Edit tour

Windows Analysis Report
Review Tempus wages bonus For 2025 Compensation Disbursement.pdf

Overview

General Information

Sample name:	Review Tempus wages bonus For 2025 Compensation Disbursement.pdf
Analysis ID:	1629440
MD5:	810621f02bc6f5704279e6f3fad07042
SHA1:	cb2a888e2721b7306fffae969b357eb8cb39535f
SHA256:	ecfacb0313c4817124af7722af1d39b9df92321148f11523ada6cb9903f28a70
Infos:

Detection

HTMLPhisher, Invisible JS

Score:	84
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected HtmlPhish44

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

HTML page contains hidden javascript code

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 4132 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Review Tempus wages bonus For 2025 Compensation Disbursement.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5560 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3196 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1728,i,2651444395611178824,4872869830403075443,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7368 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ronl.org/redirect?url=https://1C.hypernesdt.ru/A86bjH/#Xesmeralda.arriaga@tempus.com MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7756 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2652 --field-trial-handle=2604,i,702203083375713400,12249269372178961096,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 8936 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "http://mailto:digit@nelsoncourt.us" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 9112 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2004,i,10258909886674376050,18371129370388586729,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_273	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

HTML

Source	Rule	Description	Author
0.1.id.script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.1.id.script.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
1.1.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.1.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
1.0.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.0.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://1c.hypernesdt.ru/A86bjH/

Avira URL Cloud: Label: malware

Phishing

Yara detected HtmlPhish44

Source: Yara match

File source: dropped/chromecache_273, type: DROPPED

Yara detected Invisible JS

Source: Yara match	File source: 0.1.id.script.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML

Yara detected Obfuscation Via HangulCharacter

Source: Yara match	File source: 0.1.id.script.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: PDF document

Joe Sandbox AI: PDF document contains QR code

AI detected suspicious Javascript

Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://1c.hypernesdt.ru/A86bjH/#Xesmeralda.arriag... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `atob()` to decode base64-encoded strings, followed by `eval()` to execute the decoded content, poses a significant security risk. Additionally, the script appears to be sending user data to an untrusted domain, which is a clear indicator of malicious intent. Overall, this script exhibits a high level of suspicion and should be treated as a potential security threat.
Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://1c.hypernesdt.ru/A86bjH/#Xesmeralda.arriag... This script demonstrates high-risk behaviors, including dynamic code execution through the use of `eval()` and potential data exfiltration. The obfuscated code and encoded strings further increase the risk. Overall, this script exhibits a high level of malicious intent and should be treated with caution.

Source: https://1c.hypernesdt.ru/A86bjH/#Xesmeralda.arriaga@tempus.com

HTTP Parser: Base64 decoded: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>AI UI Template</title> <style> body { font-family: 'Segoe UI', Tahoma, Geneva,...

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50037 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50050 version: TLS 1.2

Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 4803
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 4803
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 4803
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 4803
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 4803
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 4803
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 4803
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 4803

Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 15.197.142.173 15.197.142.173
Source: Joe Sandbox View	IP Address: 15.197.142.173 15.197.142.173

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190
Source: unknown	TCP traffic detected without corresponding DNS query: 74.7.84.190

Source: global traffic	HTTP traffic detected: GET /redirect?url=https://1C.hypernesdt.ru/A86bjH/ HTTP/1.1Host: ronl.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /A86bjH/ HTTP/1.1Host: 1c.hypernesdt.ruConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://1c.hypernesdt.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://1c.hypernesdt.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://1c.hypernesdt.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://1c.hypernesdt.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://1c.hypernesdt.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=VZV49D3W6wQC1rCj8snQ3H0ipeFWSkR5aq5oyjEKZQo-1741109112-1.0.1.1-NRrKqpZTiKKQzGc.gJms_lY6KGAV_.oys1ECr1fzqtZKSExV3j0nCAcgUga2c5j3OE2KL3VYHXyaDPQdcpukmgrvyuMyl7zk1GKSK9oE0xE
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: nelsoncourt.usConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: nelsoncourt.usConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /NelsonCourt HTTP/1.1Host: 74.7.84.190:4803Connection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /NelsonCourt HTTP/1.1Host: 74.7.84.190:4803Connection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /NelsonCourt HTTP/1.1Host: 74.7.84.190:4803Connection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /NelsonCourt HTTP/1.1Host: 74.7.84.190:4803Connection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /NelsonCourt HTTP/1.1Host: 74.7.84.190:4803Connection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /NelsonCourt HTTP/1.1Host: 74.7.84.190:4803Connection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /NelsonCourt HTTP/1.1Host: 74.7.84.190:4803Connection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /NelsonCourt HTTP/1.1Host: 74.7.84.190:4803Connection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: ronl.org
Source: global traffic	DNS traffic detected: DNS query: 1c.hypernesdt.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: nelsoncourt.us

