Edit tour

Windows Analysis Report
H565rymIuO.doc

Overview

General Information

Sample name:	H565rymIuO.doc renamed because original name is a hash value
Original sample name:	25fe7ce806195948532624d2c2462ec952da03a3312abd79de06aa2423da03f8.docx.doc
Analysis ID:	1585126
MD5:	162dd4e4ed6c0ef700b3c95385b5dc0a
SHA1:	1afc58e221337c3f8b18dc97e3156f8dbcc7d119
SHA256:	25fe7ce806195948532624d2c2462ec952da03a3312abd79de06aa2423da03f8
Tags:	docuser-zhuzhu0009
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Contains an external reference to another file

Document exploit detected (process start blacklist hit)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Sigma detected: Suspicious Office Outbound Connections

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 7424 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

splwow64.exe (PID: 7272 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

Acrobat.exe (PID: 4564 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" -Embedding MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1020 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7564 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1628,i,12917579598302854451,16205094258031201980,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Sigma Signatures

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.4, DestinationIsIpv6: false, DestinationPort: 49741, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Initiated: true, ProcessId: 7424, Protocol: tcp, SourceIp: 104.21.74.191, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T06:00:31.139877+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	104.21.74.191	443	TCP
2025-01-07T06:00:32.734610+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	104.21.74.191	443	TCP
2025-01-07T06:00:33.393281+0100	2028371	3	Unknown Traffic	192.168.2.4	49746	104.21.74.191	443	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T06:00:32.230249+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49742	104.21.74.191	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: H565rymIuO.doc

ReversingLabs: Detection: 28%

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.4:49742 version: TLS 1.2

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Source: global traffic	DNS query: name: acesso.run
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443

Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49741
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49742
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49744
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49746
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49747
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49748
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 104.21.74.191:443

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49742 -> 104.21.74.191:443

Source: Joe Sandbox View

IP Address: 104.21.74.191 104.21.74.191

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 104.21.74.191:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 104.21.74.191:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49746 -> 104.21.74.191:443

Source: global traffic	HTTP traffic detected: GET /bkeoxH?&bondsman=troubled&shrimp=harsh&sewer=tense&cold=warlike&briefs=unsuitable&oasis=numberless&cowbell=rough&airport=lowly&dust HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: acesso.runConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /404 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: acesso.runConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /bkeoxH?&bondsman=troubled&shrimp=harsh&sewer=tense&cold=warlike&briefs=unsuitable&oasis=numberless&cowbell=rough&airport=lowly&dust HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: acesso.runConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /404 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: acesso.runConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: acesso.run
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 07 Jan 2025 05:00:33 GMTContent-Type: text/html; charset=utf-8Connection: closeX-DNS-Prefetch-Control: offX-Frame-Options: SAMEORIGINStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Download-Options: noopenX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockX-Powered-By: Next.jsVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f4nSKkpaCGVjL5BN4HxeD7qBSTdqN8NNYfpoAUrZR%2FtaUxgDcJgcCkmOG%2FI6hQj23I9eXMrJ9g2ubXUAlyHl9FPz8IEUBXHGwRWGVFiDhWSBS3aAKBmSwZhoJFKm"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8fe162854a886a5e-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1589&min_rtt=1583&rtt_var=605&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=919&delivery_rate=1790312&cwnd=187&unsent_bytes=0&cid=636c565d03f5dca1&ts=202&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 07 Jan 2025 05:00:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-DNS-Prefetch-Control: offX-Frame-Options: SAMEORIGINStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Download-Options: noopenX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockX-Powered-By: Next.jsVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k21thlJ02v4fq30wgNkg%2FVjjuwMw8kyF6CIhhd22o33gYRy%2Bw1j1yLfDZdL5obgue605iMO%2B23pQLejJFKwSjXZKO55gJqrP4s5JUnTixta2cKO57ilqAx5uAG5Q"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8fe1628e09e1f793-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1462&min_rtt=1457&rtt_var=557&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2824&recv_bytes=752&delivery_rate=1944074&cwnd=152&unsent_bytes=0&cid=7b51643410143d2f&ts=178&x=0"

Source: 2D85F72862B55C4EADD9E66E06947F3D0.10.dr

String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: classification engine

Classification label: mal64.expl.evad.winDOC@18/49@4/1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\Desktop\~$65rymIuO.doc

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{04C2B3AE-8DD9-4F92-90F9-5CB2C24EAC25} - OProcSessId.dat

Jump to behavior

Source: H565rymIuO.doc	OLE indicator, Word Document stream: true
Source: H565rymIuO.doc	OLE indicator, Word Document stream: true

Source: H565rymIuO.doc	OLE document summary: title field not present or empty
Source: H565rymIuO.doc	OLE document summary: edited time not present or 0
Source: H565rymIuO.doc	OLE document summary: title field not present or empty
Source: H565rymIuO.doc	OLE document summary: edited time not present or 0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: H565rymIuO.doc

ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" -Embedding
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1628,i,12917579598302854451,16205094258031201980,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1628,i,12917579598302854451,16205094258031201980,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: H565rymIuO.doc	Initial sample: OLE zip file path = word/_rels/header2.xml.rels
Source: H565rymIuO.doc	Initial sample: OLE zip file path = word/media/image2.emf
Source: H565rymIuO.doc	Initial sample: OLE zip file path = word/embeddings/oleObject2.bin
Source: H565rymIuO.doc	Initial sample: OLE zip file path = word/_rels/settings.xml.rels

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: H565rymIuO.doc

Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior

Contains an external reference to another file

Source: settings.xml.rels

Extracted files from sample: https://acesso.run/bkeoxh?&bondsman=troubled&shrimp=harsh&sewer=tense&cold=warlike&briefs=unsuitable&oasis=numberless&cowbell=rough&airport=lowly&dust

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\splwow64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	13 Exploitation for Client Execution	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
H565rymIuO.doc	29%	ReversingLabs	Document-Office.Trojan.Heuristic

Source	Detection	Scanner	Label	Link
https://acesso.run/bkeoxH?&bondsman=troubled&shrimp=harsh&sewer=tense&cold=warlike&briefs=unsuitable&oasis=numberless&cowbell=rough&airport=lowly&dust	0%	Avira URL Cloud	safe
https://acesso.run/404	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
acesso.run	104.21.74.191	true	true		unknown
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://acesso.run/404	true	Avira URL Cloud: safe	unknown
https://acesso.run/bkeoxH?&bondsman=troubled&shrimp=harsh&sewer=tense&cold=warlike&briefs=unsuitable&oasis=numberless&cowbell=rough&airport=lowly&dust	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.10.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.74.191	acesso.run	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585126
Start date and time:	2025-01-07 05:59:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	H565rymIuO.doc renamed because original name is a hash value
Original Sample Name:	25fe7ce806195948532624d2c2462ec952da03a3312abd79de06aa2423da03f8.docx.doc
Detection:	MAL
Classification:	mal64.expl.evad.winDOC@18/49@4/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 52.109.76.243, 23.56.254.164, 20.42.73.31, 52.109.32.46, 52.109.32.39, 52.109.32.47, 52.109.32.38, 95.100.110.78, 95.100.110.68, 23.56.252.213, 2.16.168.105, 2.16.168.107, 52.22.41.97, 3.219.243.226, 3.233.129.217, 52.6.155.20, 172.64.41.3, 162.159.61.3, 23.209.209.135, 20.109.210.53, 40.126.32.74, 13.107.246.45, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, templatesmetadata.office.net.edgekey.net, eur.roaming1.live.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, onedscolprdeus21.eastus.cloudapp.azure.com, acroipm2.adobe.com, neu-azsc-000.roaming.officeapps.live.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, ocsp.digicert.com, login.live.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, officeclient.microsoft.com, templatesmetadata.office.net, ukw-azsc-config.officeapps.live.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: H565rymIuO.doc

Simulations

Behavior and APIs

Time	Type	Description
00:00:52	API Interceptor	8x Sleep call for process: splwow64.exe modified
00:01:08	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

LLM Input / Output

Input	Output
URL: Office document Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Office document Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": " ", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": " ", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": true, "contains_fake_security_alerts": false }

URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.74.191	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	tuong.me/wp-login.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
acesso.run	A & C Metrology OC 545714677889Materiale.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	172.67.162.95
	PO.2407010.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	172.67.162.95
	Po docs.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	104.21.74.191
	AWB-M09CT560.docx.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	AWB-M09CT560.docx.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.162.95
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.162.95
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.74.191
	0001.xls	Get hash	malicious	Remcos	Browse	172.67.162.95
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	172.67.162.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	MV DESPINA_VESSEL_DESCRIPTION.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	https://u896278.ct.sendgrid.net/ls/click?upn=u001.qpi-2F0q-2FpcJZ7AGoG9N-2BrxLxoGn8scq-2BedBfmGHFAiwRCk-2Fciku7nsS3YfQMNNJI09mLo_nYx4-2F6dkZkjW10KMIp5mXhxys1ng1sBiI-2Bi9ROMYt6d5xhIh5rIqEUIaIxVHh8-2Ftz-2FouCgfXZk6mMUe2uKm92SOgBLlBdhjnRJuhENZnIuGoEoPqnROi7OCzdabJBBnGjEwd2iK-2BngR2RyIIgM3XrJQ7wQhHrfqScifSW3iAsv3H5nGFK9ntcSdChvkxj0yXdE-2FQ0ICDszl57i6aZSB-2Fow-3D-3D	Get hash	malicious	Unknown	Browse	104.26.0.123
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	https://report-scam.malwarebouncer.com/XcUR2TnV2VTlXT0s0Z0NYa01KSGt3dUtWMWNiblBrc29mMlpZUU1WdThBSjdDdTlRQTVDV1ZZd0pDeWRmUU5rQ1QvVDNiSlBNYWd2bTd0eTRkZW5jT0hrYTBKWHFiVUc4TVZBOGpiNkh4VG9OTm9zNTVUWHNmNWVydHpqbzhIc1llSzdzTHZ0dENVNWRLZy9BbCsyVDRMSGRHOThUWnV5QUxPU0RZL1dPalNYTmUzMTVoRzl5bmk1ZVZRPT0tLUdVYnJkMC9GazI3MWlxYmotLUpFOURyOWkzK1l6Vy9BYTVOVDBVNkE9PQ==?cid=2346401253	Get hash	malicious	KnowBe4	Browse	104.17.25.14
	x86_64.elf	Get hash	malicious	Mirai	Browse	8.44.60.50
	sh4.elf	Get hash	malicious	Mirai	Browse	162.158.206.216
	w3245.exe	Get hash	malicious	Unknown	Browse	104.21.80.52
	w3245.exe	Get hash	malicious	Unknown	Browse	104.21.80.52
	https://bs32c.golfercaps.com/vfd23ced/#sean@virtualintelligencebriefing.com	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://app.saner.ai/shared/notes/7353e5ae-dd5f-410b-92c3-210c9e88052a	Get hash	malicious	HTMLPhisher	Browse	104.17.247.203

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	w3245.exe	Get hash	malicious	Unknown	Browse	104.21.74.191
	w3245.exe	Get hash	malicious	Unknown	Browse	104.21.74.191
	sEG2xXpg0X.xlsm	Get hash	malicious	Unknown	Browse	104.21.74.191
	Drivespan.dll	Get hash	malicious	Unknown	Browse	104.21.74.191
	installer_1.05_36.8.exe	Get hash	malicious	LummaC	Browse	104.21.74.191
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.74.191
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.21.74.191
	anrek.mp4.hta	Get hash	malicious	LummaC Stealer	Browse	104.21.74.191
	title.mp4.hta	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	104.21.74.191
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.74.191
37f463bf4616ecd445d4a1937da06e19	287438657364-7643738421.08.exe	Get hash	malicious	Nitol	Browse	104.21.74.191
	287438657364-7643738421.08.exe	Get hash	malicious	Unknown	Browse	104.21.74.191
	u1XWB0BIju.msi	Get hash	malicious	Unknown	Browse	104.21.74.191
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.74.191
	2749837485743-7684385786.05.exe	Get hash	malicious	Nitol	Browse	104.21.74.191
	2749837485743-7684385786.05.exe	Get hash	malicious	Unknown	Browse	104.21.74.191
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.74.191
	ZT0KQ1PC.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	104.21.74.191
	LinxOptimizer.exe	Get hash	malicious	Unknown	Browse	104.21.74.191

