Edit tour

Windows Analysis Report
https://biomed.acemlna.com/lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8

Overview

General Information

Sample URL:	https://biomed.acemlna.com/lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8
Analysis ID:	1590704
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected suspicious crossdomain redirect

Drops files with a non-matching file extension (content does not match file extension)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3008 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6176 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1920,i,12792980649255489656,8554723798385530938,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://biomed.acemlna.com/lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

Acrobat.exe (PID: 4708 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 336 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2908 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1636,i,14815952976559255675,4518855623878817845,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://www.biomed.fi/favicon.ico

Avira URL Cloud: Label: phishing

Source: https://www.biomed.fi/wp-content/uploads/2021/04/biomed_nivelrikko-opas.pdf?vgo_ee=%2FS1cjsyVLpybBvx0Pqo9L5VTu1I2a3To5WfgNt%2BmfMJU23oiOO442Q%3D%3D%3AomExxXzuc1SH6H%2FIX90WR1SaV6O4pNQf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: biomed.activehosted.com to https://www.biomed.fi/wp-content/uploads/2021/04/biomed_nivelrikko-opas.pdf?vgo_ee=%2fs1cjsyvlpybbvx0pqo9l5vtu1i2a3to5wfgnt%2bmfmju23oioo442q%3d%3d%3aomexxxzuc1sh6h%2fix90wr1sav6o4pnqf

Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	UDP traffic detected without corresponding DNS query: 104.40.149.189
Source: unknown	UDP traffic detected without corresponding DNS query: 104.40.149.189
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8 HTTP/1.1Host: biomed.acemlna.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8 HTTP/1.1Host: biomed.activehosted.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/04/biomed_nivelrikko-opas.pdf?vgo_ee=%2FS1cjsyVLpybBvx0Pqo9L5VTu1I2a3To5WfgNt%2BmfMJU23oiOO442Q%3D%3D%3AomExxXzuc1SH6H%2FIX90WR1SaV6O4pNQf HTTP/1.1Host: www.biomed.fiConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.biomed.fiConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.biomed.fi/wp-content/uploads/2021/04/biomed_nivelrikko-opas.pdf?vgo_ee=%2FS1cjsyVLpybBvx0Pqo9L5VTu1I2a3To5WfgNt%2BmfMJU23oiOO442Q%3D%3D%3AomExxXzuc1SH6H%2FIX90WR1SaV6O4pNQfAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/04/biomed_nivelrikko-opas.pdf?vgo_ee=%2FS1cjsyVLpybBvx0Pqo9L5VTu1I2a3To5WfgNt%2BmfMJU23oiOO442Q%3D%3D%3AomExxXzuc1SH6H%2FIX90WR1SaV6O4pNQf HTTP/1.1Host: www.biomed.fiConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: biomed.acemlna.com
Source: global traffic	DNS traffic detected: DNS query: biomed.activehosted.com
Source: global traffic	DNS traffic detected: DNS query: www.biomed.fi
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 14 Jan 2025 13:15:26 GMTContent-Type: text/htmlContent-Length: 3143Connection: closeVary: Accept-EncodingETag: "67808ff0-c47"X-Container: biomed_45e69bX-Edge-Location: FI-C2X-Powered-By: SeravoX-Seravo-Request-Id: 02e787647371fa58a7c193a6dee988f5

Source: chromecache_216.7.dr, 012cb5c7-b207-4073-8918-5806c3bc9a76.tmp.5.dr, downloaded.pdf.crdownload.5.dr	String found in binary or memory: http://cipa.jp/exif/1.0/
Source: 77EC63BDA74BD0D0E0426DC8F80085060.15.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: chromecache_216.7.dr, 012cb5c7-b207-4073-8918-5806c3bc9a76.tmp.5.dr, downloaded.pdf.crdownload.5.dr	String found in binary or memory: http://prismstandard.org/namespaces/prismusagerights/2.1/
Source: 2D85F72862B55C4EADD9E66E06947F3D0.15.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: ReaderMessages.14.dr	String found in binary or memory: https://www.adobe.co

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1920,i,12792980649255489656,8554723798385530938,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://biomed.acemlna.com/lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8"
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1636,i,14815952976559255675,4518855623878817845,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1920,i,12792980649255489656,8554723798385530938,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1636,i,14815952976559255675,4518855623878817845,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 216
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 216			Jump to dropped file

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
file:///C:/Users/user/Downloads/downloaded.pdf	0%	Avira URL Cloud	safe
https://biomed.activehosted.com/lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8	0%	Avira URL Cloud	safe
https://www.biomed.fi/favicon.ico	100%	Avira URL Cloud	phishing
http://prismstandard.org/namespaces/prismusagerights/2.1/	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
fi-coltrane.seravo.com	95.217.107.11	true	false	high
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
biomed.acemlna.com	54.235.205.181	true	false	unknown
www.google.com	216.58.206.36	true	false	high
biomed.activehosted.com	104.17.202.31	true	false	unknown
x1.i.lencr.org	unknown	unknown	false	high
www.biomed.fi	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Downloads/downloaded.pdf	false	Avira URL Cloud: safe	unknown
https://biomed.acemlna.com/lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8	false		unknown
https://biomed.activehosted.com/lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8	false	Avira URL Cloud: safe	unknown
https://www.biomed.fi/wp-content/uploads/2021/04/biomed_nivelrikko-opas.pdf?vgo_ee=%2FS1cjsyVLpybBvx0Pqo9L5VTu1I2a3To5WfgNt%2BmfMJU23oiOO442Q%3D%3D%3AomExxXzuc1SH6H%2FIX90WR1SaV6O4pNQf	false		unknown
https://www.biomed.fi/favicon.ico	false	Avira URL Cloud: phishing	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.15.dr	false		high
https://www.adobe.co	ReaderMessages.14.dr	false		high
http://cipa.jp/exif/1.0/	chromecache_216.7.dr, 012cb5c7-b207-4073-8918-5806c3bc9a76.tmp.5.dr, downloaded.pdf.crdownload.5.dr	false		high
http://prismstandard.org/namespaces/prismusagerights/2.1/	chromecache_216.7.dr, 012cb5c7-b207-4073-8918-5806c3bc9a76.tmp.5.dr, downloaded.pdf.crdownload.5.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
95.217.107.11	fi-coltrane.seravo.com	Germany	24940	HETZNER-ASDE	false
54.235.205.181	biomed.acemlna.com	United States	14618	AMAZON-AESUS	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.17.202.31	biomed.activehosted.com	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590704
Start date and time:	2025-01-14 14:14:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://biomed.acemlna.com/lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@39/58@9/6
Cookbook Comments:	Found PDF document Close Viewer