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Review Tempus wages bonus For 2025 Compensation Disbursement.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1728,i,2651444395611178824,4872869830403075443,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ronl.org/redirect?url=https://1C.hypernesdt.ru/A86bjH/#Xesmeralda.arriaga@tempus.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2652 --field-trial-handle=2604,i,702203083375713400,12249269372178961096,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "http://mailto:digit@nelsoncourt.us"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2004,i,10258909886674376050,18371129370388586729,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1728,i,2651444395611178824,4872869830403075443,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2652 --field-trial-handle=2604,i,702203083375713400,12249269372178961096,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2004,i,10258909886674376050,18371129370388586729,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Review Tempus wages bonus For 2025 Compensation Disbursement.pdf	Initial sample: PDF keyword /JS count = 0
Source: Review Tempus wages bonus For 2025 Compensation Disbursement.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A9wk6j05_93f8y8_28w.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A9wk6j05_93f8y8_28w.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label
https://1c.hypernesdt.ru/A86bjH/	100%	Avira URL Cloud	malware
http://74.7.84.190:4803/NelsonCourt	0%	Avira URL Cloud	safe
https://ronl.org/redirect?url=https://1C.hypernesdt.ru/A86bjH/	0%	Avira URL Cloud	safe
http://nelsoncourt.us/	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
e8652.dscx.akamaiedge.net	92.123.17.129	true	false	high
code.jquery.com	151.101.194.137	true	false	high
developers.cloudflare.com	104.16.2.189	true	false	high
ronl.org	185.191.197.92	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
1c.hypernesdt.ru	188.114.96.3	true	true	unknown
nelsoncourt.us	15.197.142.173	true	false	unknown
www.google.com	172.217.16.196	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://1c.hypernesdt.ru/A86bjH/#Xesmeralda.arriaga@tempus.com	false		unknown
https://ronl.org/redirect?url=https://1C.hypernesdt.ru/A86bjH/	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://1c.hypernesdt.ru/A86bjH/	true	Avira URL Cloud: malware	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://developers.cloudflare.com/favicon.png	false		high
https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js	false		high
http://74.7.84.190:4803/NelsonCourt	false	Avira URL Cloud: safe	unknown
http://nelsoncourt.us/	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
74.7.84.190	unknown	United States	17184	ATL-CBEYONDUS	false
185.191.197.92	ronl.org	Russian Federation	42244	ESERVERRU	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
15.197.142.173	nelsoncourt.us	United States	7430	TANDEMUS	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false
104.16.2.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.217.18.4	unknown	United States	15169	GOOGLEUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.2.137	unknown	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
92.123.17.129	e8652.dscx.akamaiedge.net	European Union	16625	AKAMAI-ASUS	false
188.114.96.3	1c.hypernesdt.ru	European Union	13335	CLOUDFLARENETUS	true
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false
104.17.25.14	unknown	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1629440
Start date and time:	2025-03-04 18:24:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Review Tempus wages bonus For 2025 Compensation Disbursement.pdf
Detection:	MAL
Classification:	mal84.phis.troj.winPDF@60/61@29/16
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Source	URL
Screenshot	https://ronl.org/redirect?url=https://1C.hypernesdt.ru/A86bjH/#Xesmeralda.arriaga@tempus.com
Screenshot	https://ronl.org/redirect?url=https://1C.hypernesdt.ru/A86bjH/#Xesmeralda.arriaga@tempus.com