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.117986050595108
Encrypted:	false
SSDEEP:	6:iOpFaeCVq2Pwkn2nKuAl9OmbnIFUtLFaXfYgZmwlFaXmYIkwOwkn2nKuAl9Ombjd:7pFaTvYfHAahFUtLFaPh/lFa275JfHAR
MD5:	0F70D5FF267944B8772CC3BAFC106E1D
SHA1:	10E21C69AB6519421F51E947010D530B476BD608
SHA-256:	F677F1565AB7A33B649568F8958378E867CE8C1F8B17EF9A3BF522EF8134B748
SHA-512:	222FD958DCF22F5F787EB4C24355D57F3391177729274EDED3D47E864D7A6DAFF11DFC23C58CC41D9AA752F167F81CDEF1F4534679492CD227F04BBDC79921FC
Malicious:	false
Reputation:	low
Preview:	2025/01/07-00:00:55.358 14e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/07-00:00:55.360 14e0 Recovering log #3.2025/01/07-00:00:55.361 14e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.117986050595108
Encrypted:	false
SSDEEP:	6:iOpFaeCVq2Pwkn2nKuAl9OmbnIFUtLFaXfYgZmwlFaXmYIkwOwkn2nKuAl9Ombjd:7pFaTvYfHAahFUtLFaPh/lFa275JfHAR
MD5:	0F70D5FF267944B8772CC3BAFC106E1D
SHA1:	10E21C69AB6519421F51E947010D530B476BD608
SHA-256:	F677F1565AB7A33B649568F8958378E867CE8C1F8B17EF9A3BF522EF8134B748
SHA-512:	222FD958DCF22F5F787EB4C24355D57F3391177729274EDED3D47E864D7A6DAFF11DFC23C58CC41D9AA752F167F81CDEF1F4534679492CD227F04BBDC79921FC
Malicious:	false
Reputation:	low
Preview:	2025/01/07-00:00:55.358 14e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/07-00:00:55.360 14e0 Recovering log #3.2025/01/07-00:00:55.361 14e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.149278078927091
Encrypted:	false
SSDEEP:	6:iOpFaUL+q2Pwkn2nKuAl9Ombzo2jMGIFUtLFa5d11ZmwlFaZYLVkwOwkn2nKuAlx:7pFaJvYfHAa8uFUtLFa5d11/lFaC5Jfg
MD5:	55140488F01D2E13BFD13B9FFC5ED707
SHA1:	E476BAE0D11839AC1C41BD7DF8B05F042A244EAD
SHA-256:	A6B088E6D8EA1457427F964BBFD36C7574C5C1346840DB5ECC568EF3511449B0
SHA-512:	78728429B9229EEAFC2820781865A099020F3400226702662F659B776A73821A666C6E0D41ACDC87AC06B06065BB3776D2DC45AF5B482767413C3918340BCC52
Malicious:	false
Reputation:	low
Preview:	2025/01/07-00:00:55.490 1398 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/07-00:00:55.499 1398 Recovering log #3.2025/01/07-00:00:55.500 1398 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.149278078927091
Encrypted:	false
SSDEEP:	6:iOpFaUL+q2Pwkn2nKuAl9Ombzo2jMGIFUtLFa5d11ZmwlFaZYLVkwOwkn2nKuAlx:7pFaJvYfHAa8uFUtLFa5d11/lFaC5Jfg
MD5:	55140488F01D2E13BFD13B9FFC5ED707
SHA1:	E476BAE0D11839AC1C41BD7DF8B05F042A244EAD
SHA-256:	A6B088E6D8EA1457427F964BBFD36C7574C5C1346840DB5ECC568EF3511449B0
SHA-512:	78728429B9229EEAFC2820781865A099020F3400226702662F659B776A73821A666C6E0D41ACDC87AC06B06065BB3776D2DC45AF5B482767413C3918340BCC52
Malicious:	false
Reputation:	low
Preview:	2025/01/07-00:00:55.490 1398 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/07-00:00:55.499 1398 Recovering log #3.2025/01/07-00:00:55.500 1398 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.977815470701912
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2hsBdOg2H1Acaq3QYiubInP7E4T3y:Y2sRdsZydMH13QYhbG7nby
MD5:	A27DAD9F31407280FE6D6C7445C0745A
SHA1:	5C33B550550E0841E06BF6748FD9BFB5C898C93B
SHA-256:	2B49C109A3540A47D65187EAB5174D7A360BBFBDBC3E3F7AD7EE7114CCFF525E
SHA-512:	141DB1D57B1B03D7782537A263BDCA4BE945812E6AECE00AEB3C24BE57B4224ED84A62947D02744FA5476F6369F96EEB099361EADC05354C6A3BA98319C6FC53
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13380786067919806","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":145239},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eae424d8-8c78-4696-9d50-7bbbc6142782.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.977815470701912
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2hsBdOg2H1Acaq3QYiubInP7E4T3y:Y2sRdsZydMH13QYhbG7nby
MD5:	A27DAD9F31407280FE6D6C7445C0745A
SHA1:	5C33B550550E0841E06BF6748FD9BFB5C898C93B
SHA-256:	2B49C109A3540A47D65187EAB5174D7A360BBFBDBC3E3F7AD7EE7114CCFF525E
SHA-512:	141DB1D57B1B03D7782537A263BDCA4BE945812E6AECE00AEB3C24BE57B4224ED84A62947D02744FA5476F6369F96EEB099361EADC05354C6A3BA98319C6FC53
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13380786067919806","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":145239},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4730
Entropy (8bit):	5.258261442463756
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7LEjpqcE7Z:etJCV4FiN/jTN/2r8Mta02fEhgO73goh
MD5:	6C6B1BF5292E43E07421B938E9636A0C
SHA1:	6C76AE9C95490A45C0008D47AF71DC2386D112AC
SHA-256:	A6F1BF97C6AD09B02866527798D6455E503FB4DBCF760EBC99F523C2FB3BA756
SHA-512:	CCC6C0350695CC2491892940D123C145FD225CDD093666D64FF9A910ED10992F53A1CA7662FDD110A61741C57140213AFB2764FA5E8A6C8EA52D1F4252162156
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.174743307707662
Encrypted:	false
SSDEEP:	6:iOpFaMFlL+q2Pwkn2nKuAl9OmbzNMxIFUtLFaKH1ZmwlFaAURLVkwOwkn2nKuAlG:7pFaMFIvYfHAa8jFUtLFaM1/lFaxH5JH
MD5:	0FDDB87EEE00349C4C64DB5B29286F15
SHA1:	6DAA001AA5C0BDDFF457A7259C083868348B2190
SHA-256:	CC46AEC352EA1CD9FF63C8F31216FF711EE2BF40B269A35A1877BD71CC267980
SHA-512:	12EC672B920EBE4DC7B1E38A7C61A6F8AA7953C4153738D44E6CAF5387CBD14DA2274053C677A4741798D0C6A3116BE3588DD7AC0865410C3A9216905FBA2CB1
Malicious:	false
Preview:	2025/01/07-00:00:55.663 1398 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/07-00:00:55.665 1398 Recovering log #3.2025/01/07-00:00:55.666 1398 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.174743307707662
Encrypted:	false
SSDEEP:	6:iOpFaMFlL+q2Pwkn2nKuAl9OmbzNMxIFUtLFaKH1ZmwlFaAURLVkwOwkn2nKuAlG:7pFaMFIvYfHAa8jFUtLFaM1/lFaxH5JH
MD5:	0FDDB87EEE00349C4C64DB5B29286F15
SHA1:	6DAA001AA5C0BDDFF457A7259C083868348B2190
SHA-256:	CC46AEC352EA1CD9FF63C8F31216FF711EE2BF40B269A35A1877BD71CC267980
SHA-512:	12EC672B920EBE4DC7B1E38A7C61A6F8AA7953C4153738D44E6CAF5387CBD14DA2274053C677A4741798D0C6A3116BE3588DD7AC0865410C3A9216905FBA2CB1
Malicious:	false
Preview:	2025/01/07-00:00:55.663 1398 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/07-00:00:55.665 1398 Recovering log #3.2025/01/07-00:00:55.666 1398 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444000191823784
Encrypted:	false
SSDEEP:	384:yezci5tLiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rIs3OazzU89UTTgUL
MD5:	DC6B47F126C15F9B2A0997296F82CD81
SHA1:	57BBFA0FBA42CC4AEB5B4BD90C521C0D4B444203
SHA-256:	9039466B1C14BB39A1B672DA495E591922821AB0FA34C60FD0869C9CD74CCB27
SHA-512:	60F7620680E8E8E8DE7EBB5EF259894D3C4CEA42C3238B635B0F568FB3F6247BA7D96D3634312C9D53599604C9506589F823058EF2B1AD95725AAE940EB7193D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7690460585405083
Encrypted:	false
SSDEEP:	48:7M46pA2ioyVyioyeoWoy1Cwoy1qKOioy1noy1AYoy1Wioy11ioyeioyBoy1noy1s:7D6pfuygBX2jinb9IVXEBodRBkI
MD5:	3528FF85AF46FDEE1F67AD5EC35E3A8C
SHA1:	8E5F8BB8E6584E5C8CA1DDE4F2B4666FEEFEB8FF
SHA-256:	39D17950548691A7A3CEB4E3D9E21F1BA434021ED37673208D8C3DACCEBCBAF4
SHA-512:	DE4F55C1D1D082A6D2B38CC0BA4AE105DB03EBBAEF537F24CF16C7431BD59CD9609F22EC497F8CF0A60FB9B3C1E0E7584D05FFB98CB1F35A51484F687875AC85
Malicious:	false
Preview:	.... .c.....P..1...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7895108629891827
Encrypted:	false
SSDEEP:	3:kkFklprlFRXfllXlE/HT8kRzXNNX8RolJuRdxLlGB9lQRYwpDdt:kK2RIT8QdNMa8RdWBwRd
MD5:	196ACEEC171AE04552737822CFA360E6
SHA1:	5952A7254123F31565C1F34ECDD6B54399A67271
SHA-256:	D5F1F5A6F20EF4BA197E368F703AE79F2269022BFE581B3BEF43FE65CC524597
SHA-512:	FBEC9FE81C133DA7FB1EE0AFA812C934F9B1CB3005DEC1A3DD06AC65BD0DCACA80D48224E6FA97216271C615370B3394F6E1D0914C637DD94990492B623397D8
Malicious:	false
Preview:	p...... ...........).`..(....................................................... ..........W.....M..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1668