Input	Output
URL: https://biomed.acemlna.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://biomed.acemlna.com
URL: https://www.biomed.fi/wp-content/uploads/2021/04/biomed_nivelrikko-opas.pdf?vgo_ee=%2FS1cjsyVLpybBvx0Pqo9L5VTu1I2a3To5WfgNt%2BmfMJU23oiOO442Q%3D%3D%3AomExxXzuc1SH6H%2FIX90WR1SaV6O4pNQf Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Nivelrikko Osteoartroosi", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: file:///C:/Users/user/Downloads/downloaded.pdf Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: file:///C:/Users/user/Downloads/downloaded.pdf Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.biomed.fi/wp-content/uploads/2021/04/biomed_nivelrikko-opas.pdf?vgo_ee=%2FS1cjsyVLpybBvx0Pqo9L5VTu1I2a3To5WfgNt%2BmfMJU23oiOO442Q%3D%3D%3AomExxXzuc1SH6H%2FIX90WR1SaV6O4pNQf Model: Joe Sandbox AI	{ "brands": [ "Biomed" ] }
	{ "brands": [ "Biomed" ] }
URL: file:///C:/Users/user/Downloads/downloaded.pdf Model: Joe Sandbox AI	{ "brands": [ "Biomed" ] }
	{ "brands": [ "Biomed" ] }
URL: file:///C:/Users/user/Downloads/downloaded.pdf Model: Joe Sandbox AI	{ "brands": [ "Biomed" ] }
	{ "brands": [ "Biomed" ] }

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.2330276274909115
Encrypted:	false
SSDEEP:	6:iO8jL9Wq2PcNwi2nKuAl9OmbnIFUtWjLLlhZmwojLuDkwOcNwi2nKuAl9OmbjLJ:7A9WvLZHAahFUtaj/cw54ZHAaSJ
MD5:	78EE3D275C09184487EE094D4D2396F0
SHA1:	CD791BC9FB1A55A70BA558BC05F5B071B646FF28
SHA-256:	83E83C5E26134EC37A623921D0ACC8C5AF14B5D01DFC4E06C384F04CE3A106D2
SHA-512:	90599C629A529F703539F37DB2550D6AAF8157EE824D841867087257817130DF707834DDEA52B92DB409D0F67448FC82E3755F36163AE504C1BBB05AEF3F5509
Malicious:	false
Reputation:	low
Preview:	2025/01/14-10:13:44.833 730 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-10:13:44.835 730 Recovering log #3.2025/01/14-10:13:44.836 730 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.4
Category:	dropped
Size (bytes):	1477681
Entropy (8bit):	7.935387866817141
Encrypted:	false
SSDEEP:	24576:eeHsKpfoJyuW2uZM5qovS+BN0OEiWoYLIzJydxPfe/Taae2slg:VZJXh+NuOEiWoYuJcxPfebzslg
MD5:	A5D27C70B33856981096F83733BE406A
SHA1:	BA65A5BD4488CFA89D8EA134B1D8CC7476EE60A7
SHA-256:	35BBB43F0452E6E97FC2C61AC30797B1B1FB139729AAF4459126A7E3469A3C6D
SHA-512:	73C31FA44DFA1DEC03D533A74103B057D50A20D917AC44DFA9BC2D7CA82701F0D1F8C39B2623B9CB92B57348D49F88C5AAEB3AA962548B1405A3D13FADFDC08B
Malicious:	false
Reputation:	low
Preview:	%PDF-1.4.%......1817 0 obj.<</Linearized 1/L 1477681/O 1819/E 63746/N 12/T 1441224/H [ 975 493]>>.endobj. .xref..1817 33..0000000016 00000 n..0000001681 00000 n..0000001844 00000 n..0000002900 00000 n..0000003015 00000 n..0000003165 00000 n..0000003322 00000 n..0000003361 00000 n..0000007109 00000 n..0000011581 00000 n..0000015675 00000 n..0000020428 00000 n..0000025175 00000 n..0000029243 00000 n..0000029624 00000 n..0000029911 00000 n..0000030283 00000 n..0000034792 00000 n..0000039137 00000 n..0000041787 00000 n..0000042016 00000 n..0000042245 00000 n..0000042516 00000 n..0000049093 00000 n..0000049349 00000 n..0000049719 00000 n..0000055870 00000 n..0000056132 00000 n..0000056477 00000 n..0000063128 00000 n..0000063385 00000 n..0000001468 00000 n..0000000975 00000 n..trailer.<</Size 1850/Root 1818 0 R/Info 152 0 R/ID[<494DF82DB5754BBCAE2352D5019FF4E8><0EE797C3EBB9454EA403748E24C2297B>]/Prev 1441211/XRefStm 1468>>.startxref.0.%%EOF. .1849 0 obj.<</C 464/Filte

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 14:15:15.978441000 CET	53	51703	1.1.1.1	192.168.2.7
Jan 14, 2025 14:15:16.200989962 CET	53	50213	1.1.1.1	192.168.2.7
Jan 14, 2025 14:15:16.574285030 CET	123	123	192.168.2.7	104.40.149.189
Jan 14, 2025 14:15:16.763495922 CET	123	123	104.40.149.189	192.168.2.7
Jan 14, 2025 14:15:17.215300083 CET	53	63514	1.1.1.1	192.168.2.7
Jan 14, 2025 14:15:18.098144054 CET	123	123	192.168.2.7	104.40.149.189
Jan 14, 2025 14:15:18.275134087 CET	123	123	104.40.149.189	192.168.2.7
Jan 14, 2025 14:15:19.957046986 CET	56629	53	192.168.2.7	1.1.1.1
Jan 14, 2025 14:15:19.957941055 CET	50358	53	192.168.2.7	1.1.1.1
Jan 14, 2025 14:15:19.963958025 CET	53	56629	1.1.1.1	192.168.2.7
Jan 14, 2025 14:15:19.964833021 CET	53	50358	1.1.1.1	192.168.2.7
Jan 14, 2025 14:15:21.998898983 CET	61059	53	192.168.2.7	1.1.1.1
Jan 14, 2025 14:15:21.999150991 CET	56396	53	192.168.2.7	1.1.1.1
Jan 14, 2025 14:15:22.013242960 CET	53	56396	1.1.1.1	192.168.2.7
Jan 14, 2025 14:15:22.013410091 CET	53	61059	1.1.1.1	192.168.2.7
Jan 14, 2025 14:15:22.771842003 CET	53187	53	192.168.2.7	1.1.1.1
Jan 14, 2025 14:15:22.772094011 CET	59768	53	192.168.2.7	1.1.1.1
Jan 14, 2025 14:15:22.781635046 CET	53	59768	1.1.1.1	192.168.2.7
Jan 14, 2025 14:15:22.781646013 CET	53	53187	1.1.1.1	192.168.2.7
Jan 14, 2025 14:15:23.686676979 CET	50591	53	192.168.2.7	1.1.1.1
Jan 14, 2025 14:15:23.687203884 CET	55359	53	192.168.2.7	1.1.1.1
Jan 14, 2025 14:15:23.738523960 CET	53	55359	1.1.1.1	192.168.2.7
Jan 14, 2025 14:15:23.756268024 CET	53	50591	1.1.1.1	192.168.2.7
Jan 14, 2025 14:15:34.121624947 CET	53	56367	1.1.1.1	192.168.2.7
Jan 14, 2025 14:15:53.275804996 CET	53	61837	1.1.1.1	192.168.2.7
Jan 14, 2025 14:16:12.311378956 CET	138	138	192.168.2.7	192.168.2.255
Jan 14, 2025 14:16:15.590100050 CET	53	63863	1.1.1.1	192.168.2.7
Jan 14, 2025 14:16:15.729399920 CET	53	64418	1.1.1.1	192.168.2.7
Jan 14, 2025 14:16:43.488111019 CET	52448	53	192.168.2.7	1.1.1.1