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.191.197.92	https://www.ronl.ru/redirect?url=https://pub-587628e1416a4176a0229c5d120cb1f9.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse
185.191.197.92	https://ronl.org/redirect?url=http%3A%2F%2Fsnow.com.au/wl4Rlsona8Danga0Tnor1mConrosE5QfulB4grl4Rgh1mCa8D9vKoy45	Get hash	malicious	Unknown	Browse
104.18.94.41	Brother_MSG-voice04-45.html	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	https://buildersstoneandmasonry-my.sharepoint.com/:f:/g/personal/jorge_gardea_bsmmasonry_com/EkCNZ7HjuJVKu9OpHjDIlOIBJfNwCCSJGs6Pfb7Nsr0A4w?e=wVXyMF	Get hash	malicious	HTMLPhisher	Browse
	https://sumivida.com/wp-content/XXOXO/roni.html	Get hash	malicious	HTMLPhisher	Browse
	https://lindsaycars.umbraceleste.de/65cR9	Get hash	malicious	HTMLPhisher	Browse
	https://u17619131.ct.sendgrid.net/ls/click?upn=u001.K4JG8nMHUnY4dRjj5Gz2059XVFXFIrnWLkNOa48QpNkePjB9UEwCrB0pZbGGz5iQ9xyopT09eSDxdjqwTZGWel0BOSlYq8xO0sXSBK-2B3a8YLvf9I6p3hungARyg6yR2l7X4YLfyuEEIwqXWK-2BScLLd6I8bHWLMY1137j1m5OeKg-3Dx7vT_4ZdaYlkF5S9DQsM5Svyg9ZtG2e83A-2FNza0WD-2FFusBsUQ7ZeZcnmy7DS97Si8FHdBVbvhCkgCz1A6Sf6WLCURa1VKP9-2FY1zA4MHKSTf9wcfKXM2NTolh1P2-2BUy3bCCteVjNKMZ-2F7c3BA01Q9-2BGCSpy9BTMIW255AdUlcvBkKLBWUD-2FMVJ0-2BHOfQ9mX9YxmDgFXUAKSPAVk1UhKZexOBLYvQ-3D-3D	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	https://docsend.com/view/ewqm4kicbq7iqnd8	Get hash	malicious	Unknown	Browse
	https://bxzbxg8ymg5ncind7ucxad85ncnwx.brewskilabz.com/	Get hash	malicious	Unknown	Browse
	https://hiiudvt8z.awbpartners.com.au/?yxbe=Y2Fyb2x5bi5tLndldHRlcmxpbkB4Y2VsZW5lcmd5LmNvbQ==	Get hash	malicious	Unknown	Browse
	Qvc_MSG-voice0445.html	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	https://gamma.app/docs/-as20od50yzeyta3?mode=present#card-gq8vz6qalc06dt6	Get hash	malicious	HTMLPhisher	Browse
15.197.142.173	RyJhC2oYnM.exe	Get hash	malicious	Pony	Browse	abemoussa.com/forum/viewtopic.php
	236236236.elf	Get hash	malicious	Unknown	Browse	steptherapyinfo.net/
	firmware.armv5l.elf	Get hash	malicious	Unknown	Browse	15.197.142.173/
	7qBBKk0P4l.exe	Get hash	malicious	Unknown	Browse	womanbelieve.net/index.php
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	womanbelieve.net/index.php
	7qBBKk0P4l.exe	Get hash	malicious	Unknown	Browse	womanbelieve.net/index.php
	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	womanbelieve.net/index.php
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	womanbelieve.net/index.php
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	womanbelieve.net/index.php
	http://www.acproyectosdeingenieria.com	Get hash	malicious	Unknown	Browse	www.acproyectosdeingenieria.com/