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1668

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	243196
Entropy (8bit):	3.3450692389394283
Encrypted:	false
SSDEEP:	1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
MD5:	F5567C4FF4AB049B696D3BE0DD72A793
SHA1:	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
SHA-256:	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
SHA-512:	E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
Malicious:	false
Preview:	Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.364553916717658
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPyd5BnVoZcg1vRcR0YwRJKoAvJM3g98kUwPeUkwRe9:YvXKXerWZc0vBRJ5GMbLUkee9
MD5:	DCCD9018FEF73CE01E228A3DB1951687
SHA1:	87ED428CFFDD29E679FC7C004F763EB6860A5A23
SHA-256:	AA8448C189040F72F27C0F06E2CB56316D6724BBCE378126C9CA58E32EF671DF
SHA-512:	90307D1863C93F0D69C2C5F9294032610C6620860A3210A9546F8A5F228542FBB4BC19540CC9357CE31BF0D1D1E5029712C08E3A34B5AE064348F3928FF472C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.315123066722191
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPyd5BnVoZcg1vRcR0YwRJKoAvJfBoTfXpnrPeUkwRe9:YvXKXerWZc0vBRJ5GWTfXcUkee9
MD5:	289F13A31199C5AEBF92B45DE08A2403
SHA1:	CB00B6BA5B415773D47374C76D6543D5B96D1957
SHA-256:	9772311DB0A1F6145916DE861BB7D9F249D3ED1C038137DA8D6DBEA4FB6910F5
SHA-512:	11F78B1E1BF4E9D6BC9438821B4F4DF98BAD434FC922C2F4EF170DA40E5058C0EB8E8399307C250E4F0D1857ECE9ECD77D5CA23ED7512D0ABD7B155CAC79EEDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29382928094907
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPyd5BnVoZcg1vRcR0YwRJKoAvJfBD2G6UpnrPeUkwRe9:YvXKXerWZc0vBRJ5GR22cUkee9
MD5:	B853939462331A99E5F3D1B0888DD456
SHA1:	D41F5648AFA2A2E06C628548573B6F8B4CE752E8
SHA-256:	82C8B2F3A81C1B9ABE0557DD367B6D1D23B5AE422AB40FA84316E3BD8E6CC877
SHA-512:	ABF6F2ABE7CF5C3DD2CDFDD7568C410C1BCB9C993936BD2AE1C7A7BA1D29B4DF4ABEBC629DD3604DBA98BB85588725E525F22C9BB91397647BAEF437A0B3E7B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.351606195909324
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPyd5BnVoZcg1vRcR0YwRJKoAvJfPmwrPeUkwRe9:YvXKXerWZc0vBRJ5GH56Ukee9
MD5:	6CC0FD7D6FD2C219177125A064FF092E
SHA1:	B6F0207124BB7175352C778EE991953E0F2AF8DE
SHA-256:	3765097CDE57C094EE67F6974DF563F7D87D4B6312BCA21782F64CBEF9120037
SHA-512:	7AA02D7FD5A4831D96F5DAF3E72D4455E44442AD1093DF140D2409FEB4808906574BF57B034FD9F62C1E91B0A39890EE69BEF7E1D0FA8DAA26626FDE01AB8B67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688536016646167
Encrypted:	false
SSDEEP:	24:Yv6XeazvnJepLgE9cQx8LennAvzBvkn0RCmK8czOCCSvX:YvEfJehgy6SAFv5Ah8cv/vX
MD5:	EE0232F360489EBE461A2B97A181D657
SHA1:	F2DFB0FCB68BCEA71D16CDBA32F2CC11B07B3F7E
SHA-256:	A86A428E8F885277A95DFA6F184EBDA990DFE260A8E12BFD9CC63BBA1BE0B9D2
SHA-512:	7E8FF9CE655FC1C7F78BEE662C8C093DDEA29633DE572E9713A35D136997ADC83EE8311D9C5EDFEFF769831ED1DFF5CB790081AA08D423A868B11C65A1441EB4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298382368808233
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPyd5BnVoZcg1vRcR0YwRJKoAvJf8dPeUkwRe9:YvXKXerWZc0vBRJ5GU8Ukee9
MD5:	8AA77385044CB7EFD91ABB817082848E
SHA1:	83EC18ED5A43439B2D5243752F6E436E92CF3920
SHA-256:	FB27F726005C2773CC78DF5D076566C1BB7D1DBBD006BF62E3981129A2CD04BC
SHA-512:	03428E9BE87747931FB95FE746A32AB49FF5AAA5B0DB9D9081F719DD5C8D80241ADB37FBAF728A5D2EB38663E5A180BA510DB771B67AA8294BEE38D61321210C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.303416008398624
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPyd5BnVoZcg1vRcR0YwRJKoAvJfQ1rPeUkwRe9:YvXKXerWZc0vBRJ5GY16Ukee9
MD5:	30D4D42AE67963BD69EA96CF9E29CE6C
SHA1:	77319A6851AAC07078201FCB1491F18AE7138447
SHA-256:	C4A7FF13CF582B215302CF42640AE5E3E6700C2DA6B6618EC276CE6650A18C97
SHA-512:	DF61F37C3A4FC19A7147D475EB94EDDDCBE5A9EE9453144C397555CE4696DD8DC8CC32E983F495897AC1600041260EAC037EF845E7C0FCCB050C24E9A721DD27
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308190584821386
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPyd5BnVoZcg1vRcR0YwRJKoAvJfFldPeUkwRe9:YvXKXerWZc0vBRJ5Gz8Ukee9
MD5:	4E6D2212E36B8CEFAD7E63C40799B839
SHA1:	289CB5F18D1E84D1FB8E825BA496361D7FEFFE6C
SHA-256:	C668C95B1FEB2EB06B09EE5CC4BD99D59AA96376EE56D804A4ADBEDD8ACFDC81
SHA-512:	7EC99046821118CC75C0AD9A402878B5E8715121DBF3B555CD0155880C2AD7C9F25D24AB6427D0FF8BAE3E518BB91850EEDD7BC460E898E0AF3999CCB350AA78
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.322958412438471
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPyd5BnVoZcg1vRcR0YwRJKoAvJfzdPeUkwRe9:YvXKXerWZc0vBRJ5Gb8Ukee9
MD5:	9DB12787366B3B1176AA3FCA62108EC8
SHA1:	C763DBF1E6C48B847D8E7D3B96F108C2AD0AF57C
SHA-256:	05E97E39E41934892A1D0441F37FAA8B703C880AD9F68905988F44660A4F28BC
SHA-512:	949AC858E614C343EF8887D5603517B7C5D1AE052A76DB2F8F186E5462D4E12DD94D678B8F54F8A0BD86DC84F56D8671F76EAEF9AC16F43E0661211A31580638
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304466829970013
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPyd5BnVoZcg1vRcR0YwRJKoAvJfYdPeUkwRe9:YvXKXerWZc0vBRJ5Gg8Ukee9
MD5:	8E40543797456691171806878DF5BDBA
SHA1:	5EC64D2161AEDFB610BCBFF0DF24E269AEC830BE
SHA-256:	7D36320B4E17658991C24875D6FC6EEC6EFE02193B71CED09788164BA5A53F48
SHA-512:	F3889A108BFB5A839B8668768C58B522701E8DC7C2102CD7A4AD71CBDF3EA60A22DA6189906462E34D8897A88FB539BE22B3D48FFC6E08FA86B47B945BC81CAD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.290595844165598
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPyd5BnVoZcg1vRcR0YwRJKoAvJf+dPeUkwRe9:YvXKXerWZc0vBRJ5G28Ukee9
MD5:	23360A64A581D04F3D50C12931853D78
SHA1:	CB1B6ED4BDA128136DB6FB07577AD848DE754D9A
SHA-256:	C2CABDFC96B628F016B5B4B1125FB6900B65A14007E57976322C9F1B98169644
SHA-512:	71383D7306BA1C08A4CA0C83B066B3FFC6CA571A7529BEE4145D0F7DADCF08F33B124188DACA71D363990FA60E2894EBEE1116E8147E4DE0D31A8CDD21AE05ED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.28798322778154
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPyd5BnVoZcg1vRcR0YwRJKoAvJfbPtdPeUkwRe9:YvXKXerWZc0vBRJ5GDV8Ukee9
MD5:	DF6325A45021068D59F8369C314A0342
SHA1:	0268ADC31260ADD4FEB2C1FBBC864F8AFDF2E3EE
SHA-256:	671F299C0B85A47D4D8FE9052D897D08C85FDF61FC101D6494EAC599F6BDF5F0
SHA-512:	EF8EB77FFB20D748B7289FB4851E59247457DEF0A95024852761ECA6FABB5F6C8BC9887650688D0F19568F569ACFB4C829FEFC33401B22D8FB6E8279CA2F86FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.293536476102412
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPyd5BnVoZcg1vRcR0YwRJKoAvJf21rPeUkwRe9:YvXKXerWZc0vBRJ5G+16Ukee9
MD5:	07893F727E199B796128BAEA04C3DDEB
SHA1:	9A8FCFB27E58416ACF59AEACD5C94AB12067E7F7
SHA-256:	1C836AA873ADA54DB2205CA4948144B25453830224F23C4AD1DCE2A59AA2B8C8
SHA-512:	952CE0C7AABF8A05EBA7FCD78EFCA6ADABAEFFE3B363CF7B945ABD02DD71587A98A014C6B9BBC318EDAC9D967438D19684DD525277A9D6F6A00BA77D2A020D8E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664905735635253
Encrypted:	false
SSDEEP:	24:Yv6XeazvnJCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSvX:YvEfJcBgkDMUJUAh8cvMvX
MD5:	9F59AE348ACCBB33995F6455796E83F1
SHA1:	1EBE2DF77A46D802577DAC0C704C2E2DB738D15F
SHA-256:	A6693781079392B142AB525C12F7EE9EB6009236CA379B853CD2925328E703AC
SHA-512:	885E7FB1DC4F5C5C868524120F106C78743C3BB15AC499E344089E931A0FDCB7C9566BABA3FD354BE5A56ABA2684D8A1ADEB57C977587C4BE0CC850D1AE2E643
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.269072394519065
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPyd5BnVoZcg1vRcR0YwRJKoAvJfshHHrPeUkwRe9:YvXKXerWZc0vBRJ5GUUUkee9
MD5:	BE0463463D3174A2B7A9687B1A1D9623
SHA1:	188F29C942120DF6100493CF2A4EEC47A19CA397
SHA-256:	D8AF4F41DE09EA58497C8DDD93B33653CB7B8CAFF86F281BE4C7EEB2442343BC
SHA-512:	E72083376995AA44CA88596F1272D4CFA573E8F4D469F37CF174E05F25D30C468624FB06D2BAF02B9FBBE82D8DC7A70026E8592DCF06D160F8434B1EB9F8B957
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.282928397380754
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPyd5BnVoZcg1vRcR0YwRJKoAvJTqgFCrPeUkwRe9:YvXKXerWZc0vBRJ5GTq16Ukee9
MD5:	88D1C4AA869A27C8158E30ECF076DAD5
SHA1:	FB8F9A89BBCB2D4FB87135EBAD733E840CB345E5
SHA-256:	370546B299AE64313FB6994D4A64414AE34380DC0E898A52C06FB4993F1B79C4
SHA-512:	FEE8799342E956937CA25F683D9273E9BC92A35381294801B241DE4704F547FC5FCD396C3504F74CD11847924C2A7922FBA2C7C505F512FAAE4CDDF4A0E7116C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82b866ae-8a48-49a2-a867-438da11bcf7b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736399056814,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.123314609585867
Encrypted:	false
SSDEEP:	48:Y/SLGA2Qd9YdR4bOupWXJUTVaDGJ9Wn+Q3:EQN2Qd9KR4bOlixaDmGf3
MD5:	9B603F84A28A09CD7AC82B5D4CCE01D2
SHA1:	E2066BF87D8830E53967FD493511ECAD620B0128
SHA-256:	84F856E16FB262A0A483BB568842FE9B00CAED2E5F59DB8FE5292464EA46DB91
SHA-512:	297816EFD6B2565FE9DCD4501CA475E8AEF442B5F243C4C8D9A838DC8AE12E586ECB1B6D321F45AD14D188096F7D92C95A22661CD8D664EAE6DCB8200114019C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"64d1042759de0e0b1e2a021554316b4d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736226093000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"c030ce71a7b3069c7e2e0f2c8abb5594","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1736226093000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5c689f97f9199a619706022f87c816a9","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736226061000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"22e683d02ea3d1c28dcd73e4983739de","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736226061000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"fccd6b9cbebe8975087dca481db73838","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736226061000},{"id":"DC_FirstMile_Home_View_Surface","info":{"dg":"7d2697ac9f293aa941c23b20f9cc5bf1","sid":"DC_FirstMile_Home_View_Surface"},"mimeT

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1876937882972673
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUXJSvR9H9vxFGiDIAEkGVvpbt:lNVmswUUUUUUUU5+FGSIt9
MD5:	3DEF4E76CD04AC481469B498EB57987A
SHA1:	96B259BECBAF5591780E81CF86E5A0875D0064F8
SHA-256:	41592A0DFB501EDF0CEE6BD455E7B1FF731718F30F9E2B0EE7EF526D25A59230
SHA-512:	641E65DCA819E94B2399EE378537CA56260721A1060293EBE6CB28BB142055ADD81E53AFBD1418AA5343915CE7798751DAFF15923E58C61941D47641395C9971
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6059491356070688
Encrypted:	false
SSDEEP:	48:7MJKUUUUUUUUUUXhvR9H9vxFGiDIAEkGVvEqFl2GL7msB:7fUUUUUUUUUU1FGSItCKVmsB
MD5:	E48A310D2B24FFA9BB7C5AFDBC1F458C
SHA1:	3F54E9606ED5B0FB25D044EEDCE34517F46218D8
SHA-256:	132F031DE62B735F1E875B11C8171D69194DBD15D7D79E18C34773359AB3525D
SHA-512:	B004B169459A302D0B9D30A4CC176EA0594D16048371C31DD7640675815ECBB7AF253847C466D020222EE3A8D1A3181337D7D1C42F92FDB034FAF0A8581BF32D
Malicious:	false
Preview:	.... .c.....,.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgi3nbhOF6uTOUeVO3V0jmJ52+ZYyu:6a6TZ44ADEi3bhOF6uTOyC+ZK
MD5:	9586FE852D745CE2AB576BDD33137DA7
SHA1:	FA61C098094AEF1032424BF450E83CD03A328058
SHA-256:	00BB29389AAC550C9D8E29E9F60D01735110D7498B4A6E8300AA09273E1F57C7
SHA-512:	23C2C1EB4A1580CEACE54C88182B60D2B388F51B6818AAF31743DBC71D7E30E6E863BD53D83F91798A3936A844E2C7AD4A16D6FC5946D6120EEC2ABF6718D51C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSI89178.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4917080724083283
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8yQpClOlslwCH:Qw946cPbiOxDlbYnuRKTWIl
MD5:	9D44B7BD662A3D738EF3940217F73ABD
SHA1:	E7BD17847FAE2EC64919554FEBB3038DE6896F64
SHA-256:	7D0D32E8AF2D2F98A38D83492B12887AF9CF615CFA42FEE7580963BFCC97D746
SHA-512:	4423A22E8AD4055BF6A69395E032A2CC3A33A784B0BA56F1B80A07473681B8D552BE7324473006343BCB4AEC2A1A804CEC15FA9D5332C6E99DB84DAAFFF69C06
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.7./.0.1./.2.0.2.5. . .0.0.:.0.1.:.0.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-07 00-00-53-615.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	16605
Entropy (8bit):	5.360591790083004
Encrypted:	false
SSDEEP:	384:X2KX6Kr4BOxJkOs3JETW+RmQTaGz4eGOiJ+6M0E7C+/5f7BgQvLXOhOT2oOxDK69:WDrd
MD5:	11D086508CB7E29E7B2B325580313518
SHA1:	EE12EA56E73750F4EA66D2C0283C2B17504DF409
SHA-256:	FAEA1C6927EA51552FAD2950BFF0AE7118E003EDFE2C668F12990597AE2268F0
SHA-512:	FD0633FF8D092CC6C9CB68830603A7637A3CF85DA231167E7CC1805007D0162E6E629693F8144121F7B0CA195D8B4FBB90D3881DE388E0ED070D13AE64ADEFE4
Malicious:	false
Preview:	SessionID=b2ff3bc9-4d5e-47b8-8916-a8a12ab2c248.1736226053668 Timestamp=2025-01-07T00:00:53:668-0500 ThreadID=5628 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b2ff3bc9-4d5e-47b8-8916-a8a12ab2c248.1736226053668 Timestamp=2025-01-07T00:00:53:670-0500 ThreadID=5628 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b2ff3bc9-4d5e-47b8-8916-a8a12ab2c248.1736226053668 Timestamp=2025-01-07T00:00:53:670-0500 ThreadID=5628 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b2ff3bc9-4d5e-47b8-8916-a8a12ab2c248.1736226053668 Timestamp=2025-01-07T00:00:53:670-0500 ThreadID=5628 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b2ff3bc9-4d5e-47b8-8916-a8a12ab2c248.1736226053668 Timestamp=2025-01-07T00:00:53:670-0500 ThreadID=5628 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29845
Entropy (8bit):	5.382359280463053
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rS:+
MD5:	8664103D357712CA3221F1DA88F6058C
SHA1:	1B879CAF3A72B3317A69B46E8EE5E75D907BCD50
SHA-256:	417BAC2AE766A8E169CC3078C2DA7207FF3155BBE711A11A4C11ABE3994A0A74
SHA-512:	32A17803DB66C6746ED145A62D4BF384B2F504B35492CA586B12FDC9EC3B1DD0D14187192E6562C89211B7E7C89F0E8FC248147E9BFB718794CCD889B9D1F326
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\b25ef62c-d474-4ce0-a5c3-3cf219fe174b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c96ab8fd-f338-4d74-b815-981a96fd6c7d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\eb7e6e51-1e6e-4492-8e78-99dd841a2d9f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ef35247a-eab2-4893-87af-5074cbcb86e2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\Desktop\~$65rymIuO.doc