Timestamp	Bytes transferred	Direction	Data
2025-01-14 13:15:22 UTC	764	OUT	GET /lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8 HTTP/1.1 Host: biomed.acemlna.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-14 13:15:22 UTC	352	IN	HTTP/1.1 307 Temporary Redirect cache-control: public, max-age=2628000 location: https://biomed.activehosted.com/lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8 date: Tue, 14 Jan 2025 13:15:22 GMT content-length: 0 x-envoy-upstream-service-time: 1 server: istio-envoy connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-14 13:15:23 UTC	769	OUT	GET /lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8 HTTP/1.1 Host: biomed.activehosted.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-14 13:15:23 UTC	1353	IN	HTTP/1.1 302 Found Date: Tue, 14 Jan 2025 13:15:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close location: https://www.biomed.fi/wp-content/uploads/2021/04/biomed_nivelrikko-opas.pdf?vgo_ee=%2FS1cjsyVLpybBvx0Pqo9L5VTu1I2a3To5WfgNt%2BmfMJU23oiOO442Q%3D%3D%3AomExxXzuc1SH6H%2FIX90WR1SaV6O4pNQf Cache-Control: no-store, no-cache, must-revalidate expires: Thu, 19 Nov 1981 08:52:00 GMT pragma: no-cache Set-Cookie: PHPSESSID=36e899d7ff51f55f0851113e5040ad61; path=/; secure; HttpOnly; SameSite=Lax x-content-type-options: nosniff x-privacy-policy: You can find our privacy policy here: https://www.activecampaign.com/help/privacy-policy/ x-request-id: 8b214bd104c9d28eba99250f512387e2 x-robots-tag: noindex CF-Cache-Status: DYNAMIC Set-Cookie: cmp66048732=a2d612129dfe4b9399506b9a9416acfd; expires=Thu, 13-Feb-2025 13:15:23 GMT; Max-Age=2592000; path=/; domain=.biomed.activehosted.com; secure; SameSite=Lax Set-Cookie: __cf_bm=pFuXg.ptqRD9rGnb8c4Q3wx0S3sgTtS1ztvtvdNr35w-1736860523-1.0.1.1-Awa7GWhqkiyvgGXlDNH2VCeq.VWIrhKxK.WkqlKpT7EbtLdC8HuarAkzHhK77YG1pJKMHuQr9S4nHjgeTig1Ag; path=/; expires=Tue, 14-Jan-25 13:45:23 GMT; domain=.activehosted.com; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Server: cloudflare CF-RAY: 901de4fef90343f1-EWR