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATL-CBEYONDUS	nklppc.elf	Get hash	malicious	Unknown	Browse	216.192.157.241
	splsh4.elf	Get hash	malicious	Unknown	Browse	69.15.163.245
	mips.elf	Get hash	malicious	Unknown	Browse	216.193.7.88
	splarm.elf	Get hash	malicious	Unknown	Browse	69.198.98.153
	nabspc.elf	Get hash	malicious	Unknown	Browse	173.200.168.11
	yakov.x64.elf	Get hash	malicious	Mirai	Browse	216.193.85.217
	SecuriteInfo.com.Linux.Siggen.9999.13294.8145.elf	Get hash	malicious	Unknown	Browse	69.199.138.231
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	216.192.110.231
	demon.mpsl.elf	Get hash	malicious	Mirai	Browse	69.198.97.30
	Owari.mpsl.elf	Get hash	malicious	Unknown	Browse	69.198.97.49
ESERVERRU	botx.spc.elf	Get hash	malicious	Mirai	Browse	178.218.211.127
	https://santa-secret.ru/api/verify?a=NjgyODEwNCw1bWluOHE2MHpuX3J1LC9hY2NvdW50L2JveGVzLHZsYWRpbWlyLmdsdXNoZW5rb0Bob2NobGFuZC5ydSwyNDE0MTYzMg==	Get hash	malicious	Unknown	Browse	185.191.196.69
	https://www.ronl.ru/redirect?url=https://pub-587628e1416a4176a0229c5d120cb1f9.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	185.191.197.92
	https://ronl.org/redirect?url=http%3A%2F%2Fsnow.com.au/wl4Rlsona8Danga0Tnor1mConrosE5QfulB4grl4Rgh1mCa8D9vKoy45	Get hash	malicious	Unknown	Browse	185.191.197.92
	DTg8qjTp6U.dll	Get hash	malicious	Wannacry	Browse	91.189.86.88
FASTLYUS	Brother_MSG-voice04-45.html	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	151.101.194.137
	https://buildersstoneandmasonry-my.sharepoint.com/:f:/g/personal/jorge_gardea_bsmmasonry_com/EkCNZ7HjuJVKu9OpHjDIlOIBJfNwCCSJGs6Pfb7Nsr0A4w?e=wVXyMF	Get hash	malicious	HTMLPhisher	Browse	151.101.65.229
	https://sumivida.com/wp-content/XXOXO/roni.html	Get hash	malicious	HTMLPhisher	Browse	151.101.65.229
	https://tremeautouniversalluxury.docvaulthost.com/9WSTO/	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://lindsaycars.umbraceleste.de/65cR9	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://u7990385.ct.sendgrid.net/ls/click?upn=u001.oZ6GXC16Ztdw1ob-2F3C5yow-2FsK2YC4S8s269h9OLgp-2FGcQesCtXDXKgCEAF90Sa3Oaw5NBOq4zBLYrR7x3oQBDOcKfWRYaWyQMMOEYO-2FqhT1JGWXCFxuq18n23-2BegpkKCgXK2FDB3owMtM4ZIFSnNfozd3stK-2F80PpzPngMRJneJs749Ny4a9GzfT5Oa5gf-2FjB5Oki96IZAozrJihzSs-2BBxDdI3oFqcEzjrif3kZGVKBcv5ZxgdGfQbb5FvA4MAHam-aH_z9j2n0xFnkQDXFaeGkJTjlS7g1QaUT1mmh1IVnQrWJkyDZP-2FQ1BLPc8I5a3rN7uIwApNV9WcMi0i6VW2-2FBFofD8gI4nhx2Emsw0FP9lXUg96nEVNaOeJ8nZPPEgprizjXUgtZTe8pOtai7fTrfVu3OMZ-2FxUBlNBHaGFqFS9VkomQhDWeNfshfuKfNYB1RzRAPqGD7d-2BdJTfBqV7PyNu8NNNKWxsJHojpMQhEQF5ojgMa-2FGCFGcsaT4THyMYeu8DCW17ndYHwHOPEuAm4-2FMIm4Lcj-2Ff5qnouSxfnp06Y4TQp6iek4YnINHIQ2TOzS-2BBJoZD-2FhDHxubGc3A8XxB2HrAf0ozbL03kQCxoZE7DbFx6UBZ0kbWeytOo-2Bx9NIVutKWkadHJ1oekSJ9gWRnYlWeh-2FnMwOemzJF3UIk8gP1GeIGOk58rnAqIK-2F6iKRQx7d6gONculXhYa47Xko3KyQyZF-2FvDQTKv1hp-2Bj3M4z0lRco3ReEOeK7klNTGt5Rav9tWc9M5OujixPDaJAVlf6gHchUg7Zpmzsf6nncOl1zrnCuRdJYCN5-2FMj60aq5ucabPOAgZsNBDUHE6iSsZj-2B-2Fa33Q1e5zUqJOYL4rkt3yx24bMn65ejwE6fmTEN1EdGnimlrv-2FEykoupDBnmzIwE2x4L-2FWfIuHF33x18sJUN4qB7jrOyHc2XS5v30L4bSCJva6WpDWWkw7fKEatZazcZvky2IN5NX43cqXPNBULjuQSYI0q3DwvTh-2Fkz7a2DBpL1k9aiabeg4-2FyX9Z2TdvZNEOiq4-2FDv1djEgj0Bpgi6X9UJLtQiwfZJ-2FTK1CKwbelIF7aMrKa-2BxwDhS-2BD3toz35HBFqPTFDv3wchQR0-2BMaLTn496KfFVc31bbylq1MqxExZETxWuDHc2rHIzk08OYTkkGIocexuENJLNiIr8Qr0ZBGIKH1HCseqfb-2Fhv0nePPqE1tKDZO-2FXBUq4UG-2Ft8HXS5tqQdSsA15jejnqoHpRoZSpJFX1trZqUfR-2Fh7Q4nx1CkdjEv	Get hash	malicious	Unknown	Browse	151.101.194.217
	Your Capital One Account Restricted...pdf	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://u17619131.ct.sendgrid.net/ls/click?upn=u001.K4JG8nMHUnY4dRjj5Gz2059XVFXFIrnWLkNOa48QpNkePjB9UEwCrB0pZbGGz5iQ9xyopT09eSDxdjqwTZGWel0BOSlYq8xO0sXSBK-2B3a8YLvf9I6p3hungARyg6yR2l7X4YLfyuEEIwqXWK-2BScLLd6I8bHWLMY1137j1m5OeKg-3Dx7vT_4ZdaYlkF5S9DQsM5Svyg9ZtG2e83A-2FNza0WD-2FFusBsUQ7ZeZcnmy7DS97Si8FHdBVbvhCkgCz1A6Sf6WLCURa1VKP9-2FY1zA4MHKSTf9wcfKXM2NTolh1P2-2BUy3bCCteVjNKMZ-2F7c3BA01Q9-2BGCSpy9BTMIW255AdUlcvBkKLBWUD-2FMVJ0-2BHOfQ9mX9YxmDgFXUAKSPAVk1UhKZexOBLYvQ-3D-3D	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	151.101.194.137
