Edit tour

Windows Analysis Report
processed-ach-remittance-031925 (2).pdf

Overview

General Information

Sample name:	processed-ach-remittance-031925 (2).pdf
Analysis ID:	1642548
MD5:	6ef7005eef078fd12a90f03a7753070a
SHA1:	1f46d7868b22652458ef028d09f72baa5e1c3b9d
SHA256:	2e45baa2e3bf3ea5da01f8a64e6e16ffca7a3da58ed8b9b295f85df4d1c89685
Infos:

Detection

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

Found potential malicious PDF (bad image similarity)

AI detected landing page (webpage, office document or email)

Suspicious PDF detected (based on various text indicators)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7700 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\processed-ach-remittance-031925 (2).pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8048 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7412 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1664 --field-trial-handle=1568,i,4038913409643386264,5492468394634696909,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8956 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://sexa.xftprojects.com/" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2288 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2040,i,6421133465372305949,14597510339509831683,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: PDF document	Joe Sandbox AI: Page contains button: 'VIEW COMPLETED DOCUMENT' Source: 'PDF document'
Source: PDF document	Joe Sandbox AI: PDF document contains prominent button: 'view completed document'

Suspicious PDF detected (based on various text indicators)

Source: Adobe Acrobat PDF

OCR Text: docusign You have received an " ACH" Remittance Document VIEW COMPLETED DOCUMENT Completed Document: Payment Notification of ach-receipt#902762 Ref:672862 Final Payout Settlement processed Powered by "docusign About Docusign It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe. Download the Docusign_App This message was sent to you by Docusign Electronic Signature Service.

Source: unknown	HTTPS traffic detected: 162.241.114.35:443 -> 192.168.2.6:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.36:443 -> 192.168.2.6:49714 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.6:62309 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:54648 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 2.19.105.127 2.19.105.127
Source: Joe Sandbox View	IP Address: 2.19.105.127 2.19.105.127
Source: Joe Sandbox View	IP Address: 162.241.114.35 162.241.114.35
Source: Joe Sandbox View	IP Address: 162.241.114.35 162.241.114.35

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.22
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.5
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.5
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.191.45.158
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CO6MywE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: sexa.xftprojects.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons2.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons3.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons4.gvt2.com

Source: 77EC63BDA74BD0D0E0426DC8F80085060.6.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.6.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: processed-ach-remittance-031925 (2).pdf	String found in binary or memory: https://sexa.xftprojects.com/)
Source: processed-ach-remittance-031925 (2).pdf	String found in binary or memory: https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificat

Source: unknown	Network traffic detected: HTTP traffic on port 54667 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49680
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54667
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown	HTTPS traffic detected: 162.241.114.35:443 -> 192.168.2.6:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.36:443 -> 192.168.2.6:49714 version: TLS 1.2

System Summary

Found potential malicious PDF (bad image similarity)

Source: processed-ach-remittance-031925 (2).pdf

Static PDF information: Image stream: 8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir8956_804199945

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir8956_804199945

Jump to behavior

Source: classification engine

Classification label: mal56.phis.winPDF@66/47@62/4

Source: processed-ach-remittance-031925 (2).pdf	Initial sample: https://www.docusign.com/features-and-benefits/mobile?utm_campaign=gbl_xx_dbu_ups_2211_signnotificationemailfooter&utm_medium=product&utm_source=postsend
Source: processed-ach-remittance-031925 (2).pdf	Initial sample: https://sexa.xftprojects.com/
Source: processed-ach-remittance-031925 (2).pdf	Initial sample: https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-03-19 01-28-42-020.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\processed-ach-remittance-031925 (2).pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1664 --field-trial-handle=1568,i,4038913409643386264,5492468394634696909,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://sexa.xftprojects.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2040,i,6421133465372305949,14597510339509831683,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1664 --field-trial-handle=1568,i,4038913409643386264,5492468394634696909,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2040,i,6421133465372305949,14597510339509831683,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: processed-ach-remittance-031925 (2).pdf	Initial sample: PDF keyword /JS count = 0
Source: processed-ach-remittance-031925 (2).pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: processed-ach-remittance-031925 (2).pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
processed-ach-remittance-031925 (2).pdf	0%	Virustotal		Browse
processed-ach-remittance-031925 (2).pdf	3%	ReversingLabs	Document-PDF.Phishing.Generic