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.655933165847645
Encrypted:	false
SSDEEP:	3:KVGl/lilKlRAGlLv3WQtQdD9yvpbTnCkfnqfn:KVy/4KDdnpT7in
MD5:	EEAFC1805283A30AF0351E19379DB8D7
SHA1:	159175EB78A95AEE5D36362A4B1C7637B8A89DD3
SHA-256:	A40E210B70B16D23D9FEA5BF8172C1B2681628BD6503E7E783150407BD1C6A60
SHA-512:	789525A0767099393BF028BCE9BD918DBBE971C555CFA9980D6FDDCA4A463B29FA146550F64D196D93BA1A4D6F82269CA16CC8152446EF5FF2B4BE11E883799C
Malicious:	false
Preview:	.user..................................................j.o.n.e.s.........GQ.e.GET..!J.D@BZ..Q1""K......`......1*H...D.I.I'...`...........&z.}..i......y..=.i

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.997560538515653
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41%
File name:	H565rymIuO.doc
File size:	772'883 bytes
MD5:	162dd4e4ed6c0ef700b3c95385b5dc0a
SHA1:	1afc58e221337c3f8b18dc97e3156f8dbcc7d119
SHA256:	25fe7ce806195948532624d2c2462ec952da03a3312abd79de06aa2423da03f8
SHA512:	9f0a61a472232c6ed8dfcc4573a52143221862abcd282c82129047621a9fb547ca9a0d3058e2fd61151ec4c7254b0dbf67bb537b40314eec7ec21496292e147e
SSDEEP:	12288:PgQZ2ZnS2Q57FPCSX3IOwatF3UhqmecJ3baH5d8nncr9/KU4SEkgqCzPrF2:P4ZSLBqK3UeF3UVTJ2wncdJ4SEkgqcJ2
TLSH:	83F423C60EEF903481B9FFF413414CA3B5B229265B2945433B78D51C6EF84BAC796A78
File Content Preview:	PK.........a]Ys"P)............[Content_Types].xmlUT..... g.. g.. g.V.N.0.._....E.[...j.....n.......d.....7.B..B....9.1s.vF..k...I{W.a5`.8..v..=Ln.sV$.N....l..]....&... .K5.#...'9.+R..8Zi\|...5.x..I.....g\z........;2....^D...t....7.....":V\..,]3...R ../N}.-

File Icon


Icon Hash:	35e1cc889a8a8599

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	2

OLE File "H565rymIuO.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	4
Total Edit Time:	0
Create Time:	2024-10-29T02:17:00Z
Last Saved Time:	2024-10-29T06:44:00Z
Number of Pages:	1
Number of Words:	12
Number of Characters:	71
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	1
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1Ole10Native, File Type: data, Stream Size: 721346

General
Stream Path:	\x1Ole10Native
CLSID:
File Type:	data
Stream Size:	721346
Entropy:	7.687301120111189
Base64 Encoded:	True
Data ASCII:	. . . . . 2 4 0 9 2 4 ? ? ? ? ? ? ? ? ? ? ? ? ? . p d f . C : \\ U s e r s \\ 9 1 9 7 4 \\ O n e D r i v e \\ D e s k t o p \\ W o r d F i l e \\ N E W F I L E S \\ 2 4 0 9 2 4 ? ? ? ? ? ? ? ? ? ? ? ? ? . p d f . . . . . = . . . C : \\ U s e r s \\ 9 1 9 7 4 \\ A p p D a t a \\ L o c a l \\ T e m p \\ 2 4 0 9 2 4 ? ? ? ? ? ? ? ? ? ? ? ? ? . p d f . . . % P D F - 1 . 7 . % . . . . 1 0 o b j . < < / A c r o F o r m 6 4 0 R / M e t a d a t a 6 3 0 R / P a g e s 3 0 R / T y p
Data Raw:	be 01 0b 00 02 00 32 34 30 39 32 34 20 3f 3f 3f 3f 3f 20 3f 3f 3f 3f 20 3f 3f 3f 3f 2e 70 64 66 00 43 3a 5c 55 73 65 72 73 5c 39 31 39 37 34 5c 4f 6e 65 44 72 69 76 65 5c 44 65 73 6b 74 6f 70 5c 57 6f 72 64 46 69 6c 65 5c 4e 45 57 46 49 4c 45 53 5c 32 34 30 39 32 34 20 3f 3f 3f 3f 3f 20 3f 3f 3f 3f 20 3f 3f 3f 3f 2e 70 64 66 00 00 00 03 00 3d 00 00 00 43 3a 5c 55 73 65 72 73 5c 39

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 01 00

OLE File "H565rymIuO.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	4
Total Edit Time:	0
Create Time:	2024-10-29T02:17:00Z
Last Saved Time:	2024-10-29T06:44:00Z
Number of Pages:	1
Number of Words:	12
Number of Characters:	71
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	1
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.8475846798245739
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 0d 00

Stream Path: CONTENTS, File Type: PDF document, version 1.7, 1 pages, Stream Size: 56395

General
Stream Path:	CONTENTS
CLSID:
File Type:	PDF document, version 1.7, 1 pages
Stream Size:	56395
Entropy:	7.879183004467334
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 7 . . 4 0 o b j . ( I d e n t i t y ) . e n d o b j . 5 0 o b j . ( A d o b e ) . e n d o b j . 8 0 o b j . < < . / F i l t e r / F l a t e D e c o d e . / L e n g t h 3 1 7 3 8 . / L e n g t h 1 4 0 2 7 6 0 . / T y p e / S t r e a m . > > . s t r e a m . x } . \| \\ U 9 r % . I 2 Y & I I t . i i . $ ) P V v , H A _ ~ . . . / " L d u m = = s = . . A . ! ? * l X _ . . . } . . z . f , ^ > z 6 4 # / . \\ m 3 . . # { . l 8 . 0 } F . E . 6 o } . . ? a ? . k . . " . q . Z . [
Data Raw:	25 50 44 46 2d 31 2e 37 0a 0a 34 20 30 20 6f 62 6a 0a 28 49 64 65 6e 74 69 74 79 29 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 28 41 64 6f 62 65 29 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 0a 2f 4c 65 6e 67 74 68 20 33 31 37 33 38 0a 2f 4c 65 6e 67 74 68 31 20 34 30 32 37 36 30 0a 2f 54 79 70 65 20 2f

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-07T06:00:31.139877+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	104.21.74.191	443	TCP
2025-01-07T06:00:32.230249+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49742	104.21.74.191	443	TCP
2025-01-07T06:00:32.734610+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	104.21.74.191	443	TCP
2025-01-07T06:00:33.393281+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49746	104.21.74.191	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 06:00:30.674509048 CET	49741	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:30.674540043 CET	443	49741	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:30.674665928 CET	49741	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:30.675307035 CET	49741	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:30.675323009 CET	443	49741	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:31.139712095 CET	443	49741	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:31.139877081 CET	49741	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:31.172694921 CET	49741	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:31.172733068 CET	443	49741	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:31.173075914 CET	443	49741	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:31.185197115 CET	49741	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:31.231342077 CET	443	49741	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:31.327296019 CET	443	49741	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:31.327404976 CET	443	49741	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:31.327505112 CET	49741	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:31.550482988 CET	49741	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:31.550513029 CET	443	49741	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:31.604218960 CET	49742	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:31.604264975 CET	443	49742	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:31.604346037 CET	49742	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:31.605643988 CET	49742	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:31.605663061 CET	443	49742	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.071098089 CET	443	49742	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.071177959 CET	49742	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.084322929 CET	49742	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.084352016 CET	443	49742	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.084651947 CET	443	49742	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.084763050 CET	49742	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.085813999 CET	49742	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.131325006 CET	443	49742	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.230254889 CET	443	49742	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.230349064 CET	49742	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.230365038 CET	443	49742	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.230391979 CET	443	49742	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.230432034 CET	49742	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.230458975 CET	49742	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.232358932 CET	49742	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.232373953 CET	443	49742	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.250757933 CET	49744	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.250797033 CET	443	49744	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.250938892 CET	49744	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.251204014 CET	49744	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.251219988 CET	443	49744	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.733855009 CET	443	49744	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.734610081 CET	49744	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.734637976 CET	443	49744	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.735639095 CET	49744	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.735649109 CET	443	49744	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.924501896 CET	443	49744	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.924596071 CET	443	49744	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.924662113 CET	49744	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.924799919 CET	49744	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.924824953 CET	443	49744	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.924839973 CET	49744	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.924849033 CET	443	49744	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.926666975 CET	49746	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.926716089 CET	443	49746	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:32.926964045 CET	49746	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.927227020 CET	49746	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:32.927251101 CET	443	49746	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:33.392750978 CET	443	49746	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:33.393280983 CET	49746	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:33.393312931 CET	443	49746	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:33.394257069 CET	49746	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:33.394263029 CET	443	49746	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:33.588969946 CET	443	49746	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:33.589056015 CET	443	49746	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:33.589152098 CET	49746	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:33.589287043 CET	49746	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:33.589308023 CET	443	49746	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:33.589318037 CET	49746	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:33.589327097 CET	443	49746	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:33.670447111 CET	49747	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:33.670490980 CET	443	49747	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:33.670597076 CET	49747	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:33.670972109 CET	49747	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:33.670989037 CET	443	49747	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:34.136698008 CET	443	49747	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:34.136850119 CET	49747	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:34.141027927 CET	49747	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:34.141038895 CET	443	49747	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:34.141597986 CET	49747	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:34.141602993 CET	443	49747	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:34.335009098 CET	443	49747	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:34.335086107 CET	443	49747	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:34.335568905 CET	49747	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:34.335592031 CET	49747	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:34.335592031 CET	49747	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:34.343667030 CET	49748	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:34.343715906 CET	443	49748	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:34.343832970 CET	49748	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:34.344075918 CET	49748	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:34.344086885 CET	443	49748	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:34.642595053 CET	49747	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:34.642630100 CET	443	49747	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:34.826239109 CET	443	49748	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:34.826534033 CET	49748	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:34.826981068 CET	49748	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:34.826987982 CET	443	49748	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:34.827388048 CET	49748	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:34.827393055 CET	443	49748	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:35.000188112 CET	443	49748	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:35.000281096 CET	443	49748	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:35.000314951 CET	443	49748	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:35.000349998 CET	443	49748	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:35.000468969 CET	49748	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:35.000468969 CET	49748	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:35.000468969 CET	49748	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:35.000482082 CET	443	49748	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:35.000550032 CET	443	49748	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:35.000699997 CET	49748	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:35.001907110 CET	49748	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:35.001924038 CET	443	49748	104.21.74.191	192.168.2.4
Jan 7, 2025 06:00:35.001939058 CET	49748	443	192.168.2.4	104.21.74.191
Jan 7, 2025 06:00:35.002041101 CET	49748	443	192.168.2.4	104.21.74.191

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 06:00:30.657018900 CET	64164	53	192.168.2.4	1.1.1.1
Jan 7, 2025 06:00:30.673280001 CET	53	64164	1.1.1.1	192.168.2.4
Jan 7, 2025 06:01:08.225682020 CET	55178	53	192.168.2.4	1.1.1.1
Jan 7, 2025 06:01:24.348793983 CET	58985	53	192.168.2.4	1.1.1.1
Jan 7, 2025 06:01:48.424173117 CET	57899	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 06:00:30.657018900 CET	192.168.2.4	1.1.1.1	0x76a5	Standard query (0)	acesso.run	A (IP address)	IN (0x0001)	false
Jan 7, 2025 06:01:08.225682020 CET	192.168.2.4	1.1.1.1	0x5c85	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 7, 2025 06:01:24.348793983 CET	192.168.2.4	1.1.1.1	0x5b46	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 7, 2025 06:01:48.424173117 CET	192.168.2.4	1.1.1.1	0xeffd	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 06:00:30.673280001 CET	1.1.1.1	192.168.2.4	0x76a5	No error (0)	acesso.run		104.21.74.191	A (IP address)	IN (0x0001)	false
Jan 7, 2025 06:00:30.673280001 CET	1.1.1.1	192.168.2.4	0x76a5	No error (0)	acesso.run		172.67.162.95	A (IP address)	IN (0x0001)	false
Jan 7, 2025 06:01:08.237143040 CET	1.1.1.1	192.168.2.4	0x5c85	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 06:01:24.357666016 CET	1.1.1.1	192.168.2.4	0x5b46	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 06:01:48.431516886 CET	1.1.1.1	192.168.2.4	0xeffd	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

acesso.run

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	104.21.74.191	443	7424	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2025-01-07 05:00:31 UTC	323	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive Authorization: Bearer User-Agent: Microsoft Office Word 2014 X-Office-Major-Version: 16 X-MS-CookieUri-Requested: t X-FeatureVersion: 1 Accept-Auth: badger,Wlid1.1,Bearer,Basic,NTLM,Digest,Kerberos,Negotiate,Nego2 X-MSGETWEBURL: t X-IDCRL_ACCEPTED: t Host: acesso.run
2025-01-07 05:00:31 UTC	1008	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 05:00:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Allow: GET,HEAD cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kbHNUKqlWtfxqGyZFlZLoqMJvymRF7tpbEfHVn%2BUIPyA8PMa2Bb4UN6vinpHXbT5Hn6dtYIhdKmmV9nZRlU5nXQRxTFEhHmGNXb4LkkdkytGmjlI%2BFqibLKRliKv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe162773c4342da-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1747&min_rtt=1740&rtt_var=668&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=937&delivery_rate=1619523&cwnd=227&unsent_bytes=0&cid=23210e710b744b8b&ts=199&x=0"
2025-01-07 05:00:31 UTC	13	IN	Data Raw: 38 0d 0a 47 45 54 2c 48 45 41 44 0d 0a Data Ascii: 8GET,HEAD
2025-01-07 05:00:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	104.21.74.191	443	7424	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2025-01-07 05:00:32 UTC	226	OUT	OPTIONS / HTTP/1.1 Authorization: Bearer X-MS-CookieUri-Requested: t X-FeatureVersion: 1 X-IDCRL_ACCEPTED: t User-Agent: Microsoft Office Protocol Discovery Host: acesso.run Content-Length: 0 Connection: Keep-Alive
2025-01-07 05:00:32 UTC	1012	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 05:00:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Allow: GET,HEAD cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8Fdw13gy2PxZ8HXEa%2BjI9kxDrvbowFh%2F%2FNKiTv2FEkuHKgTXLf5yr9e%2BCClYRu1ym0JtycUkqpo56zFkZpnDk3xsAfbJ43JWeny8igSSmvhl4JO1EQzItNPg0Is6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe1627cdb6378e8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1788&min_rtt=1776&rtt_var=690&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2824&recv_bytes=840&delivery_rate=1557333&cwnd=230&unsent_bytes=0&cid=4a3e1c7f281f8674&ts=166&x=0"
2025-01-07 05:00:32 UTC	13	IN	Data Raw: 38 0d 0a 47 45 54 2c 48 45 41 44 0d 0a Data Ascii: 8GET,HEAD
2025-01-07 05:00:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49744	104.21.74.191	443	7424	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2025-01-07 05:00:32 UTC	433	OUT	HEAD /bkeoxH?&bondsman=troubled&shrimp=harsh&sewer=tense&cold=warlike&briefs=unsuitable&oasis=numberless&cowbell=rough&airport=lowly&dust HTTP/1.1 Connection: Keep-Alive Authorization: Bearer User-Agent: Microsoft Office Word 2014 X-Office-Major-Version: 16 X-MS-CookieUri-Requested: t X-FeatureVersion: 1 Accept-Auth: badger,Wlid1.1,Bearer,Basic,NTLM,Digest,Kerberos,Negotiate,Nego2 X-IDCRL_ACCEPTED: t Host: acesso.run
2025-01-07 05:00:32 UTC	1032	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 07 Jan 2025 05:00:32 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 38 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Location: /404 Vary: Accept cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sbIX4aqkyYmRXJ5PdYWZGLQjnogY206227iS0GblVyRs3Wxvuoa8y%2F2dKW7NUlCTk3%2BQ0VT6vZvoUjrs6BFSwQzhhGuOGYkTQC7OuqidVyCVSwjd7YP0ln%2F8VRim"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe162811fd94398-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1615&min_rtt=1601&rtt_var=610&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1047&delivery_rate=1823860&cwnd=230&unsent_bytes=0&cid=d2fd1441b4d82d0b&ts=195&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49746	104.21.74.191	443	7424	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2025-01-07 05:00:33 UTC	305	OUT	HEAD /404 HTTP/1.1 Connection: Keep-Alive Authorization: Bearer User-Agent: Microsoft Office Word 2014 X-Office-Major-Version: 16 X-MS-CookieUri-Requested: t X-FeatureVersion: 1 Accept-Auth: badger,Wlid1.1,Bearer,Basic,NTLM,Digest,Kerberos,Negotiate,Nego2 X-IDCRL_ACCEPTED: t Host: acesso.run
2025-01-07 05:00:33 UTC	1016	IN	HTTP/1.1 404 Not Found Date: Tue, 07 Jan 2025 05:00:33 GMT Content-Type: text/html; charset=utf-8 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Powered-By: Next.js Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f4nSKkpaCGVjL5BN4HxeD7qBSTdqN8NNYfpoAUrZR%2FtaUxgDcJgcCkmOG%2FI6hQj23I9eXMrJ9g2ubXUAlyHl9FPz8IEUBXHGwRWGVFiDhWSBS3aAKBmSwZhoJFKm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe162854a886a5e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1589&min_rtt=1583&rtt_var=605&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=919&delivery_rate=1790312&cwnd=187&unsent_bytes=0&cid=636c565d03f5dca1&ts=202&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	104.21.74.191	443	7424	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2025-01-07 05:00:34 UTC	298	OUT	GET /bkeoxH?&bondsman=troubled&shrimp=harsh&sewer=tense&cold=warlike&briefs=unsuitable&oasis=numberless&cowbell=rough&airport=lowly&dust HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16) Accept-Encoding: gzip, deflate Host: acesso.run Connection: Keep-Alive
2025-01-07 05:00:34 UTC	1029	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 07 Jan 2025 05:00:34 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 38 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Location: /404 Vary: Accept cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TTYSCKvSc7dpc1j6Im6xG1aaqOZJ2%2F4xnBfcll2FdM5G3kQII1Z9eVxjSGUJEVYKhgrWLTTUVlMSkjXUYJ%2FoaH3Wktq48TBZMG8fE0V48cUECqvRuWiU7ibumgL0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe16289defd431f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1653&min_rtt=1631&rtt_var=628&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=880&delivery_rate=1790312&cwnd=250&unsent_bytes=0&cid=28a01e6ccf9223da&ts=204&x=0"
2025-01-07 05:00:34 UTC	38	IN	Data Raw: 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 2f 34 30 34 Data Ascii: Moved Permanently. Redirecting to /404

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49748	104.21.74.191	443	7424	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2025-01-07 05:00:34 UTC	170	OUT	GET /404 HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16) Accept-Encoding: gzip, deflate Host: acesso.run Connection: Keep-Alive
2025-01-07 05:00:34 UTC	1046	IN	HTTP/1.1 404 Not Found Date: Tue, 07 Jan 2025 05:00:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Powered-By: Next.js Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k21thlJ02v4fq30wgNkg%2FVjjuwMw8kyF6CIhhd22o33gYRy%2Bw1j1yLfDZdL5obgue605iMO%2B23pQLejJFKwSjXZKO55gJqrP4s5JUnTixta2cKO57ilqAx5uAG5Q"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe1628e09e1f793-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1462&min_rtt=1457&rtt_var=557&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2824&recv_bytes=752&delivery_rate=1944074&cwnd=152&unsent_bytes=0&cid=7b51643410143d2f&ts=178&x=0"
2025-01-07 05:00:34 UTC	323	IN	Data Raw: 31 32 32 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 72 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 75 6e 64 65 66 69 6e 65 64 20 69 73 20 61 20 66 72 65 65 20 61 6e 64 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 55 52 4c 20 73 68 6f 72 74 65 6e 65 72 20 77 69 74 68 20 63 75 73 74 6f 6d 20 64 6f 6d 61 Data Ascii: 1225<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover"/><meta name="description" content="undefined is a free and open source URL shortener with custom doma
2025-01-07 05:00:34 UTC	1369	IN	Data Raw: 3d 4e 75 6e 69 74 6f 3a 33 30 30 2c 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 36 78 31 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2d 31 39 36 78 31 39 36 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2d 31 36 78 31 36 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d Data Ascii: =Nunito:300,400,700" rel="stylesheet"/><link rel="icon" sizes="196x196" href="/images/favicon-196x196.png"/><link rel="icon" sizes="32x32" href="/images/favicon-32x32.png"/><link rel="icon" sizes="16x16" href="/images/favicon-16x16.png"/><link rel="apple-
2025-01-07 05:00:34 UTC	1369	IN	Data Raw: 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6e 65 78 74 2d 68 65 61 64 2d 63 6f 75 6e 74 22 20 63 6f 6e 74 65 6e 74 3d 22 33 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 75 6d 32 32 67 32 4c 50 38 4b 6f 30 6a 6b 31 76 48 72 50 43 63 2f 70 61 67 65 73 2f 5f 61 70 70 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 72 75 6e 74 69 6d 65 2f 77 65 62 70 61 63 6b 2d 31 63 35 31 39 39 66 66 36 36 35 35 30 64 32 36 65 34 39 39 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 2f 3e 3c 6c 69 Data Ascii: could not be found</title><meta name="next-head-count" content="3"/><link rel="preload" href="/_next/static/um22g2LP8Ko0jk1vHrPCc/pages/_app.js" as="script"/><link rel="preload" href="/_next/static/runtime/webpack-1c5199ff66550d26e499.js" as="script"/><li
2025-01-07 05:00:34 UTC	1369	IN	Data Raw: 68 31 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 34 39 70 78 3b 68 65 69 67 68 74 3a 34 39 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 22 3e 3c 68 32 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 22 3e 54 68 69 73 20 70 61 67 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 21 2d 2d 20 2d 2d 3e 2e 3c 2f 68 32 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e Data Ascii: h1><div style="display:inline-block;text-align:left;line-height:49px;height:49px;vertical-align:middle"><h2 style="font-size:14px;font-weight:normal;line-height:inherit;margin:0;padding:0">This page could not be found... -->.</h2></div></div></div></div>
2025-01-07 05:00:34 UTC	223	IN	Data Raw: 61 37 33 30 66 63 34 35 32 39 36 61 32 30 2e 6a 73 22 20 61 73 79 6e 63 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 75 6d 32 32 67 32 4c 50 38 4b 6f 30 6a 6b 31 76 48 72 50 43 63 2f 5f 62 75 69 6c 64 4d 61 6e 69 66 65 73 74 2e 6a 73 22 20 61 73 79 6e 63 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 75 6d 32 32 67 32 4c 50 38 4b 6f 30 6a 6b 31 76 48 72 50 43 63 2f 5f 73 73 67 4d 61 6e 69 66 65 73 74 2e 6a 73 22 20 61 73 79 6e 63 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: a730fc45296a20.js" async=""></script><script src="/_next/static/um22g2LP8Ko0jk1vHrPCc/_buildManifest.js" async=""></script><script src="/_next/static/um22g2LP8Ko0jk1vHrPCc/_ssgManifest.js" async=""></script></body></html>
2025-01-07 05:00:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	00:00:18
Start date:	07/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0xc50000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:00:52
Start date:	07/01/2025
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff761170000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:00:52
Start date:	07/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" -Embedding
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:00:55
Start date:	07/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:00:55
Start date:	07/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1628,i,12917579598302854451,16205094258031201980,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report H565rymIuO.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eae424d8-8c78-4696-9d50-7bbbc6142782.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1668

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1668

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Windows Analysis Report
H565rymIuO.doc