2de0e11d-da42-446f-a718-00c44672625d&mkt=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=bbf60dad-072f-44d9-a6e7-e0931f50c482&rnd=457e8b8c9dd1497ba62a5c55b5b0b82d&market=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/forms/ed6cc479-cc38-ef11-8409-7c1e520ba499/visits HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=bbf60dad-072f-44d9-a6e7-e0931f50c482&rnd=457e8b8c9dd1497ba62a5c55b5b0b82d&market=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/script?dc=EastUS&mkt=en&fid=bbf60dad-072f-44d9-a6e7-e0931f50c482&type=visual&c=1&rnd=0.5199867511130329 HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=bbf60dad-072f-44d9-a6e7-e0931f50c482&rnd=bfb5869cd5d147faa63611d80225b568&market=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=bbf60dad-072f-44d9-a6e7-e0931f50c482&rnd=bfb5869cd5d147faa63611d80225b568&market=en HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: forms.office.com
Source: global traffic	DNS traffic detected: DNS query: cdn.forms.office.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: lists.office.com
Source: global traffic	DNS traffic detected: DNS query: c.office.com
Source: global traffic	DNS traffic detected: DNS query: assets-usa.mkt.dynamics.com
Source: global traffic	DNS traffic detected: DNS query: public-usa.mkt.dynamics.com

Source: unknown

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 19:17:23 GMTContent-Type: text/htmlContent-Length: 548Connection: closeStrict-Transport-Security: max-age=2592000; preloadx-azure-ref: 20240703T191723Z-157bfc59976pjpd267bfvppp200000000ff0000000005fuwx-fd-int-roxy-purgeid: 72378317X-Cache: TCP_MISS
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 03 Jul 2024 19:17:26 GMTContent-Length: 0Connection: closex-ms-trace-id: 3a757724eac03d86c6071ba177122c6dStrict-Transport-Security: max-age=2592000; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 03 Jul 2024 19:18:26 GMTContent-Length: 0Connection: closex-ms-trace-id: 08b06769535da11a1dffe787e15c6c7aStrict-Transport-Security: max-age=2592000; preload

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: chromecache_254.9.dr	String found in binary or memory: https://aka.ms/FormsConsumerElite.
Source: chromecache_297.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/dll-dompurify.min.bcf1a85.js.map/4ee7b161
Source: chromecache_277.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.1ds.a8079b3.js.
Source: chromecache_255.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_cover.9b66b
Source: chromecache_281.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_ext.1918055
Source: chromecache_292.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_groupnote.f
Source: chromecache_290.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_post.boot.4
Source: chromecache_301.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_saverespons
Source: chromecache_276.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.officebrowserfe
Source: chromecache_273.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.sw.a6ac500.js.m
Source: chromecache_252.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.utel.508f317.js
Source: chromecache_258.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.utel_1ds.625545
Source: chromecache_280.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.min.32c356c.js.map/0c
Source: chromecache_283.9.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/sw.js.map/29290e03f931b88dc228d32a0295c7a
Source: chromecache_284.9.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/forms/ed6cc47
Source: chromecache_298.9.dr	String found in binary or memory: https://cdn.forms.office.net/forms/images/pwa/forms-pwa-logo-192.png
Source: chromecache_298.9.dr	String found in binary or memory: https://cdn.forms.office.net/forms/images/pwa/forms-pwa-logo-256.png
Source: chromecache_298.9.dr	String found in binary or memory: https://cdn.forms.office.net/forms/images/pwa/forms-pwa-logo-512.png
Source: chromecache_284.9.dr	String found in binary or memory: https://cxppusa1formui01cdnsa01-endpoint.azureedge.net/usa/FormLoader/FormLoader.bundle.js
Source: chromecache_268.9.dr, chromecache_300.9.dr	String found in binary or memory: https://doni2.r.ag.d.sendibm3.com/mk/cl/f/sh/OycZvHuFo1eQtVYsQwMXO2o3/Y3fF0MGRoEKk
Source: URBAN CORPS.pdf	String found in binary or memory: https://forms.office.com/r/4i3EYM0R1S)
Source: chromecache_284.9.dr	String found in binary or memory: https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpagefo
Source: URBAN CORPS.pdf	String found in binary or memory: https://urldefense.com/v3/__http:/www.urbancorpscharter.com/__;
Source: URBAN CORPS.pdf	String found in binary or memory: https://urldefense.com/v3/__http:/www.urbancorpssd.org/__;
Source: URBAN CORPS.pdf	String found in binary or memory: https://urldefense.com/v3/__http:/www.urbancorpssd.org/index.html__;