	https://aircarecolorado.com/locations/van-locations?tab=jl_magic_tabs_m_th_current_week_gix1	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://digi-searches.com/	Get hash	malicious	Unknown	Browse	151.101.2.132
CLOUDFLARENETUS	Brother_MSG-voice04-45.html	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.17.25.14
	https://buildersstoneandmasonry-my.sharepoint.com/:f:/g/personal/jorge_gardea_bsmmasonry_com/EkCNZ7HjuJVKu9OpHjDIlOIBJfNwCCSJGs6Pfb7Nsr0A4w?e=wVXyMF	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	95.msi	Get hash	malicious	RedLine	Browse	172.64.41.3
	https://sumivida.com/wp-content/XXOXO/roni.html	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://tremeautouniversalluxury.docvaulthost.com/9WSTO/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://lindsaycars.umbraceleste.de/65cR9	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://u7990385.ct.sendgrid.net/ls/click?upn=u001.oZ6GXC16Ztdw1ob-2F3C5yow-2FsK2YC4S8s269h9OLgp-2FGcQesCtXDXKgCEAF90Sa3Oaw5NBOq4zBLYrR7x3oQBDOcKfWRYaWyQMMOEYO-2FqhT1JGWXCFxuq18n23-2BegpkKCgXK2FDB3owMtM4ZIFSnNfozd3stK-2F80PpzPngMRJneJs749Ny4a9GzfT5Oa5gf-2FjB5Oki96IZAozrJihzSs-2BBxDdI3oFqcEzjrif3kZGVKBcv5ZxgdGfQbb5FvA4MAHam-aH_z9j2n0xFnkQDXFaeGkJTjlS7g1QaUT1mmh1IVnQrWJkyDZP-2FQ1BLPc8I5a3rN7uIwApNV9WcMi0i6VW2-2FBFofD8gI4nhx2Emsw0FP9lXUg96nEVNaOeJ8nZPPEgprizjXUgtZTe8pOtai7fTrfVu3OMZ-2FxUBlNBHaGFqFS9VkomQhDWeNfshfuKfNYB1RzRAPqGD7d-2BdJTfBqV7PyNu8NNNKWxsJHojpMQhEQF5ojgMa-2FGCFGcsaT4THyMYeu8DCW17ndYHwHOPEuAm4-2FMIm4Lcj-2Ff5qnouSxfnp06Y4TQp6iek4YnINHIQ2TOzS-2BBJoZD-2FhDHxubGc3A8XxB2HrAf0ozbL03kQCxoZE7DbFx6UBZ0kbWeytOo-2Bx9NIVutKWkadHJ1oekSJ9gWRnYlWeh-2FnMwOemzJF3UIk8gP1GeIGOk58rnAqIK-2F6iKRQx7d6gONculXhYa47Xko3KyQyZF-2FvDQTKv1hp-2Bj3M4z0lRco3ReEOeK7klNTGt5Rav9tWc9M5OujixPDaJAVlf6gHchUg7Zpmzsf6nncOl1zrnCuRdJYCN5-2FMj60aq5ucabPOAgZsNBDUHE6iSsZj-2B-2Fa33Q1e5zUqJOYL4rkt3yx24bMn65ejwE6fmTEN1EdGnimlrv-2FEykoupDBnmzIwE2x4L-2FWfIuHF33x18sJUN4qB7jrOyHc2XS5v30L4bSCJva6WpDWWkw7fKEatZazcZvky2IN5NX43cqXPNBULjuQSYI0q3DwvTh-2Fkz7a2DBpL1k9aiabeg4-2FyX9Z2TdvZNEOiq4-2FDv1djEgj0Bpgi6X9UJLtQiwfZJ-2FTK1CKwbelIF7aMrKa-2BxwDhS-2BD3toz35HBFqPTFDv3wchQR0-2BMaLTn496KfFVc31bbylq1MqxExZETxWuDHc2rHIzk08OYTkkGIocexuENJLNiIr8Qr0ZBGIKH1HCseqfb-2Fhv0nePPqE1tKDZO-2FXBUq4UG-2Ft8HXS5tqQdSsA15jejnqoHpRoZSpJFX1trZqUfR-2Fh7Q4nx1CkdjEv	Get hash	malicious	Unknown	Browse	1.1.1.1
	Your Capital One Account Restricted...pdf	Get hash	malicious	HTMLPhisher	Browse	162.159.140.229
	https://u17619131.ct.sendgrid.net/ls/click?upn=u001.K4JG8nMHUnY4dRjj5Gz2059XVFXFIrnWLkNOa48QpNkePjB9UEwCrB0pZbGGz5iQ9xyopT09eSDxdjqwTZGWel0BOSlYq8xO0sXSBK-2B3a8YLvf9I6p3hungARyg6yR2l7X4YLfyuEEIwqXWK-2BScLLd6I8bHWLMY1137j1m5OeKg-3Dx7vT_4ZdaYlkF5S9DQsM5Svyg9ZtG2e83A-2FNza0WD-2FFusBsUQ7ZeZcnmy7DS97Si8FHdBVbvhCkgCz1A6Sf6WLCURa1VKP9-2FY1zA4MHKSTf9wcfKXM2NTolh1P2-2BUy3bCCteVjNKMZ-2F7c3BA01Q9-2BGCSpy9BTMIW255AdUlcvBkKLBWUD-2FMVJ0-2BHOfQ9mX9YxmDgFXUAKSPAVk1UhKZexOBLYvQ-3D-3D	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.2.189
	https://docsend.com/view/ewqm4kicbq7iqnd8	Get hash	malicious	Unknown	Browse	172.67.188.187
TANDEMUS	https://gamma.app/docs/-as20od50yzeyta3?mode=present#card-gq8vz6qalc06dt6	Get hash	malicious	HTMLPhisher	Browse	15.197.213.252
	8ab19998dc86c27d89cf727862b67a397c5fcba459c86.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer	Browse	15.197.240.20
	Documents.html	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	15.197.137.111
	https://watchmedier.peytzmail.com/bc/xkjnez/sobema/qwiuiy/3299365831?t=//gamma.app/docs/New-File-Received--mrs6to00w2gfwz8?mode=doc	Get hash	malicious	Unknown	Browse	15.197.213.252
	Documents.html	Get hash	malicious	Unknown	Browse	15.197.137.111
	Swift Copy.exe	Get hash	malicious	FormBook	Browse	15.197.172.60
	sh4.elf	Get hash	malicious	Unknown	Browse	128.88.62.131
	Swift Copy.exe	Get hash	malicious	FormBook	Browse	15.197.172.60
	http://www.schoolboxstuff.com	Get hash	malicious	Unknown	Browse	15.197.225.128
	yakov.m68k.elf	Get hash	malicious	Unknown	Browse	16.254.120.195

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	morninghtaaaafilex.hta	Get hash	malicious	AgentTesla	Browse	40.113.110.67 40.115.3.253
	svchost.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	https://bxzbxg8ymg5ncind7ucxad85ncnwx.brewskilabz.com/	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	rarrivalnotice.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.115.3.253
	InquiryNo 04032025.vbe	Get hash	malicious	AgentTesla	Browse	40.113.110.67 40.115.3.253
	https://sfo2.digitaloceanspaces.com/ca7229/oi2237	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	50% deposit's payment advice.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.115.3.253
	https://choomtopsoal.net/afu.php?zoneid=6906804&var=6906804&rid=ksX-wKK1z8yLZCaWKyzJyw==&rhd=false&ab2r=0&sf=1&os=windows&os_version=10.0.0&is_mobile=false&browser_version=117.0.5938.134	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	Comprobante de pago adjunto_pdf.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	https://getrunkhomuto.info/aVBHWG5WMzRlDD08Dz0rGTIEEFslNXZsIQoFN202HmE9C10gdiY6GlRgYSoLDW12fh0EbXZuSAJtYS5TWH50bEBaZmlsSBokNGVeTyA1NlNZdiI1DFRgYSwHDW12aVtYZnVgSBsoPmVfUGJ3B19ZaHd%2BBwczemlaTyV6a11ZZHFgXlBjdG1cWGB%2Bfg8ONSRlX15kd2BbXmR0akgPI3ppSAQyLDpTW2F0dlxYaXFpWFtgc25XWWhyfhwMNnowGh0gNH1dKHV1HktbFjQsQAo4JiwPBzcodg0GPWJqKAFlYmooDipiaigbYHRoX1tldmhdXHV1HgcNfi8sAwV2KCscVDEkPRQdIi41HUcgJj8LGn4jPRhPOjQsU1l2IjYcVGBhNA0cMXo1ARM5KzQPTGIBbUBZdXVoRh45KTwBHiNial4HJGJqXlhgaWhLWhJial4eOSluWkxjBX1cWShxbEdMYnc5Hhk8Ii8LCzsuLEtbFnJrWUdjcX1cWXgsMBoEPGJqLUxidzQHAjVial4ONSQzAUB1dWgNASIoNQtMYgFpXVp%2Bd3ZeR2Bial4aMSE5HAB1dR5bWmdpa1hPJD08U0RoYS0CBjN6fgcPbXd%2BDR1tdH4NHTN6YUg2YQYqO1RhcGxeUWZ2YVpdaXFtSBwkNWlTWWF9bllTZHdsXk8lMypcVGBhLRobY3poSBwkNWxTWXYyLBxcbXd%2BGx0icWVeTyUzKllUYGEuDwU5I2Vf	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Review Tempus wages bonus For 2025 Compensation Disbursement.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f07d509b-36b2-4448-aaa2-fdc9f872f2bc.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250304172507Z-193.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Windows Analysis Report
Review Tempus wages bonus For 2025 Compensation Disbursement.pdf

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.1469752714395565
Encrypted:	false
SSDEEP:	6:iOTX4DOyq2PN72nKuAl9OmbnIFUt5X4+1ZmwXX4oRkwON72nKuAl9OmbjLJ:7cOyvVaHAahFUtX/9R5OaHAaSJ
MD5:	DBB8287A45C3DBBE458DD9BD9E0E8B61
SHA1:	8950B29539E35A3D51F4200D1511684FB958DC74
SHA-256:	832B569600E4EF79D35E0FDD41F49021B3436DD11C6DB9A9975C8E9DC2A2CFBF
SHA-512:	3B49B553676B0A25AECFB065D6DDC00C8851AED49F0516D3573A41429701590FF45FCF25A6B873B315187E2632F080CEE90659784B841A9C30E10563B98A4B20
Malicious:	false
Reputation:	low
Preview:	2025/03/04-12:25:02.344 18e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/04-12:25:02.346 18e0 Recovering log #3.2025/03/04-12:25:02.346 18e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	dropped
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

File type:	PDF document, version 1.4, 0 pages
Entropy (8bit):	7.679900546712824
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Review Tempus wages bonus For 2025 Compensation Disbursement.pdf
File size:	50'744 bytes
MD5:	810621f02bc6f5704279e6f3fad07042
SHA1:	cb2a888e2721b7306fffae969b357eb8cb39535f
SHA256:	ecfacb0313c4817124af7722af1d39b9df92321148f11523ada6cb9903f28a70
SHA512:	09ad5d9fe7ae03c55c6b0e9b144b0903c5ca9675ee7a69b46f4b33cf82b84c74afb48d986c2da524b7fd01961e31e789f7ddd42afad55e12353cdff5f7bab3d8
SSDEEP:	768:nA0Ha9FDJoKWk0A6nHa9FDJoijxRnFZULMD0ONrH9jzCxGoPZZ:nHH4Joxk0A6nH4Jo0BNT9j2PZZ
TLSH:	95334ABAA8E5992CD8D14377B7F27B0966D9B5634BC82089F07805EEF4D6C19E312313
File Content Preview:	%PDF-1.4.1 0 obj.<<./Title (...A.d.o.b.e. .P.o.l.i.c.y. .U.p.d.a.t.e.s)./Creator (...w.k.h.t.m.l.t.o.p.d.f. .0...1.2...6)./Producer (...Q.t. .4...8...7)./CreationDate (D:20250304073853-05'00').>>.endobj.3 0 obj.<<./Type /ExtGState./SA true./SM 0.02./ca 1.

General
Header:	%PDF-1.4
Total Entropy:	7.679901
Total Bytes:	50744
Stream Entropy:	7.767555
Stream Bytes:	43531
Entropy outside Streams:	5.153028
Bytes outside Streams:	7213
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	53
endobj	53
stream	18
endstream	18
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

ID	DHASH	MD5
6	8282828282828282	dfb0d4eb91b19d7b140d7c35f779429e
8	0000000000000000	0609038781fe48b7a6d6331b5de10471
12	8282828282828282	9cadf73900ad3e6c34f59e827924ad3c
16	8282828282828282	777618a2b03f022e2e0ae865c9e7dd15
20	8282828282828280	59dbb06377f258d53acba9a45fb23fe3

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 4, 2025 18:25:07.534518003 CET	59758	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:07.534719944 CET	59164	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:07.592133045 CET	53	59164	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:07.616983891 CET	53	52931	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:07.644395113 CET	53	59758	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:08.801192999 CET	53	53281	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:08.833013058 CET	63326	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:08.833144903 CET	60943	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:08.846394062 CET	53	63326	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:08.930938005 CET	53	60943	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:10.127599955 CET	62453	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:10.127600908 CET	56786	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:10.127840042 CET	49326	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:10.128355026 CET	60986	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:10.128355026 CET	49177	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:10.128859043 CET	57084	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:10.134970903 CET	53	56786	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:10.135188103 CET	53	49326	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:10.135411024 CET	53	62453	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:10.136099100 CET	53	57084	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:10.136435032 CET	53	60986	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:10.136738062 CET	53	49177	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:11.074007034 CET	63143	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:11.074270010 CET	52974	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:11.076910019 CET	52559	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:11.077091932 CET	65253	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:11.081386089 CET	53	52974	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:11.081463099 CET	53	63143	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:11.084291935 CET	53	52559	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:11.084316015 CET	53	65253	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:11.439289093 CET	49704	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:11.439475060 CET	59167	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:11.446566105 CET	53	59167	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:11.447104931 CET	53	49704	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:11.607482910 CET	63522	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:11.607482910 CET	51862	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:11.614584923 CET	53	63522	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:11.614763021 CET	53	51862	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:11.654315948 CET	58596	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:11.654767036 CET	53134	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:11.663892984 CET	53	53134	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:11.666951895 CET	53	58596	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:12.353844881 CET	50718	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:12.354047060 CET	57129	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:12.362557888 CET	53	50718	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:12.402153969 CET	53	57129	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:15.544877052 CET	63257	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:15.552647114 CET	53	63257	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:25.823805094 CET	53	57324	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:25.824806929 CET	53	55553	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:28.076179028 CET	52022	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:28.076394081 CET	49348	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:28.082071066 CET	53	56318	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:28.089371920 CET	53	49348	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:28.127690077 CET	53	52022	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:28.341202021 CET	53	58717	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:28.365283012 CET	50535	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:28.365462065 CET	55910	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:28.473913908 CET	53	50535	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:28.571103096 CET	53	55910	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:29.748047113 CET	53	62781	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:32.579647064 CET	58315	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:32.579822063 CET	61061	53	192.168.2.6	1.1.1.1
Mar 4, 2025 18:25:32.586735010 CET	53	58315	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:32.587425947 CET	53	61061	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:34.838893890 CET	53	63211	1.1.1.1	192.168.2.6
Mar 4, 2025 18:25:46.823602915 CET	53	63454	1.1.1.1	192.168.2.6
Mar 4, 2025 18:26:05.651454926 CET	53	56963	1.1.1.1	192.168.2.6
Mar 4, 2025 18:26:27.793309927 CET	53	53423	1.1.1.1	192.168.2.6
Mar 4, 2025 18:26:28.619663954 CET	53	50559	1.1.1.1	192.168.2.6
Mar 4, 2025 18:26:58.871867895 CET	53	55730	1.1.1.1	192.168.2.6
Mar 4, 2025 18:27:45.026597977 CET	53	52439	1.1.1.1	192.168.2.6

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 4, 2025 18:25:08.931004047 CET	192.168.2.6	1.1.1.1	c27c	(Port unreachable)	Destination Unreachable
Mar 4, 2025 18:25:12.402235031 CET	192.168.2.6	1.1.1.1	c276	(Port unreachable)	Destination Unreachable
Mar 4, 2025 18:25:28.571250916 CET	192.168.2.6	1.1.1.1	c22d	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2025 18:25:15.563416004 CET	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Mar 4, 2025 18:25:16.215126038 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=68301 Expires: Wed, 05 Mar 2025 12:23:37 GMT Date: Tue, 04 Mar 2025 17:25:16 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urIAv5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0*HUX
Mar 4, 2025 18:25:16.215146065 CET	509	IN	Data Raw: a9 bc b2 a8 50 d0 0c b1 d8 1a 69 20 27 29 08 ac 61 75 5c 8a 6e f8 82 e5 69 2f d5 f6 56 4b b9 b8 73 10 59 d3 21 97 7e e7 4c 71 fb b2 d2 60 ad 39 a8 0b ea 17 21 56 85 f1 50 0e 59 eb ce e0 59 e9 ba c9 15 ef 86 9d 8f 84 80 f6 e4 e9 91 90 dc 17 9b 62 Data Ascii: Pi ')au\ni/VKsY!~Lq`9!VPYYbEf\|o;'}~"+"4[XT&3L-<W,N;1"ss993#L<U)"k;W:pMMl]+NEJ&rj

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2025 18:25:31.020153999 CET	429	OUT	GET / HTTP/1.1 Host: nelsoncourt.us Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 4, 2025 18:25:31.331192970 CET	429	OUT	GET / HTTP/1.1 Host: nelsoncourt.us Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 4, 2025 18:25:32.035602093 CET	387	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 04 Mar 2025 17:25:31 GMT Content-Type: text/html; charset=utf-8 Content-Length: 70 Connection: keep-alive Location: http://74.7.84.190:4803/NelsonCourt Server: ip-10-123-124-171.ec2.internal Vary: Accept-Encoding X-Request-Id: eb7c17ba-e6c7-4d3f-907c-b8c867bf5a1f Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 37 34 2e 37 2e 38 34 2e 31 39 30 3a 34 38 30 33 2f 4e 65 6c 73 6f 6e 43 6f 75 72 74 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="http://74.7.84.190:4803/NelsonCourt">Moved Permanently</a>.
Mar 4, 2025 18:26:17.048712015 CET	6	OUT	Data Raw: 00 Data Ascii: