Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
URBAN CORPS.pdf
|
PDF document, version 1.7, 1 pages
|
initial sample
|
 |
|
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ea986e22-4085-4271-b273-72c08f55dec0.tmp
|
JSON data
|
modified
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log
|
data
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240703191645Z-157.bmp
|
PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
|
data
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
modified
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
|
SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8,
version-valid-for 19
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal
|
SQLite Rollback Journal
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSI71eea.LOG
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A918q8in7_ninilq_3g0.tmp
|
PDF document, version 1.6, 0 pages
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 15-16-43-460.log
|
ASCII text, with very long lines (393)
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log
|
ASCII text, with very long lines (392), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrocef_low\379a2e62-3256-4fc6-a26b-5bb1eeedaafa.tmp
|
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrocef_low\38ee6027-ee42-4ae8-af0a-4eeb0c036a51.tmp
|
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrocef_low\58c66d0b-0be7-4612-9afe-0bf3954343dc.tmp
|
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrocef_low\a101ce50-11dd-4fcb-8220-fbd8ab7ef473.tmp
|
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 18:17:08 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 18:17:08 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 18:17:08 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 18:17:08 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command
line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 18:17:08 2024, atime=Wed Sep 27 04:28:28
2023, length=1210144, window=hide
|
dropped
|
||
|
Chrome Cache Entry: 252
|
ASCII text, with very long lines (35861)
|
downloaded
|
||
|
Chrome Cache Entry: 253
|
PNG image data, 206 x 58, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 254
|
Unicode text, UTF-8 text, with very long lines (36828), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 255
|
ASCII text, with very long lines (65536), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 256
|
SVG Scalable Vector Graphics image
|
downloaded
|
||
|
Chrome Cache Entry: 257
|
PNG image data, 490 x 180, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 258
|
ASCII text, with very long lines (34041)
|
downloaded
|
||
|
Chrome Cache Entry: 259
|
JSON data
|
dropped
|
||
|
Chrome Cache Entry: 260
|
ASCII text, with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 261
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 216x96, components
3
|
downloaded
|
||
|
Chrome Cache Entry: 262
|
ASCII text, with very long lines (23130), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 263
|
MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
|
dropped
|
||
|
Chrome Cache Entry: 264
|
GIF image data, version 89a, 20 x 20
|
dropped
|
||
|
Chrome Cache Entry: 265
|
ASCII text, with very long lines (23130), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 266
|
HTML document, ASCII text, with very long lines (5844), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 267
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 216x96, components
3
|
dropped
|
||
|
Chrome Cache Entry: 268
|
HTML document, ASCII text, with very long lines (20912)
|
dropped
|
||
|
Chrome Cache Entry: 269
|
PNG image data, 192 x 192, 8-bit colormap, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 270
|
HTML document, ASCII text, with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 271
|
PNG image data, 192 x 192, 8-bit colormap, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 272
|
JSON data
|
downloaded
|
||
|
Chrome Cache Entry: 273
|
ASCII text, with very long lines (917)
|
downloaded
|
||
|
Chrome Cache Entry: 274
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 216x96, components
3
|
downloaded
|
||
|
Chrome Cache Entry: 275
|
GIF image data, version 89a, 16 x 16
|
dropped
|
||
|
Chrome Cache Entry: 276
|
ASCII text, with very long lines (65381)
|
downloaded
|
||
|
Chrome Cache Entry: 277
|
Java source, ASCII text, with very long lines (17610)
|
downloaded
|
||
|
Chrome Cache Entry: 278
|
JSON data
|
dropped
|
||
|
Chrome Cache Entry: 279
|
ASCII text, with very long lines (23130), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 280
|
ASCII text, with very long lines (38720)
|
downloaded
|
||
|
Chrome Cache Entry: 281
|
Unicode text, UTF-8 text, with very long lines (64406), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 282
|
JSON data
|
downloaded
|
||
|
Chrome Cache Entry: 283
|
ASCII text, with very long lines (43631)
|
downloaded
|
||
|
Chrome Cache Entry: 284
|
HTML document, ASCII text
|
downloaded
|
||
|
Chrome Cache Entry: 285
|
JSON data
|
dropped
|
||
|
Chrome Cache Entry: 286
|
GIF image data, version 89a, 20 x 20
|
downloaded
|
||
|
Chrome Cache Entry: 287
|
MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
|
downloaded
|
||
|
Chrome Cache Entry: 288
|
JSON data
|
dropped
|
||
|
Chrome Cache Entry: 289
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 216x96, components
3
|
dropped
|
||
|
Chrome Cache Entry: 290
|
ASCII text, with very long lines (15444)
|
downloaded
|
||
|
Chrome Cache Entry: 291
|
PNG image data, 490 x 180, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 292
|
ASCII text, with very long lines (4357)
|
downloaded
|
||
|
Chrome Cache Entry: 293
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 216x96, components
3
|
dropped
|
||
|
Chrome Cache Entry: 294
|
GIF image data, version 89a, 16 x 16
|
downloaded
|
||
|
Chrome Cache Entry: 295
|
PNG image data, 206 x 58, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 296
|
ASCII text, with very long lines (65461)
|
downloaded
|
||
|
Chrome Cache Entry: 297
|
ASCII text, with very long lines (16094)
|
downloaded
|
||
|
Chrome Cache Entry: 298
|
JSON data
|
downloaded
|
||
|
Chrome Cache Entry: 299
|
SVG Scalable Vector Graphics image
|
dropped
|
||
|
Chrome Cache Entry: 300
|
HTML document, ASCII text, with very long lines (20912)
|
downloaded
|
||
|
Chrome Cache Entry: 301
|
ASCII text, with very long lines (32830)
|
downloaded
|
||
|
Chrome Cache Entry: 302
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 216x96, components
3
|
downloaded
|
There are 92 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
|
"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\URBAN CORPS.pdf"
|
||
|
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
|
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
|
||
|
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
|
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService
--lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0"
--lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log"
--mojo-platform-channel-handle=2104 --field-trial-handle=1740,i,16772849399050595403,9305864139534860805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker
/prefetch:8
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://forms.office.com/r/4i3EYM0R1S"
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US
--service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1988,i,14556554370102153334,10441946139869340800,262144
/prefetch:8
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://assets-usa.mkt.dynamics.com/favicon.ico
|
13.107.246.60
|
|
|
|
https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499
|
|
||
|
https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/forms/ed6cc479-cc38-ef11-8409-7c1e520ba499
|
13.107.246.60
|
|
|
|
https://forms.office.com/pages/responsepage.aspx?id=m-YY3RuX2UeS4svj8aYQ3DeXDZSh651OljSHQ-HNcj5UQ0c1Q1hRTEZFWFRLODJTUkRXS1pQNVU2MS4u
|
|
||
|
https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/forms/ed6cc47
|
unknown
|
|
|
|
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/forms/ed6cc479-cc38-ef11-8409-7c1e520ba499/visits
|
52.146.76.30
|
||
|
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.min.32c356c.js.map/0c
|
unknown
|
||
|
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/script?fid=b105fd92-33cc-447c-b000-df58cfaf4e89&type=visual&rnd=c3b6d445-c55a-490e-a171-56d758d0beaf&mkt=en
|
52.146.76.30
|
||
|
https://aka.ms/FormsConsumerElite.
|
unknown
|
||
|
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=b105fd92-33cc-447c-b000-df58cfaf4e89&rnd=48c46033440a4adcaad070e562fb0a2c&market=en
|
52.146.76.30
|
||
|
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_ext.1918055
|
unknown
|
||
|
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_groupnote.f
|
unknown
|
||
|
https://cdn.forms.office.net/forms/images/pwa/forms-pwa-logo-256.png
|
unknown
|
||
|
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/script?dc=EastUS&mkt=en&fid=bbf60dad-072f-44d9-a6e7-e0931f50c482&type=visual&c=1&rnd=0.5199867511130329
|
52.146.76.30
|
||
|
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_saverespons
|
unknown
|
||
|
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.1ds.a8079b3.js.
|
unknown
|
||
|
https://doni2.r.ag.d.sendibm3.com/mk/cl/f/sh/OycZvHuFo1eQtVYsQwMXO2o3/Y3fF0MGRoEKk
|
unknown
|
||
|
https://urldefense.com/v3/__http:/www.urbancorpscharter.com/__;
|
unknown
|
||
|
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.officebrowserfe
|
unknown
|
||
|
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.utel_1ds.625545
|
unknown
|
||
|
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/forms/ed6cc479-cc38-ef11-8409-7c1e520ba499
|
52.146.76.30
|
||
|
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=bbf60dad-072f-44d9-a6e7-e0931f50c482&rnd=457e8b8c9dd1497ba62a5c55b5b0b82d&market=en
|
52.146.76.30
|
||
|
https://urldefense.com/v3/__http:/www.urbancorpssd.org/__;
|
unknown
|
||
|
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_post.boot.4
|
unknown
|
||
|
https://forms.office.com/r/4i3EYM0R1S)
|
unknown
|
||
|
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.sw.a6ac500.js.m
|
unknown
|
||
|
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/challenge/visual?flowId=bbf60dad-072f-44d9-a6e7-e0931f50c482&rnd=bfb5869cd5d147faa63611d80225b568&market=en
|
52.146.76.30
|
||
|
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpageforms/captcha/script?fid=bbf60dad-072f-44d9-a6e7-e0931f50c482&type=visual&rnd=2de0e11d-da42-446f-a718-00c44672625d&mkt=en
|
52.146.76.30
|
||
|
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/8eafd458-f837-ef11-8e4b-0022482aac2c/landingpagefo
|
unknown
|
||
|
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.lrp_cover.9b66b
|
unknown
|
||
|
https://cdn.forms.office.net/forms/images/pwa/forms-pwa-logo-192.png
|
unknown
|
||
|
https://cdn.forms.office.net/forms/images/pwa/forms-pwa-logo-512.png
|
unknown
|
||
|
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-response-page.chunk.utel.508f317.js
|
unknown
|
||
|
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/dll-dompurify.min.bcf1a85.js.map/4ee7b161
|
unknown
|
||
|
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/sw.js.map/29290e03f931b88dc228d32a0295c7a
|
unknown
|
||
|
https://urldefense.com/v3/__http:/www.urbancorpssd.org/index.html__;
|
unknown
|
There are 26 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
assets-usa.mkt.dynamics.com
|
unknown
|
|
|
|
s-part-0014.t-0009.t-msedge.net
|
13.107.246.42
|
||
|
bg.microsoft.map.fastly.net
|
199.232.214.172
|
||
|
www.google.com
|
142.250.186.164
|
||
|
prdia888eus0aks.mkt.dynamics.com
|
52.146.76.30
|
||
|
s-part-0032.t-0009.t-msedge.net
|
13.107.246.60
|
||
|
prdia888wus0aks.mkt.dynamics.com
|
20.49.124.158
|
||
|
public-usa.mkt.dynamics.com
|
unknown
|
||
|
forms.office.com
|
unknown
|
||
|
c.office.com
|
unknown
|
||
|
cdn.forms.office.net
|
unknown
|
||
|
lists.office.com
|
unknown
|
There are 2 hidden domains, click here to show them.
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
13.107.246.60
|
s-part-0032.t-0009.t-msedge.net
|
United States
|
||
|
192.168.2.5
|
unknown
|
unknown
|
||
|
20.49.124.158
|
prdia888wus0aks.mkt.dynamics.com
|
United States
|
||
|
52.146.76.30
|
prdia888eus0aks.mkt.dynamics.com
|
United States
|
||
|
239.255.255.250
|
unknown
|
Reserved
|
||
|
142.250.186.164
|
www.google.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
|
aFS
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
|
tDIText
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
|
tFileName
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
|
tFileSource
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
|
sFileAncestors
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
|
sDI
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
|
sDate
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
|
uFileSize
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
|
uPageCount
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
|
sAssetId
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
|
bisSharedFile
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
|
aFS
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
|
tDIText
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
|
tFileName
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
|
sFileAncestors
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
|
sDI
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
|
sDate
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
|
uFileSize
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
|
uPageCount
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
|
bisSharedFile
|
There are 10 hidden registries, click here to show them.
DOM / HTML
|
URL
|
Malicious
|
|
|---|---|---|
|
https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499
|
|
|
|
https://forms.office.com/pages/responsepage.aspx?id=m-YY3RuX2UeS4svj8aYQ3DeXDZSh651OljSHQ-HNcj5UQ0c1Q1hRTEZFWFRLODJTUkRXS1pQNVU2MS4u
|
||
|
https://forms.office.com/pages/responsepage.aspx?id=m-YY3RuX2UeS4svj8aYQ3DeXDZSh651OljSHQ-HNcj5UQ0c1Q1hRTEZFWFRLODJTUkRXS1pQNVU2MS4u
|
||
|
https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499
|
||
|
https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499
|
||
|
https://assets-usa.mkt.dynamics.com/8eafd458-f837-ef11-8e4b-0022482aac2c/digitalassets/standaloneforms/ed6cc479-cc38-ef11-8409-7c1e520ba499
|