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:49801 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.winPDF@42/137@36/6

Source: URBAN CORPS.pdf	Initial sample: https://urldefense.com/v3/__http:/www.urbancorpssd.org/index.html__;!!e_4xu6-vwmwk-q!smymy4aqrbnmri2yfq3eb2yn77t90x16dffzyk-8owpndxasgjfvxq2lwin0zq6hoqcn46qjc81xcljfeqpz-gaugmvw$
Source: URBAN CORPS.pdf	Initial sample: https://urldefense.com/v3/__http:/www.urbancorpssd.org/__;!!E_4xU6-vwMWK-Q!smYMY4aqRbNMRI2yFQ3Eb2yN77T90x16dFfzyK-8OwPNDXAsGjFVxQ2lwIN0ZQ6hoQcN46QjC81xclJfEQpZ-ubQ6WrD$
Source: URBAN CORPS.pdf	Initial sample: https://urldefense.com/v3/__http:/www.urbancorpssd.org/index.html__;!!E_4xU6-vwMWK-Q!smYMY4aqRbNMRI2yFQ3Eb2yN77T90x16dFfzyK-8OwPNDXAsGjFVxQ2lwIN0ZQ6hoQcN46QjC81xclJfEQpZ-gAUgMvw$
Source: URBAN CORPS.pdf	Initial sample: https://forms.office.com/r/4i3eym0r1s
Source: URBAN CORPS.pdf	Initial sample: mailto:kfreeland@urbancorps.com
Source: URBAN CORPS.pdf	Initial sample: https://forms.office.com/r/4i3EYM0R1S
Source: URBAN CORPS.pdf	Initial sample: https://urldefense.com/v3/__http:/www.urbancorpssd.org/__;!!e_4xu6-vwmwk-q!smymy4aqrbnmri2yfq3eb2yn77t90x16dffzyk-8owpndxasgjfvxq2lwin0zq6hoqcn46qjc81xcljfeqpz-ubq6wrd$
Source: URBAN CORPS.pdf	Initial sample: https://urldefense.com/v3/__http:/www.urbancorpscharter.com/__;!!e_4xu6-vwmwk-q!smymy4aqrbnmri2yfq3eb2yn77t90x16dffzyk-8owpndxasgjfvxq2lwin0zq6hoqcn46qjc81xcljfeqpz-tqkcyxn$
Source: URBAN CORPS.pdf	Initial sample: https://urldefense.com/v3/__http:/www.urbancorpscharter.com/__;!!E_4xU6-vwMWK-Q!smYMY4aqRbNMRI2yFQ3Eb2yN77T90x16dFfzyK-8OwPNDXAsGjFVxQ2lwIN0ZQ6hoQcN46QjC81xclJfEQpZ-tQKCyxN$

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 15-16-43-460.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\URBAN CORPS.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1740,i,16772849399050595403,9305864139534860805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://forms.office.com/r/4i3EYM0R1S"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1988,i,14556554370102153334,10441946139869340800,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1740,i,16772849399050595403,9305864139534860805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1988,i,14556554370102153334,10441946139869340800,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: URBAN CORPS.pdf	Initial sample: PDF keyword /JS count = 0
Source: URBAN CORPS.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A918q8in7_ninilq_3g0.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A918q8in7_ninilq_3g0.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: URBAN CORPS.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: URBAN CORPS.pdf

Initial sample: PDF keyword obj count = 60

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

ID:	1467212
Product:	CloudBasic
Start time:	21:15:53
Start date:	03.07.2024
Sample:	URBAN CORPS.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	ae7cb9463b29e62eca0e9e0e03bb6fb5
SHA1:	785afd91cc7bfe3e1a8339154d602f0c66bbf9cc
SHA256:	a8cf6092efd02a772c56a3ab265844c3fb329b165ad901d1c6ffc2d52040a1e1
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Windows Analysis Report
URBAN CORPS.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report URBAN CORPS.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
URBAN CORPS.pdf