Timestamp	Bytes transferred	Direction	Data
2025-01-14 13:15:24 UTC	818	OUT	GET /wp-content/uploads/2021/04/biomed_nivelrikko-opas.pdf?vgo_ee=%2FS1cjsyVLpybBvx0Pqo9L5VTu1I2a3To5WfgNt%2BmfMJU23oiOO442Q%3D%3D%3AomExxXzuc1SH6H%2FIX90WR1SaV6O4pNQf HTTP/1.1 Host: www.biomed.fi Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-14 13:15:24 UTC	616	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 14 Jan 2025 13:15:24 GMT Content-Type: application/pdf Content-Length: 1477681 Connection: close Last-Modified: Wed, 21 Apr 2021 15:30:58 GMT ETag: "60804532-168c31" X-Container: biomed_45e69b Strict-Transport-Security: max-age=63072000; Content-Security-Policy: upgrade-insecure-requests X-Proxy-Cache: MISS P: A: N: H:0 O: S:bytes=0-5242879 Accept-Ranges: bytes X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Edge-Location: FI-C2 X-Powered-By: Seravo X-Seravo-Request-Id: 0104ce1d866b3cd78d3774c4517f59d6
2025-01-14 13:15:24 UTC	15768	IN	Data Raw: 25 50 44 46 2d 31 2e 34 0d 25 e2 e3 cf d3 0d 0a 31 38 31 37 20 30 20 6f 62 6a 0d 3c 3c 2f 4c 69 6e 65 61 72 69 7a 65 64 20 31 2f 4c 20 31 34 37 37 36 38 31 2f 4f 20 31 38 31 39 2f 45 20 36 33 37 34 36 2f 4e 20 31 32 2f 54 20 31 34 34 31 32 32 34 2f 48 20 5b 20 39 37 35 20 34 39 33 5d 3e 3e 0d 65 6e 64 6f 62 6a 0d 20 20 20 20 20 20 20 20 20 20 0d 78 72 65 66 0d 0a 31 38 31 37 20 33 33 0d 0a 30 30 30 30 30 30 30 30 31 36 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 30 30 31 36 38 31 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 30 30 31 38 34 34 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 30 30 32 39 30 30 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 30 30 33 30 31 35 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 30 30 33 31 36 35 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 Data Ascii: %PDF-1.4%1817 0 obj<</Linearized 1/L 1477681/O 1819/E 63746/N 12/T 1441224/H [ 975 493]>>endobj xref1817 330000000016 00000 n0000001681 00000 n0000001844 00000 n0000002900 00000 n0000003015 00000 n0000003165 00000 n0000
2025-01-14 13:15:24 UTC	16384	IN	Data Raw: 8a 9a cf 1b 60 93 18 0b f4 8a d3 6c 49 24 8b 45 72 c4 f5 dd 77 df ff f8 c3 f5 f8 c7 65 57 c3 9f 5d 36 f2 de d9 e7 e5 33 ee 65 b6 ae d7 97 07 5f 7d 79 3c c7 6d 7e d9 bd 96 5d 3f 3f 9e fd 0e b7 cb ef ec 83 e2 ba 67 f7 6b de 63 1f 71 ed 09 71 c6 be 20 ec 36 ae 75 b7 b6 28 cc 61 10 6c f6 eb 45 c5 01 c5 75 f7 ae 77 fc 87 67 4c 0a 54 c1 73 4b d1 ef 95 fd ea b7 f7 ce 03 fc 76 cf 2b ee bd 20 fd f5 f1 e7 c7 1f 1f bf fb 09 a6 7c f3 fb bf fd e5 97 7f fe e9 fa f6 db 6f 7e fa e1 0f 3f 5e 63 7c 62 e4 ea 77 f7 b9 2f cf 7e 6f 9b f3 57 23 03 37 e8 17 8c eb c6 63 fc 8e 35 29 0e 4a 79 b7 6d d7 73 df 2b 24 79 83 aa b5 bb f5 bc f2 36 38 82 92 af bc c6 bd 69 0f a4 8e 0b be 1e 03 8e 70 c9 b0 7d dc b1 eb c3 c0 8f e3 ee 70 a8 3e 8c 84 aa dd 73 ea c8 8d 5d 7f 7e b4 3b f1 09 7c 1f Data Ascii: `lI$ErweW]63e_}y<m~]??gkcqq 6u(alEuwgLTsKv+ \|o~?^c\|bw/~oW#7c5)Jyms+$y68ip}p>s]~;\|
2025-01-14 13:15:25 UTC	16384	IN	Data Raw: 2b 11 7a 8c 90 00 05 d8 35 4c 29 d9 15 8c 17 7b e5 e7 47 b5 26 74 7b 41 57 ea aa 93 9c 9f 46 22 5b 2d 67 33 39 65 a4 90 3e 6a 8c 52 f3 c5 ae 90 2b 14 8d 84 8a 5d 2f 04 17 31 f2 d0 2a f7 51 a4 69 4a ec 41 97 90 ef d0 a9 72 f8 ea b2 3a 93 9c a4 a9 91 6a 4c 45 38 cc e4 6a 6d c8 4d 16 31 9c 6d 8e a8 c4 2e ad aa f2 b1 48 2e 25 1d 35 24 16 d1 f7 b3 e2 27 a9 cc e8 2c af 89 ad 27 1b 18 10 ed 24 d0 b8 3a 43 17 d9 24 6d eb 44 1c 05 57 1b 02 ef 35 a5 ee cc 62 2f 33 a9 87 98 31 f9 27 4f 26 1b 21 66 74 0a 3b 95 ca a4 3d 4c 03 d6 2b 32 a9 29 ea df 10 c9 48 5d 73 15 49 a2 8a 52 d9 72 a9 89 a8 3a 96 5c 37 bb 04 5a 64 0b 61 35 31 37 2d d2 0a 8d d8 1a 20 0d 7b 51 93 01 64 62 72 ab f8 79 77 d6 27 57 af 93 22 c6 53 f0 1c 61 02 df 54 ce b3 66 41 62 c9 96 91 48 a5 c9 77 52 5c Data Ascii: +z5L){G&t{AWF"[-g39e>jR+]/1*QiJAr:jLE8jmM1m.H.%5$','$:C$mDW5b/31'O&!ft;=L+2)H]sIRr:\7Zda517- {Qdbryw'W"SaTfAbHwR\
2025-01-14 13:15:25 UTC	16384	IN	Data Raw: 3d 33 9c 29 64 9e 49 a7 9c 54 b2 90 74 06 b3 c7 a6 72 99 e1 91 82 f3 a2 b3 73 47 f3 8e 46 fe 35 3f e4 74 66 b3 c3 4f a7 9d 47 b3 b9 63 d9 5c b2 90 c9 8e 6f df d3 79 a0 f3 b1 bd b1 fd c7 d2 e3 fd c9 f1 fc 17 77 85 3b 22 38 99 bc 93 74 0a b9 64 2a 3d 96 cc 3d e5 64 87 bc b5 93 e3 29 67 2c 39 e5 1c 4d 3b b9 f4 70 26 5f 48 e7 78 a8 cc b8 33 98 ce 15 92 e4 a3 93 b9 4c 3e 95 19 94 dd f3 db d1 8e 0c 86 49 05 d2 33 48 23 05 87 94 64 3f 49 69 10 59 1c c3 14 35 25 b3 46 38 ea e0 45 d2 4e ec 40 33 a9 d1 95 9a f1 10 47 3b 39 3b cb 79 4f 73 1d 07 8f 52 ce f1 6d f9 4f ea f5 b3 18 c7 76 ec e1 bc 03 a4 c7 b0 17 31 ec e7 8c 34 c7 fb 39 67 9c 55 61 1f 7b c3 98 e4 1a 49 be f7 c5 73 ff 9b a7 5e df 59 1b 71 78 42 f9 97 7b 17 f4 99 53 9c 31 a6 cf f1 14 c7 b2 f4 9c f5 77 94 37 Data Ascii: =3)dITtrsGF5?tfOGc\oyw;"8td*==d)g,9M;p&_Hx3L>I3H#d?IiY5%F8EN@3G;9;yOsRmOv149gUa{Is^YqxB{S1w7
2025-01-14 13:15:25 UTC	16384	IN	Data Raw: be 9b a6 bb 24 f1 22 82 37 5c 05 5e ec fa a1 9f d0 20 26 74 17 b8 41 1a a5 5e 40 e1 77 e2 c6 41 92 a4 f1 8e 3c 95 ab eb df c9 f6 e1 e8 91 e6 48 6e 7e 27 bf ad 6e be c2 3b b7 0f a7 4c 20 e6 bb 4c 3c 93 35 13 57 9f af 9d ed d7 4f b7 3f 13 9f 52 83 ec b7 d5 f5 7e b5 fd 04 ef 7f 6a 88 e7 06 5e 0a 9f 61 08 1f 7e 18 10 d2 3c 89 0e dd 76 bf f7 88 4f f6 df 57 a1 a7 e0 c1 57 14 bb f1 8e ee e0 67 ea d2 1d 3c 76 5f ae d6 bf de fe f3 e6 ee db ed 97 2f f7 e4 e6 ee 96 dc 3f ec 6f ee 7f fa b6 ff 76 7f ff 70 eb ec 5f 56 37 fb 51 84 df f9 d5 df 6e 3b 84 81 41 08 f8 f4 eb 0c 18 bf 05 e3 6b 30 3b 75 72 47 4c ae 48 90 78 6e 94 d2 18 b1 fc b1 fe e6 ec c8 5a 36 8e 4f d6 67 c7 87 cf 4a 90 ac c8 b8 60 82 14 52 92 dc a1 91 8b 87 1d 3f 25 eb 57 e6 44 ea 42 f8 80 93 2f 19 69 38 3f Data Ascii: $"7\^ &tA^@wA<Hn~'n;L L<5WO?R~j^a~<vOWWg<v_/?ovp_V7Qn;Ak0;urGLHxnZ6OgJ`R?%WDB/i8?
2025-01-14 13:15:25 UTC	16384	IN	Data Raw: c2 31 0a d7 3a 10 9f b4 77 50 2d 8e b3 9a 3d a3 16 62 ab 9e 85 58 03 f5 89 b0 46 3b a8 3c ed c5 f1 86 d9 45 1a a0 99 c9 9d 0c 12 33 c4 0c 60 80 77 1b 11 ea 37 d8 e3 84 96 1f 07 55 cf 53 35 55 0f 50 f5 02 34 80 b1 5b 9e 05 fd 79 c6 29 c7 3c 9d e2 f0 66 eb 22 5b 34 28 ac 01 17 2d f9 88 38 c7 35 d8 d1 16 62 9e 96 21 29 d5 09 70 58 9d b6 db b6 f8 1a e0 b2 6a 52 39 19 9d 3c 68 ba 51 19 1c 9f 53 6c 67 ba 28 ed 5c 8e 1b 52 24 91 9d 62 ed eb eb 8c db 72 76 dc 70 66 a6 17 3e 5d f7 df db e5 8c f2 89 d5 48 e4 d4 50 ea 0e 2c 08 b6 38 4a b3 aa 99 9e 9a 89 81 36 fc f8 cd 2a ce ca 47 36 58 1d 4f f0 58 e1 28 33 dd 48 fc c8 24 6f b5 b1 f9 83 d8 f1 65 0c 05 af 7c 7a 3e 0f d4 78 67 1f 87 b2 3f ff d3 87 f2 dc 8b 00 4e 36 b3 1a 3f 98 e0 91 ce e2 c3 d3 be 3f 54 4f 1b 3a d4 d4 Data Ascii: 1:wP-=bXF;<E3`w7US5UP4[y)<f"[4(-85b!)pXjR9<hQSlg(\R$brvpf>]HP,8J6*G6XOX(3H$oe\|z>xg?N6??TO:
2025-01-14 13:15:25 UTC	16384	IN	Data Raw: 88 34 72 0d 20 8f d5 69 e5 48 26 fb 63 75 74 f9 99 67 67 90 35 cf 3c 57 0e 4b 09 9a c6 5a 96 5e a4 71 c6 35 33 1b 1d 8d b8 f9 60 85 3a 6d ec cb 65 bb 41 2d 77 8e 33 aa a9 1a 5a 8a d6 4d 41 99 20 04 85 0a dc 00 05 b0 4a 1a 38 ae 8b e3 31 ca f6 c2 07 84 33 c9 b3 6c 96 78 9a a7 ea 95 89 66 67 05 81 65 24 5e d6 26 c4 63 16 aa 9d 92 34 d3 3d cb 07 17 39 f1 0c 14 be 14 cf f2 f6 aa 68 c6 76 a6 11 22 92 4d d4 de f6 ec 0e e3 1d 6a a1 bb 22 fc 8f 49 d9 88 b5 e6 2a d9 60 9a a6 a6 58 c3 96 97 48 55 0a 4e fb f3 c7 a5 b0 c7 37 84 0b ea 16 b2 5a cc da 8b 42 54 16 92 9a 79 9a 28 f4 0d 4e 80 0b 86 3f 85 f0 36 d8 c5 f4 34 c2 4d 05 2c 98 d5 34 70 94 91 6a 23 69 4e 92 7e c8 0c 2c 47 1e d8 1d 6e 0d 50 6c 21 f8 23 39 a8 cb b3 d4 48 8b 40 86 52 8c 8c 76 17 3a b6 f9 e3 0e b2 a5 Data Ascii: 4r iH&cutgg5<WKZ^q53`:meA-w3ZMA J813lxfge$^&c4=9hv"Mj"I*`XHUN7ZBTy(N?64M,4pj#iN~,GnPl!#9H@Rv:
2025-01-14 13:15:25 UTC	16384	IN	Data Raw: f1 d9 c3 07 3d d9 3a d9 4f 4b 5d 63 b4 81 22 96 30 42 af bf 20 0f 4d b1 ca dc f0 7b c0 e9 4f f4 23 42 96 65 d2 1c 0f 53 76 be f7 c7 35 9c 9e ef 18 3c 36 a2 a7 65 47 15 3a d5 77 01 41 20 11 6d 89 f5 c7 b6 f7 e4 7a ed 3f 1a ac a6 39 03 e8 8c 15 65 d4 07 17 db 60 6c 76 f9 e3 f6 36 9f 92 81 9d 8d 5b 2f 57 41 a5 5c 5a c4 ef bd ce c0 0f 6c 68 7e b1 cd 7a a7 e1 5b 54 eb 4a da 58 f4 af 7d 69 f6 4d c5 ee 7e 64 63 da 31 e4 f5 93 e0 0d f8 9a 9e 67 82 49 03 c9 be f6 57 3c 72 0a 8e e2 f8 2b a7 92 c9 82 d4 60 e2 cd 05 6f 45 e7 61 15 4d 3d d1 c2 0b 6a be c2 e4 ed 72 07 df 8d 8e bd bd 0c ca 79 3f 7a dc ae ae 6a 7f a5 24 c5 c3 8b a1 d4 2d d4 d3 e6 16 ec 7d 31 f9 0b 12 78 3f 65 07 8c 9c 3a 4f d1 28 66 62 0b 49 d3 03 cb 2b 02 74 8b df d3 f3 1c 76 96 d6 8f 45 90 99 e1 7a e8 Data Ascii: =:OK]c"0B M{O#BeSv5<6eG:wA mz?9e`lv6[/WA\Zlh~z[TJX}iM~dc1gIW<r+`oEaM=jry?zj$-}1x?e:O(fbI+tvEz
2025-01-14 13:15:25 UTC	16384	IN	Data Raw: f6 c1 05 62 91 c7 d1 b4 64 25 a3 a5 9d dd cd 43 c4 b2 c8 44 43 60 cf 62 2e 08 27 db b6 34 a9 b4 7e 7a 33 8f 5b 4f 3d 3c 9a ed d5 52 0b 47 15 f6 20 dc 5f 1d 61 24 cf c7 03 f2 a3 cb e8 d2 13 2d 6b f9 67 bb 47 12 93 e4 6e fc f1 fc 1e 3c 95 8f 3c 1e 2a cf d4 88 16 18 a4 62 f1 c6 9b c2 06 c1 c8 e4 00 3b e3 cc bc 9e 7a 33 89 51 d7 a9 95 7c cc b3 33 dc 80 7c a1 46 fc 5f 1d 56 11 e8 e1 93 a5 49 2d 5c 3e 67 94 c6 b0 a1 f3 5e c0 80 4d fe 43 1c e4 93 3f 36 1f c2 10 cb d5 a7 64 78 ba 8c 85 54 10 5a fd ee 7d 0f 7c 7e fb cf 57 13 f5 67 e8 32 19 15 19 57 9d 5b ad c1 f6 fe 17 1e 2e 4f c7 13 c4 56 74 92 66 62 24 47 05 cd cd ce fd 92 ff 00 76 c3 1e dd 4e 6e 26 57 36 ab e8 ca e0 c6 64 9c 3f 94 9d 88 da d6 03 1a 20 8e 33 06 39 9c 92 33 4d 55 2b ab 06 26 32 c3 95 03 6b 7a 9f Data Ascii: bd%CDC`b.'4~z3[O=<RG _a$-kgGn<<*b;z3Q\|3\|F_VI-\>g^MC?6dxTZ}\|~Wg2W[.OVtfb$GvNn&W6d? 393MU+&2kz
2025-01-14 13:15:25 UTC	16384	IN	Data Raw: 0f 0e a2 8e 29 25 d2 86 3a c3 d3 07 ac a0 99 51 40 bb de c0 72 47 7c 7b c6 47 ea 8b 4b cb e6 3f 75 9e 54 ac 88 a9 5a 78 54 29 03 b1 b8 3f 6c 0f 71 b6 f8 fc ec 72 95 39 47 eb 4b 5b 01 15 10 2b 29 61 22 86 76 6b 87 2d 76 fe 0f 9c 78 d1 ca cd 3b ea 79 39 c6 5d f4 af 07 e6 30 b2 49 55 32 29 90 03 6b 28 f3 58 af 73 ce 3d 54 bd 63 3d 6b 16 a1 4f 96 84 d2 41 af a0 67 75 62 cc b2 0b 12 aa 01 b0 1c de f6 c6 57 1d ab 3d 43 b2 af 2c f2 32 ec 8f 5c 2d 56 8e d1 f5 56 ed 05 b7 2c 4f d9 b6 f6 fc 71 de 8a 78 dd f5 0c 77 2e 70 64 7c 62 ab 92 d3 c9 34 84 08 65 50 75 33 6f 1a 58 dc 36 dd ed 8e 1a b7 b3 e3 33 7a 34 d6 5f 62 7f f8 ab 35 5c d3 35 ad ab 55 b2 cb 21 0a a0 9b 04 1b 0e 6f db 18 65 31 0f 59 3f 49 37 2f 36 70 60 24 2a 92 05 d8 da fc ed 8f c8 b3 0b 89 e4 df b0 37 24 Data Ascii: )%:Q@rG\|{GK?uTZxT)?lqr9GK[+)a"vk-vx;y9]0IU2)k(Xs=Tc=kOAgubW=C,2\-VV,Oqxw.pd\|b4ePu3oX63z4_b5\5U!oe1Y?I7/6p`$*7$

Timestamp	Bytes transferred	Direction	Data
2025-01-14 13:15:26 UTC	744	OUT	GET /favicon.ico HTTP/1.1 Host: www.biomed.fi Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.biomed.fi/wp-content/uploads/2021/04/biomed_nivelrikko-opas.pdf?vgo_ee=%2FS1cjsyVLpybBvx0Pqo9L5VTu1I2a3To5WfgNt%2BmfMJU23oiOO442Q%3D%3D%3AomExxXzuc1SH6H%2FIX90WR1SaV6O4pNQf Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-14 13:15:26 UTC	318	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 14 Jan 2025 13:15:26 GMT Content-Type: text/html Content-Length: 3143 Connection: close Vary: Accept-Encoding ETag: "67808ff0-c47" X-Container: biomed_45e69b X-Edge-Location: FI-C2 X-Powered-By: Seravo X-Seravo-Request-Id: 02e787647371fa58a7c193a6dee988f5
2025-01-14 13:15:26 UTC	3143	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 2f 2a 21 20 6e Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>404 - Not Found</title> <style type="text/css">/*! n

Timestamp	Bytes transferred	Direction	Data
2025-01-14 13:15:27 UTC	490	OUT	GET /wp-content/uploads/2021/04/biomed_nivelrikko-opas.pdf?vgo_ee=%2FS1cjsyVLpybBvx0Pqo9L5VTu1I2a3To5WfgNt%2BmfMJU23oiOO442Q%3D%3D%3AomExxXzuc1SH6H%2FIX90WR1SaV6O4pNQf HTTP/1.1 Host: www.biomed.fi Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-14 13:15:27 UTC	616	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 14 Jan 2025 13:15:27 GMT Content-Type: application/pdf Content-Length: 1477681 Connection: close Last-Modified: Wed, 21 Apr 2021 15:30:58 GMT ETag: "60804532-168c31" X-Container: biomed_45e69b Strict-Transport-Security: max-age=63072000; Content-Security-Policy: upgrade-insecure-requests X-Proxy-Cache: MISS P: A: N: H:0 O: S:bytes=0-5242879 Accept-Ranges: bytes X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Edge-Location: FI-C2 X-Powered-By: Seravo X-Seravo-Request-Id: 58a1b2050e64b19bf83311b96e57120c
2025-01-14 13:15:27 UTC	15768	IN	Data Raw: 25 50 44 46 2d 31 2e 34 0d 25 e2 e3 cf d3 0d 0a 31 38 31 37 20 30 20 6f 62 6a 0d 3c 3c 2f 4c 69 6e 65 61 72 69 7a 65 64 20 31 2f 4c 20 31 34 37 37 36 38 31 2f 4f 20 31 38 31 39 2f 45 20 36 33 37 34 36 2f 4e 20 31 32 2f 54 20 31 34 34 31 32 32 34 2f 48 20 5b 20 39 37 35 20 34 39 33 5d 3e 3e 0d 65 6e 64 6f 62 6a 0d 20 20 20 20 20 20 20 20 20 20 0d 78 72 65 66 0d 0a 31 38 31 37 20 33 33 0d 0a 30 30 30 30 30 30 30 30 31 36 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 30 30 31 36 38 31 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 30 30 31 38 34 34 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 30 30 32 39 30 30 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 30 30 33 30 31 35 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 30 30 33 31 36 35 20 30 30 30 30 30 20 6e 0d 0a 30 30 30 30 Data Ascii: %PDF-1.4%1817 0 obj<</Linearized 1/L 1477681/O 1819/E 63746/N 12/T 1441224/H [ 975 493]>>endobj xref1817 330000000016 00000 n0000001681 00000 n0000001844 00000 n0000002900 00000 n0000003015 00000 n0000003165 00000 n0000
2025-01-14 13:15:27 UTC	16384	IN	Data Raw: 8a 9a cf 1b 60 93 18 0b f4 8a d3 6c 49 24 8b 45 72 c4 f5 dd 77 df ff f8 c3 f5 f8 c7 65 57 c3 9f 5d 36 f2 de d9 e7 e5 33 ee 65 b6 ae d7 97 07 5f 7d 79 3c c7 6d 7e d9 bd 96 5d 3f 3f 9e fd 0e b7 cb ef ec 83 e2 ba 67 f7 6b de 63 1f 71 ed 09 71 c6 be 20 ec 36 ae 75 b7 b6 28 cc 61 10 6c f6 eb 45 c5 01 c5 75 f7 ae 77 fc 87 67 4c 0a 54 c1 73 4b d1 ef 95 fd ea b7 f7 ce 03 fc 76 cf 2b ee bd 20 fd f5 f1 e7 c7 1f 1f bf fb 09 a6 7c f3 fb bf fd e5 97 7f fe e9 fa f6 db 6f 7e fa e1 0f 3f 5e 63 7c 62 e4 ea 77 f7 b9 2f cf 7e 6f 9b f3 57 23 03 37 e8 17 8c eb c6 63 fc 8e 35 29 0e 4a 79 b7 6d d7 73 df 2b 24 79 83 aa b5 bb f5 bc f2 36 38 82 92 af bc c6 bd 69 0f a4 8e 0b be 1e 03 8e 70 c9 b0 7d dc b1 eb c3 c0 8f e3 ee 70 a8 3e 8c 84 aa dd 73 ea c8 8d 5d 7f 7e b4 3b f1 09 7c 1f Data Ascii: `lI$ErweW]63e_}y<m~]??gkcqq 6u(alEuwgLTsKv+ \|o~?^c\|bw/~oW#7c5)Jyms+$y68ip}p>s]~;\|
2025-01-14 13:15:27 UTC	16384	IN	Data Raw: 2b 11 7a 8c 90 00 05 d8 35 4c 29 d9 15 8c 17 7b e5 e7 47 b5 26 74 7b 41 57 ea aa 93 9c 9f 46 22 5b 2d 67 33 39 65 a4 90 3e 6a 8c 52 f3 c5 ae 90 2b 14 8d 84 8a 5d 2f 04 17 31 f2 d0 2a f7 51 a4 69 4a ec 41 97 90 ef d0 a9 72 f8 ea b2 3a 93 9c a4 a9 91 6a 4c 45 38 cc e4 6a 6d c8 4d 16 31 9c 6d 8e a8 c4 2e ad aa f2 b1 48 2e 25 1d 35 24 16 d1 f7 b3 e2 27 a9 cc e8 2c af 89 ad 27 1b 18 10 ed 24 d0 b8 3a 43 17 d9 24 6d eb 44 1c 05 57 1b 02 ef 35 a5 ee cc 62 2f 33 a9 87 98 31 f9 27 4f 26 1b 21 66 74 0a 3b 95 ca a4 3d 4c 03 d6 2b 32 a9 29 ea df 10 c9 48 5d 73 15 49 a2 8a 52 d9 72 a9 89 a8 3a 96 5c 37 bb 04 5a 64 0b 61 35 31 37 2d d2 0a 8d d8 1a 20 0d 7b 51 93 01 64 62 72 ab f8 79 77 d6 27 57 af 93 22 c6 53 f0 1c 61 02 df 54 ce b3 66 41 62 c9 96 91 48 a5 c9 77 52 5c Data Ascii: +z5L){G&t{AWF"[-g39e>jR+]/1*QiJAr:jLE8jmM1m.H.%5$','$:C$mDW5b/31'O&!ft;=L+2)H]sIRr:\7Zda517- {Qdbryw'W"SaTfAbHwR\
2025-01-14 13:15:27 UTC	16384	IN	Data Raw: 3d 33 9c 29 64 9e 49 a7 9c 54 b2 90 74 06 b3 c7 a6 72 99 e1 91 82 f3 a2 b3 73 47 f3 8e 46 fe 35 3f e4 74 66 b3 c3 4f a7 9d 47 b3 b9 63 d9 5c b2 90 c9 8e 6f df d3 79 a0 f3 b1 bd b1 fd c7 d2 e3 fd c9 f1 fc 17 77 85 3b 22 38 99 bc 93 74 0a b9 64 2a 3d 96 cc 3d e5 64 87 bc b5 93 e3 29 67 2c 39 e5 1c 4d 3b b9 f4 70 26 5f 48 e7 78 a8 cc b8 33 98 ce 15 92 e4 a3 93 b9 4c 3e 95 19 94 dd f3 db d1 8e 0c 86 49 05 d2 33 48 23 05 87 94 64 3f 49 69 10 59 1c c3 14 35 25 b3 46 38 ea e0 45 d2 4e ec 40 33 a9 d1 95 9a f1 10 47 3b 39 3b cb 79 4f 73 1d 07 8f 52 ce f1 6d f9 4f ea f5 b3 18 c7 76 ec e1 bc 03 a4 c7 b0 17 31 ec e7 8c 34 c7 fb 39 67 9c 55 61 1f 7b c3 98 e4 1a 49 be f7 c5 73 ff 9b a7 5e df 59 1b 71 78 42 f9 97 7b 17 f4 99 53 9c 31 a6 cf f1 14 c7 b2 f4 9c f5 77 94 37 Data Ascii: =3)dITtrsGF5?tfOGc\oyw;"8td*==d)g,9M;p&_Hx3L>I3H#d?IiY5%F8EN@3G;9;yOsRmOv149gUa{Is^YqxB{S1w7
2025-01-14 13:15:27 UTC	16384	IN	Data Raw: be 9b a6 bb 24 f1 22 82 37 5c 05 5e ec fa a1 9f d0 20 26 74 17 b8 41 1a a5 5e 40 e1 77 e2 c6 41 92 a4 f1 8e 3c 95 ab eb df c9 f6 e1 e8 91 e6 48 6e 7e 27 bf ad 6e be c2 3b b7 0f a7 4c 20 e6 bb 4c 3c 93 35 13 57 9f af 9d ed d7 4f b7 3f 13 9f 52 83 ec b7 d5 f5 7e b5 fd 04 ef 7f 6a 88 e7 06 5e 0a 9f 61 08 1f 7e 18 10 d2 3c 89 0e dd 76 bf f7 88 4f f6 df 57 a1 a7 e0 c1 57 14 bb f1 8e ee e0 67 ea d2 1d 3c 76 5f ae d6 bf de fe f3 e6 ee db ed 97 2f f7 e4 e6 ee 96 dc 3f ec 6f ee 7f fa b6 ff 76 7f ff 70 eb ec 5f 56 37 fb 51 84 df f9 d5 df 6e 3b 84 81 41 08 f8 f4 eb 0c 18 bf 05 e3 6b 30 3b 75 72 47 4c ae 48 90 78 6e 94 d2 18 b1 fc b1 fe e6 ec c8 5a 36 8e 4f d6 67 c7 87 cf 4a 90 ac c8 b8 60 82 14 52 92 dc a1 91 8b 87 1d 3f 25 eb 57 e6 44 ea 42 f8 80 93 2f 19 69 38 3f Data Ascii: $"7\^ &tA^@wA<Hn~'n;L L<5WO?R~j^a~<vOWWg<v_/?ovp_V7Qn;Ak0;urGLHxnZ6OgJ`R?%WDB/i8?
2025-01-14 13:15:27 UTC	16384	IN	Data Raw: c2 31 0a d7 3a 10 9f b4 77 50 2d 8e b3 9a 3d a3 16 62 ab 9e 85 58 03 f5 89 b0 46 3b a8 3c ed c5 f1 86 d9 45 1a a0 99 c9 9d 0c 12 33 c4 0c 60 80 77 1b 11 ea 37 d8 e3 84 96 1f 07 55 cf 53 35 55 0f 50 f5 02 34 80 b1 5b 9e 05 fd 79 c6 29 c7 3c 9d e2 f0 66 eb 22 5b 34 28 ac 01 17 2d f9 88 38 c7 35 d8 d1 16 62 9e 96 21 29 d5 09 70 58 9d b6 db b6 f8 1a e0 b2 6a 52 39 19 9d 3c 68 ba 51 19 1c 9f 53 6c 67 ba 28 ed 5c 8e 1b 52 24 91 9d 62 ed eb eb 8c db 72 76 dc 70 66 a6 17 3e 5d f7 df db e5 8c f2 89 d5 48 e4 d4 50 ea 0e 2c 08 b6 38 4a b3 aa 99 9e 9a 89 81 36 fc f8 cd 2a ce ca 47 36 58 1d 4f f0 58 e1 28 33 dd 48 fc c8 24 6f b5 b1 f9 83 d8 f1 65 0c 05 af 7c 7a 3e 0f d4 78 67 1f 87 b2 3f ff d3 87 f2 dc 8b 00 4e 36 b3 1a 3f 98 e0 91 ce e2 c3 d3 be 3f 54 4f 1b 3a d4 d4 Data Ascii: 1:wP-=bXF;<E3`w7US5UP4[y)<f"[4(-85b!)pXjR9<hQSlg(\R$brvpf>]HP,8J6*G6XOX(3H$oe\|z>xg?N6??TO:
2025-01-14 13:15:27 UTC	16384	IN	Data Raw: 88 34 72 0d 20 8f d5 69 e5 48 26 fb 63 75 74 f9 99 67 67 90 35 cf 3c 57 0e 4b 09 9a c6 5a 96 5e a4 71 c6 35 33 1b 1d 8d b8 f9 60 85 3a 6d ec cb 65 bb 41 2d 77 8e 33 aa a9 1a 5a 8a d6 4d 41 99 20 04 85 0a dc 00 05 b0 4a 1a 38 ae 8b e3 31 ca f6 c2 07 84 33 c9 b3 6c 96 78 9a a7 ea 95 89 66 67 05 81 65 24 5e d6 26 c4 63 16 aa 9d 92 34 d3 3d cb 07 17 39 f1 0c 14 be 14 cf f2 f6 aa 68 c6 76 a6 11 22 92 4d d4 de f6 ec 0e e3 1d 6a a1 bb 22 fc 8f 49 d9 88 b5 e6 2a d9 60 9a a6 a6 58 c3 96 97 48 55 0a 4e fb f3 c7 a5 b0 c7 37 84 0b ea 16 b2 5a cc da 8b 42 54 16 92 9a 79 9a 28 f4 0d 4e 80 0b 86 3f 85 f0 36 d8 c5 f4 34 c2 4d 05 2c 98 d5 34 70 94 91 6a 23 69 4e 92 7e c8 0c 2c 47 1e d8 1d 6e 0d 50 6c 21 f8 23 39 a8 cb b3 d4 48 8b 40 86 52 8c 8c 76 17 3a b6 f9 e3 0e b2 a5 Data Ascii: 4r iH&cutgg5<WKZ^q53`:meA-w3ZMA J813lxfge$^&c4=9hv"Mj"I*`XHUN7ZBTy(N?64M,4pj#iN~,GnPl!#9H@Rv:
2025-01-14 13:15:27 UTC	16384	IN	Data Raw: f1 d9 c3 07 3d d9 3a d9 4f 4b 5d 63 b4 81 22 96 30 42 af bf 20 0f 4d b1 ca dc f0 7b c0 e9 4f f4 23 42 96 65 d2 1c 0f 53 76 be f7 c7 35 9c 9e ef 18 3c 36 a2 a7 65 47 15 3a d5 77 01 41 20 11 6d 89 f5 c7 b6 f7 e4 7a ed 3f 1a ac a6 39 03 e8 8c 15 65 d4 07 17 db 60 6c 76 f9 e3 f6 36 9f 92 81 9d 8d 5b 2f 57 41 a5 5c 5a c4 ef bd ce c0 0f 6c 68 7e b1 cd 7a a7 e1 5b 54 eb 4a da 58 f4 af 7d 69 f6 4d c5 ee 7e 64 63 da 31 e4 f5 93 e0 0d f8 9a 9e 67 82 49 03 c9 be f6 57 3c 72 0a 8e e2 f8 2b a7 92 c9 82 d4 60 e2 cd 05 6f 45 e7 61 15 4d 3d d1 c2 0b 6a be c2 e4 ed 72 07 df 8d 8e bd bd 0c ca 79 3f 7a dc ae ae 6a 7f a5 24 c5 c3 8b a1 d4 2d d4 d3 e6 16 ec 7d 31 f9 0b 12 78 3f 65 07 8c 9c 3a 4f d1 28 66 62 0b 49 d3 03 cb 2b 02 74 8b df d3 f3 1c 76 96 d6 8f 45 90 99 e1 7a e8 Data Ascii: =:OK]c"0B M{O#BeSv5<6eG:wA mz?9e`lv6[/WA\Zlh~z[TJX}iM~dc1gIW<r+`oEaM=jry?zj$-}1x?e:O(fbI+tvEz
2025-01-14 13:15:27 UTC	16384	IN	Data Raw: f6 c1 05 62 91 c7 d1 b4 64 25 a3 a5 9d dd cd 43 c4 b2 c8 44 43 60 cf 62 2e 08 27 db b6 34 a9 b4 7e 7a 33 8f 5b 4f 3d 3c 9a ed d5 52 0b 47 15 f6 20 dc 5f 1d 61 24 cf c7 03 f2 a3 cb e8 d2 13 2d 6b f9 67 bb 47 12 93 e4 6e fc f1 fc 1e 3c 95 8f 3c 1e 2a cf d4 88 16 18 a4 62 f1 c6 9b c2 06 c1 c8 e4 00 3b e3 cc bc 9e 7a 33 89 51 d7 a9 95 7c cc b3 33 dc 80 7c a1 46 fc 5f 1d 56 11 e8 e1 93 a5 49 2d 5c 3e 67 94 c6 b0 a1 f3 5e c0 80 4d fe 43 1c e4 93 3f 36 1f c2 10 cb d5 a7 64 78 ba 8c 85 54 10 5a fd ee 7d 0f 7c 7e fb cf 57 13 f5 67 e8 32 19 15 19 57 9d 5b ad c1 f6 fe 17 1e 2e 4f c7 13 c4 56 74 92 66 62 24 47 05 cd cd ce fd 92 ff 00 76 c3 1e dd 4e 6e 26 57 36 ab e8 ca e0 c6 64 9c 3f 94 9d 88 da d6 03 1a 20 8e 33 06 39 9c 92 33 4d 55 2b ab 06 26 32 c3 95 03 6b 7a 9f Data Ascii: bd%CDC`b.'4~z3[O=<RG _a$-kgGn<<*b;z3Q\|3\|F_VI-\>g^MC?6dxTZ}\|~Wg2W[.OVtfb$GvNn&W6d? 393MU+&2kz
2025-01-14 13:15:27 UTC	16384	IN	Data Raw: 0f 0e a2 8e 29 25 d2 86 3a c3 d3 07 ac a0 99 51 40 bb de c0 72 47 7c 7b c6 47 ea 8b 4b cb e6 3f 75 9e 54 ac 88 a9 5a 78 54 29 03 b1 b8 3f 6c 0f 71 b6 f8 fc ec 72 95 39 47 eb 4b 5b 01 15 10 2b 29 61 22 86 76 6b 87 2d 76 fe 0f 9c 78 d1 ca cd 3b ea 79 39 c6 5d f4 af 07 e6 30 b2 49 55 32 29 90 03 6b 28 f3 58 af 73 ce 3d 54 bd 63 3d 6b 16 a1 4f 96 84 d2 41 af a0 67 75 62 cc b2 0b 12 aa 01 b0 1c de f6 c6 57 1d ab 3d 43 b2 af 2c f2 32 ec 8f 5c 2d 56 8e d1 f5 56 ed 05 b7 2c 4f d9 b6 f6 fc 71 de 8a 78 dd f5 0c 77 2e 70 64 7c 62 ab 92 d3 c9 34 84 08 65 50 75 33 6f 1a 58 dc 36 dd ed 8e 1a b7 b3 e3 33 7a 34 d6 5f 62 7f f8 ab 35 5c d3 35 ad ab 55 b2 cb 21 0a a0 9b 04 1b 0e 6f db 18 65 31 0f 59 3f 49 37 2f 36 70 60 24 2a 92 05 d8 da fc ed 8f c8 b3 0b 89 e4 df b0 37 24 Data Ascii: )%:Q@rG\|{GK?uTZxT)?lqr9GK[+)a"vk-vx;y9]0IU2)k(Xs=Tc=kOAgubW=C,2\-VV,Oqxw.pd\|b4ePu3oX63z4_b5\5U!oe1Y?I7/6p`$*7$

Target ID:	5
Start time:	08:15:12
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	08:15:14
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1920,i,12792980649255489656,8554723798385530938,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	9
Start time:	08:15:21
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://biomed.acemlna.com/lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://biomed.acemlna.com/lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b27b6d67-9566-4e29-ab3a-d190f6a6a850.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250114151351Z-228.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6776

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6776

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Windows Analysis Report
https://biomed.acemlna.com/lt.php?x=3TZy~GE4J6XM5p79_du5VOds1H_TjdEjvPthjaTKJ3DP65RA_ky.0.Rv2Y2liNA~j-xAXHXFJFQNDb.y_ELGV.Fw3Hyoi8

Target ID:	14
Start time:	10:13:43
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	15
Start time:	10:13:44
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre