IOC Report
https://www.directcommerce.com/e3t/Ctc/LW+113/cxTvs04/VXh84F1y5yWKW4GR0mQ35bLC_W6y9Q695m9L8YN99fz8T5kvg0W6N1X8z6lZ3nyW818wP_6txjwsV2dJT-4yR4GRW63tGH02LYvKrW3vXKpn5R3YxZW7rnHgw2ry-bcW6zC-8S25BTT6W80BcBl8wNpPRN7CqLf5_ryhyW6hq48D8gxg2QW5XBQHR4hvw0NW63XDXd46lFQ4W7J9b072rWlfSW2FsL3j39rwyNW24tgr07r9jkwVrX

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\27096b36-a56e-4c4b-818b-74de6897e84a.tmp
JSON data
modified
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5e727b3a-c998-4fe5-9ee2-5adbe1b49ef9.tmp
JSON data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)
JSON data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF714ce2.TMP (copy)
JSON data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241030164742Z-190.bmp
PC bitmap, Windows 3.x format, 164 x -92 x 32, cbSize 60406, bits offset 54
dropped
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
dropped
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal
SQLite Rollback Journal
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D
Certificate, Version=3
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D
data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat
data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING
data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal
SQLite Rollback Journal
dropped
C:\Users\user\AppData\Local\Temp\MSI10b06.LOG
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-30 12-47-39-699.log
ASCII text, with very long lines (393)
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log
ASCII text, with very long lines (393), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\0cd60fd1-a36e-48f1-941c-85d07190bc1d.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\2fa7c7e9-4ba5-4ff6-aba7-69548889705a.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\5c536817-56e9-405a-8df1-431c51602006.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\c06dfc56-70d6-4185-9c85-b48142e71424.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
dropped
C:\Users\user\Downloads\00be1649-58fd-4289-9166-e6e54ba57031.tmp
PDF document, version 1.4
dropped
C:\Users\user\Downloads\163e78a4-7bd7-44c4-b7b3-5d13e35e91e1.tmp
PDF document, version 1.4, 1 pages
dropped
C:\Users\user\Downloads\downloaded.pdf (copy)
PDF document, version 1.4, 1 pages
dropped
C:\Users\user\Downloads\downloaded.pdf.crdownload
PDF document, version 1.4, 1 pages
dropped
Chrome Cache Entry: 213
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 214
HTML document, Unicode text, UTF-8 text, with very long lines (1183)
downloaded
Chrome Cache Entry: 215
PDF document, version 1.4, 1 pages
downloaded
Chrome Cache Entry: 216
PNG image data, 225 x 162, 8-bit/color RGBA, non-interlaced
dropped
There are 44 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1944,i,9983051778415378146,5541647370405151897,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.directcommerce.com/e3t/Ctc/LW+113/cxTvs04/VXh84F1y5yWKW4GR0mQ35bLC_W6y9Q695m9L8YN99fz8T5kvg0W6N1X8z6lZ3nyW818wP_6txjwsV2dJT-4yR4GRW63tGH02LYvKrW3vXKpn5R3YxZW7rnHgw2ry-bcW6zC-8S25BTT6W80BcBl8wNpPRN7CqLf5_ryhyW6hq48D8gxg2QW5XBQHR4hvw0NW63XDXd46lFQ4W7J9b072rWlfSW2FsL3j39rwyNW24tgr07r9jkwVrXfNr30Xs-QW2XBYBp1RpglRN7CcYZtbrgKYN2FMSdzlmdNXW89wTpB5Zydv9W4lxjWh6fjHw4W3NBqdl7FR5pFW62b_nY60F2wxW4rZ5jY2tQbvwN2Ljb7yHs9JzW3lj7GT192KwlVLQgDZ3T3KbwW90T2rZ4HcZyPW7NVDFh8Ncx6_W3Tl1Jt1H2Z5cVM_cT8656sYcN7XnB7YLpwRPW3DJnQS8b4RvkN3Zll41X5SPLW3cKxMl1FqBfDN23gpL7mTdM2N1nBRG2Drr51W89BH2D1nT-xsVVqY6Q7219tSf2MzHJl04"
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf"
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1584,i,18199776120133472988,5127619646676685281,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8

URLs

Name
IP
Malicious
https://www.directcommerce.com/e3t/Ctc/LW+113/cxTvs04/VXh84F1y5yWKW4GR0mQ35bLC_W6y9Q695m9L8YN99fz8T5kvg0W6N1X8z6lZ3nyW818wP_6txjwsV2dJT-4yR4GRW63tGH02LYvKrW3vXKpn5R3YxZW7rnHgw2ry-bcW6zC-8S25BTT6W80BcBl8wNpPRN7CqLf5_ryhyW6hq48D8gxg2QW5XBQHR4hvw0NW63XDXd46lFQ4W7J9b072rWlfSW2FsL3j39rwyNW24tgr07r9jkwVrXfNr30Xs-QW2XBYBp1RpglRN7CcYZtbrgKYN2FMSdzlmdNXW89wTpB5Zydv9W4lxjWh6fjHw4W3NBqdl7FR5pFW62b_nY60F2wxW4rZ5jY2tQbvwN2Ljb7yHs9JzW3lj7GT192KwlVLQgDZ3T3KbwW90T2rZ4HcZyPW7NVDFh8Ncx6_W3Tl1Jt1H2Z5cVM_cT8656sYcN7XnB7YLpwRPW3DJnQS8b4RvkN3Zll41X5SPLW3cKxMl1FqBfDN23gpL7mTdM2N1nBRG2Drr51W89BH2D1nT-xsVVqY6Q7219tSf2MzHJl04
http://x1.i.lencr.org/
unknown
https://www.directcommerce.com/hubfs/Onboarding-%20THD%20Dynamic%20Discounting-Pay%20Me%20Early/Discount%20Managment_Pay%20Me%20Early%20QSG%20CANADA.pptx%20(2)%20(2).pdf?utm_medium=email&_hsenc=p2ANqtz-9ibpxrnGHj4kuhwdOQh47Xv8e6XmXogYq1Q9H14-p6dCLZ42vcfz5RgLaDD7J1zI_q4orlKgqmFA7yZE4T23cWJs8-TNypJMFYMPgZgRJ7huANUlU&_hsmi=328556203&utm_content=328556203&utm_source=hs_email
https://chrome.cloudflare-dns.com/dns-query
162.159.61.3
file:///C:/Users/user/Downloads/downloaded.pdf
https://www.directcommerce.com/e3t/Ctc/LW+113/cxTvs04/VXh84F1y5yWKW4GR0mQ35bLC_W6y9Q695m9L8YN99fz8T5kvg0W6N1X8z6lZ3nyW818wP_6txjwsV2dJT-4yR4GRW63tGH02LYvKrW3vXKpn5R3YxZW7rnHgw2ry-bcW6zC-8S25BTT6W80BcBl8wNpPRN7CqLf5_ryhyW6hq48D8gxg2QW5XBQHR4hvw0NW63XDXd46lFQ4W7J9b072rWlfSW2FsL3j39rwyNW24tgr07r9jkwVrXfNr30Xs-QW2XBYBp1RpglRN7CcYZtbrgKYN2FMSdzlmdNXW89wTpB5Zydv9W4lxjWh6fjHw4W3NBqdl7FR5pFW62b_nY60F2wxW4rZ5jY2tQbvwN2Ljb7yHs9JzW3lj7GT192KwlVLQgDZ3T3KbwW90T2rZ4HcZyPW7NVDFh8Ncx6_W3Tl1Jt1H2Z5cVM_cT8656sYcN7XnB7YLpwRPW3DJnQS8b4RvkN3Zll41X5SPLW3cKxMl1FqBfDN23gpL7mTdM2N1nBRG2Drr51W89BH2D1nT-xsVVqY6Q7219tSf2MzHJl04
199.60.103.30
https://www.directcommerce.com/favicon.ico
199.60.103.30
https://www.directcommerce.com/events/public/v1/encoded/track/tc/LW
unknown
https://www.directcommerce.com/events/public/v1/encoded/track/tc/LW+113/cxTvs04/VXh84F1y5yWKW4GR0mQ35bLC_W6y9Q695m9L8YN99fz8T5kvg0W6N1X8z6lZ3nyW818wP_6txjwsV2dJT-4yR4GRW63tGH02LYvKrW3vXKpn5R3YxZW7rnHgw2ry-bcW6zC-8S25BTT6W80BcBl8wNpPRN7CqLf5_ryhyW6hq48D8gxg2QW5XBQHR4hvw0NW63XDXd46lFQ4W7J9b072rWlfSW2FsL3j39rwyNW24tgr07r9jkwVrXfNr30Xs-QW2XBYBp1RpglRN7CcYZtbrgKYN2FMSdzlmdNXW89wTpB5Zydv9W4lxjWh6fjHw4W3NBqdl7FR5pFW62b_nY60F2wxW4rZ5jY2tQbvwN2Ljb7yHs9JzW3lj7GT192KwlVLQgDZ3T3KbwW90T2rZ4HcZyPW7NVDFh8Ncx6_W3Tl1Jt1H2Z5cVM_cT8656sYcN7XnB7YLpwRPW3DJnQS8b4RvkN3Zll41X5SPLW3cKxMl1FqBfDN23gpL7mTdM2N1nBRG2Drr51W89BH2D1nT-xsVVqY6Q7219tSf2MzHJl04?_ud=2d56c355-73ed-4ab7-91f6-a60868ea539e&_jss=1&_fl=8&_pl=5&_hc=4&_lg=en-US,en&_plt=Win32&_scr=1280,1024
199.60.103.30
https://www.directcommerce.com/hubfs/DC-Logo-Icon.png
199.60.103.30

Domains

Name
IP
Malicious
chrome.cloudflare-dns.com
162.159.61.3
s-part-0017.t-0009.t-msedge.net
13.107.246.45
www.google.com
142.250.185.100
s-part-0039.t-0009.t-msedge.net
13.107.246.67
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
217.20.57.35
fp2e7a.wpc.phicdn.net
192.229.221.95
group6.sites.hscoscdn00.net
199.60.103.30
x1.i.lencr.org
unknown
www.directcommerce.com
unknown

IPs

IP
Domain
Country
Malicious
192.168.2.17
unknown
unknown
142.250.185.100
www.google.com
United States
192.168.2.4
unknown
unknown
199.60.103.30
group6.sites.hscoscdn00.net
Canada
192.168.2.6
unknown
unknown
192.168.2.5
unknown
unknown
162.159.61.3
chrome.cloudflare-dns.com
United States
239.255.255.250
unknown
Reserved
96.7.168.138
unknown
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
aFS
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
tDIText
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
tFileName
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
tFileSource
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sFileAncestors
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sDI
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sDate
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
uFileSize
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
uPageCount
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sAssetId
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
bisSharedFile
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
aFS
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
tDIText
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
tFileName
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
sDI
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
sDate
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
uFileSize
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
uPageCount
There are 8 hidden registries, click here to show them.

DOM / HTML

URL
Malicious
https://www.directcommerce.com/hubfs/Onboarding-%20THD%20Dynamic%20Discounting-Pay%20Me%20Early/Discount%20Managment_Pay%20Me%20Early%20QSG%20CANADA.pptx%20(2)%20(2).pdf?utm_medium=email&_hsenc=p2ANqtz-9ibpxrnGHj4kuhwdOQh47Xv8e6XmXogYq1Q9H14-p6dCLZ42vcfz5RgLaDD7J1zI_q4orlKgqmFA7yZE4T23cWJs8-TNypJMFYMPgZgRJ7huANUlU&_hsmi=328556203&utm_content=328556203&utm_source=hs_email
file:///C:/Users/user/Downloads/downloaded.pdf
file:///C:/Users/user/Downloads/downloaded.pdf