Source	Detection	Scanner	Label	Link
https://sexa.xftprojects.com/)	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
beacons3.gvt2.com	142.250.185.227	true	false	high
sexa.xftprojects.com	162.241.114.35	true	false	unknown
e8652.dscx.akamaiedge.net	2.19.105.127	true	false	high
beacons-handoff.gcp.gvt2.com	142.250.180.99	true	false	high
www.google.com	142.250.186.36	true	false	high
beacons2.gvt2.com	142.250.194.99	true	false	high
beacons.gvt2.com	142.251.143.67	true	false	high
beacons4.gvt2.com	216.239.32.116	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.6.dr	false		high
https://sexa.xftprojects.com/)	processed-ach-remittance-031925 (2).pdf	false	Avira URL Cloud: safe	unknown
https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificat	processed-ach-remittance-031925 (2).pdf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
2.19.105.127	e8652.dscx.akamaiedge.net	European Union	16625	AKAMAI-ASUS	false
162.241.114.35	sexa.xftprojects.com	United States	46606	UNIFIEDLAYER-AS-1US	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1642548
Start date and time:	2025-03-19 06:27:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	processed-ach-remittance-031925 (2).pdf
Detection:	MAL
Classification:	mal56.phis.winPDF@66/47@62/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 2.19.104.203, 3.233.129.217, 52.22.41.97, 3.219.243.226, 52.6.155.20, 172.64.41.3, 162.159.61.3, 2.16.164.112, 2.16.164.121, 2.16.164.59, 2.16.164.113, 2.16.164.33, 2.16.164.35, 23.219.148.205, 2.18.205.236, 23.33.31.106, 142.250.184.195, 142.250.185.142, 172.217.16.142, 74.125.206.84, 142.250.184.206, 142.250.186.46, 172.217.18.14, 142.250.185.106, 172.217.16.202, 142.250.186.106, 142.250.186.42, 142.250.185.234, 142.250.185.74, 142.250.184.234, 142.250.186.74, 216.58.206.74, 142.250.184.202, 142.250.181.234, 172.217.18.10, 142.250.186.170, 172.217.16.138, 216.58.206.42, 142.250.186.138, 142.250.181.238, 142.251.35.174, 63.117.68.20, 199.232.210.172, 142.250.186.131, 216.58.212.163, 142.250.185.174, 23.60.203.209, 4.175.87.197, 172.202.163.200
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, r6.sn-8xgp1vo-ab56.gvt1.com, clientservices.googleapis.com, a767.dspw65.akamai.net, acroipm2.adobe.com, clients2.google.com, redirector.gvt1.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, wu-b-net.trafficmanager.net, optimizationguide-pa.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ssl.adobe.com.edgekey.net, edgedl.me.gvt1.com, armmf.adobe.com, r6---sn-8xgp1vo-ab56.gvt1.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:28:52	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2.19.105.127	Emarine System Contact Update.pdf	Get hash	malicious	HTMLPhisher	Browse	x1.i.lencr.org/
	nZsqQiT9Wr.lnk	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	Elm City Communities-encrypted.pdf	Get hash	malicious	HTMLPhisher	Browse	x1.i.lencr.org/
	7ZSfxMod_x86.exe	Get hash	malicious	Gamaredon, UltraVNC	Browse	x1.i.lencr.org/
	Cbonline Q1 Handbook-0782794.pdf	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	x1.i.lencr.org/
	ZWOLANIE-_1 (1) (2) (2).pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	aaaaaaaa.docx.doc	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	Acuerdo_de_Orden_de_Compra001.pdf.lnk	Get hash	malicious	Remcos	Browse	x1.i.lencr.org/
	Attach_Project_27022025.pdf	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	x1.i.lencr.org/
	osnova.ps1	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
162.241.114.35	Enquiry-Dubai.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	jilas.net/files/222.txt
	Ferc Q1 2025 401(k) Statement-5997707969.pdf	Get hash	malicious	HTMLPhisher	Browse	r56eqpki1r3pdt55n3rm.wearedhaka.com/favicon.ico
	https://google.com.mx//url?ob=pglnk4shsljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/Kcxz0m1anE-SUREDANN-Y3NoYW5ub25Ac2tvcmJ1cmdjb21wYW55LmNvbQ==	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse	braverygray.com/favicon.ico
	88a4dd8-Contract Agreement-Final378208743.pdf	Get hash	malicious	Unknown	Browse	cofnbpbnp.edwardrochford.com/favicon.ico
	754619b-Contract Agreement-Final727916073.pdf	Get hash	malicious	Unknown	Browse	repubrepub.edwardrochford.com/favicon.ico
	http://zerpcon.com	Get hash	malicious	Unknown	Browse	zerpcon.com/nxgtnrtn/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
beacons3.gvt2.com	http://overtimeforus.com/pols	Get hash	malicious	Unknown	Browse	142.250.186.99
	947060507.svg	Get hash	malicious	HTMLPhisher	Browse	172.217.16.131
	http://politicallyartisticsocks.com	Get hash	malicious	Unknown	Browse	172.217.16.131
	https://www.central1.internationalpayments.com/geo/	Get hash	malicious	Unknown	Browse	142.250.186.163
	http://grantus.org	Get hash	malicious	Unknown	Browse	142.250.185.195
	doc Pg 2A gmt_5057363908.pdf	Get hash	malicious	HTMLPhisher	Browse	172.217.18.99
	https://upbring.org/foster-training-calendar	Get hash	malicious	Unknown	Browse	142.250.185.99
	http://gamma.app	Get hash	malicious	Unknown	Browse	216.58.206.67
	Emarine System Contact Update.pdf	Get hash	malicious	HTMLPhisher	Browse	142.250.185.163
e8652.dscx.akamaiedge.net	DTG.pdf	Get hash	malicious	Unknown	Browse	72.246.169.163
	Munsch-Employee-Handbook.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.209.209.135
	doc Pg 2A gmt_5057363908.pdf	Get hash	malicious	HTMLPhisher	Browse	23.192.153.142
	Yasmine Hilal W2, 401(k).pdf	Get hash	malicious	Unknown	Browse	23.192.153.142
	virus.pdf	Get hash	malicious	HTMLPhisher	Browse	92.123.21.129
	Emarine System Contact Update.pdf	Get hash	malicious	HTMLPhisher	Browse	2.19.105.127
	1099-NEC.pdf	Get hash	malicious	RHADAMANTHYS	Browse	23.209.213.129
	1099-NEC.pdf	Get hash	malicious	Unknown	Browse	23.209.209.135
	resume.pdf	Get hash	malicious	Unknown	Browse	23.209.213.129
	f64da42c-e9a8-a0ac-437d-d14377da4643.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.209.213.129
beacons-handoff.gcp.gvt2.com	https://official-site-coinbase-pro-digital-asse.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	142.250.180.67
	https://trezor-io-start-r---starting-auth.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	142.251.143.35
	https://0942774-Mailscanner.000-0x2auixx-7yhx.cc/NARMdP/$verify.background@sterlingcheck.com	Get hash	malicious	Unknown	Browse	142.251.143.67
	https://trezor-i-start-org.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	142.250.180.67
	https://trezor-io-start-r-powering.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	142.250.180.67
	https://messagerieorange5.godaddysites.com/identifiez-vous	Get hash	malicious	Unknown	Browse	142.251.143.67
	https://bmchaturvedi.in/wp-content/uploads/admin.php	Get hash	malicious	Unknown	Browse	142.251.143.67
	http://communaute-protestante-berlin.de/din	Get hash	malicious	Unknown	Browse	142.250.180.99
	https://1158f3d.wcomhost.com/lo/index.php	Get hash	malicious	Unknown	Browse	142.250.185.163
	http://ajrdn.qqmasonry.com/	Get hash	malicious	Unknown	Browse	142.250.185.67
bg.microsoft.map.fastly.net	1.exe	Get hash	malicious	VIP Keylogger	Browse	199.232.214.172
	2SXBuho.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://steampowered.doomthedarkages-invite.com/app/DOOM_THE_DARK_AGES/2246340/	Get hash	malicious	Unknown	Browse	199.232.214.172
	FluxusV7.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	DEVM28.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	ORDER-984486-895432.js	Get hash	malicious	WSHRat, AsyncRAT	Browse	199.232.214.172
	Message.eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	The Powder Shop Inc.eml	Get hash	malicious	unknown	Browse	199.232.210.172
	lMAZvNDY8G.exe	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	DTG.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	http://ajrdn.qqmasonry.com/	Get hash	malicious	Unknown	Browse	192.185.198.213
	https://host09318.com/#gia@gds-industries.com	Get hash	malicious	HTMLPhisher	Browse	162.241.225.33
	DTG.pdf	Get hash	malicious	Unknown	Browse	162.214.69.41
	https://gqp37f3i3u.us-east-1.awsapprunner.com/#nik@karash.biz	Get hash	malicious	HTMLPhisher	Browse	173.254.28.213
	http://ajrdn.qqmasonry.com/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	192.185.198.213
	hgfs.mpsl.elf	Get hash	malicious	Unknown	Browse	198.1.102.65
	virus.pdf	Get hash	malicious	HTMLPhisher	Browse	192.185.25.215
	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	69.49.230.198
	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	69.49.230.198
	Sat#U0131nalma Sipari#U015fi Q4-2025-V5560001.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	192.254.225.136
AKAMAI-ASUS	hoho.m68k.elf	Get hash	malicious	Unknown	Browse	184.31.203.169
	https://sceanmcommnunmnlty.com/siute/apxpw/zpq	Get hash	malicious	Unknown	Browse	2.16.202.91
	random.exe	Get hash	malicious	Unknown	Browse	104.73.234.102
	https://messagerieorange5.godaddysites.com/identifiez-vous	Get hash	malicious	Unknown	Browse	23.199.222.88
	http://steampowered.doomthedarkages-invite.com/app/DOOM_THE_DARK_AGES/2246340/	Get hash	malicious	Unknown	Browse	95.101.177.190
	https://tureforma.us13.list-manage.com/track/click?u=bac98affc3a72272e373cbb77&id=fb4a543799&e=daa59f7daf	Get hash	malicious	Unknown	Browse	95.100.65.46
	http://www.islandclipper.com/	Get hash	malicious	Unknown	Browse	92.123.12.5
	http://overtimeforus.com/pols	Get hash	malicious	Unknown	Browse	23.199.214.10
	DTG.pdf	Get hash	malicious	Unknown	Browse	72.246.169.163
	https://crazy-moments.com/	Get hash	malicious	Unknown	Browse	2.19.244.157

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.185361747749887
Encrypted:	false
SSDEEP:	6:iOG5g8N+q2PN72nKuAl9OmbnIFUto5goDCWZmwC5goDBVkwON72nKuAl9OmbjLJ:7G5gA+vVaHAahFUto5goDCW/C5goDBV8
MD5:	3D6D0E1AF02933632CB3D0B060A1B031
SHA1:	286EAA7A09932119491D0A84F39F52B4CDC33495
SHA-256:	3D401CF131F5850C813CCEE6FAFCFF3C9E3DF470CF7AAE28A88E71A7C4BDACB5
SHA-512:	4420895CB1AF61FD29023E849580EAB6D06EC0564FAB8EC880A3A5FA4A8BD5ED073B7025A07104B6E879739A0E57D1D45129E5AFB37ECE9686B07C4591363890
Malicious:	false
Reputation:	low
Preview:	2025/03/19-01:28:40.598 1fcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/19-01:28:40.600 1fcc Recovering log #3.2025/03/19-01:28:40.600 1fcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3298)
Category:	downloaded
Size (bytes):	3303
Entropy (8bit):	5.845280999261656
Encrypted:	false
SSDEEP:	96:bdlgH6666Ln5Jn4drLPRLIiZ1DX0W2f9UKfffQfo:ngH6666jf4dfPR0EX49d
MD5:	DCE91BCB71AEB7FAF524590EF2F5F593
SHA1:	82E4AF278B91166AC6922690F415663A8D0BCEC0
SHA-256:	6B1DEB15D074DB37124A88AC233D2B787BB46BB95AEC9F39AEA3C1790A8B1B90
SHA-512:	3DEF6EA46A41520896BEBFE7FC47D215B780F9F27E762D32987E9839E22729277B1CE767DA268B477955C73334BBFF27014771EB2CF913BC7437BD42F07DCD52
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
Preview:	)]}'.["",["frozen meals recalled","snow storm weather forecast","samsung galaxy one ui 7","general hospital hospital spoilers","amari cooper","pepsico buys prebiotic soda brand poppi","alexa amazon echo","new mortal kombat movie trailer"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChoIkk4SFQoRVHJlbmRpbmcgc2VhcmNoZXMoCg\u003d\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgovbS8wbmd0NHNuEhZGb290YmFsbCB3aWRlIHJlY2VpdmVyMosNZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBYkFBRUJBQU1BQXdBQUFBQUFBQUFBQUFBSEFBUUZCZ0VDQS8vRUFEQVFBQUVEQWdRRUJRTUVBd0FBQUFBQUFBRUNBd1FBRVFVR0VpRVRNWEdCQnlKQlVXRV

File type:	PDF document, version 1.4, 1 pages
Entropy (8bit):	7.896810025788748
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	processed-ach-remittance-031925 (2).pdf
File size:	60'986 bytes
MD5:	6ef7005eef078fd12a90f03a7753070a
SHA1:	1f46d7868b22652458ef028d09f72baa5e1c3b9d
SHA256:	2e45baa2e3bf3ea5da01f8a64e6e16ffca7a3da58ed8b9b295f85df4d1c89685
SHA512:	8021b2cd22407ae018adff729ad0fb4c78b948d20f5311a1fb4d83bb0c5491edb0b2fc76dfd316dabf17fa369d3117f513f770b332c249068e77507d7a4cb0dd
SSDEEP:	1536:1jk744Enpjaoel4qXkTXK4aVXSMnc1QTxN2/ncbQC1:EPM295kG7iMnwQTxN2fHy
TLSH:	E653D0B4B1660C98E995C34A923435C98D4DF62E5AC518DA10B80EC3BD8CCD5AB73ADE
File Content Preview:	%PDF-1.4.%.....1 0 obj.<</Title (HTML Editor - Full Version)./Creator (Mozilla/5.0 \(X11; Linux x86_64\) AppleWebKit/537.36 \(KHTML, like Gecko\) HeadlessChrome/134.0.0.0 Safari/537.36)./Producer (Skia/PDF m134)./CreationDate (D:20250318164850+00'00')./Mo

General
Header:	%PDF-1.4
Total Entropy:	7.896810
Total Bytes:	60986
Stream Entropy:	7.993708
Stream Bytes:	51353
Entropy outside Streams:	5.322819
Bytes outside Streams:	9633
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	46
endobj	46
stream	20
endstream	20
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	6
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

ID	DHASH	MD5
4	0000000000000000	fdda827b0288c9be4e93817da3e71081
5	0404062a6c525e06	0d3ea7540d369c250d3397855404bb59
7	0000000000000000	b757ef81fffb0184381ecdf8d87f3779
8	cca66d5155599acc	258e49f428d437bbebb097b44e84cbd0
15	0000000000000000	b59e0552698cb5528e78ea7592e02340

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 06:28:32.850531101 CET	49672	443	192.168.2.6	204.79.197.203
Mar 19, 2025 06:28:35.256844997 CET	49672	443	192.168.2.6	204.79.197.203
Mar 19, 2025 06:28:39.320266962 CET	49678	443	192.168.2.6	20.42.65.91
Mar 19, 2025 06:28:39.631764889 CET	49678	443	192.168.2.6	20.42.65.91
Mar 19, 2025 06:28:40.069298029 CET	49672	443	192.168.2.6	204.79.197.203
Mar 19, 2025 06:28:40.241184950 CET	49678	443	192.168.2.6	20.42.65.91
Mar 19, 2025 06:28:41.445872068 CET	49678	443	192.168.2.6	20.42.65.91
Mar 19, 2025 06:28:43.854857922 CET	49678	443	192.168.2.6	20.42.65.91
Mar 19, 2025 06:28:48.656131029 CET	49678	443	192.168.2.6	20.42.65.91
Mar 19, 2025 06:28:49.671720028 CET	49672	443	192.168.2.6	204.79.197.203
Mar 19, 2025 06:28:52.586952925 CET	49702	80	192.168.2.6	2.19.105.127
Mar 19, 2025 06:28:52.592729092 CET	80	49702	2.19.105.127	192.168.2.6
Mar 19, 2025 06:28:52.592849970 CET	49702	80	192.168.2.6	2.19.105.127
Mar 19, 2025 06:28:52.592924118 CET	49702	80	192.168.2.6	2.19.105.127
Mar 19, 2025 06:28:52.597568035 CET	80	49702	2.19.105.127	192.168.2.6
Mar 19, 2025 06:28:53.249305964 CET	80	49702	2.19.105.127	192.168.2.6
Mar 19, 2025 06:28:53.249320984 CET	80	49702	2.19.105.127	192.168.2.6
Mar 19, 2025 06:28:53.249417067 CET	49702	80	192.168.2.6	2.19.105.127
Mar 19, 2025 06:28:53.389328957 CET	80	49702	2.19.105.127	192.168.2.6
Mar 19, 2025 06:28:53.432113886 CET	49702	80	192.168.2.6	2.19.105.127
Mar 19, 2025 06:28:58.257868052 CET	49678	443	192.168.2.6	20.42.65.91
Mar 19, 2025 06:29:06.048429966 CET	49702	80	192.168.2.6	2.19.105.127
Mar 19, 2025 06:29:09.943988085 CET	49705	443	192.168.2.6	162.241.114.35
Mar 19, 2025 06:29:09.944035053 CET	443	49705	162.241.114.35	192.168.2.6
Mar 19, 2025 06:29:09.944092989 CET	49705	443	192.168.2.6	162.241.114.35
Mar 19, 2025 06:29:09.972843885 CET	49705	443	192.168.2.6	162.241.114.35
Mar 19, 2025 06:29:09.972877026 CET	443	49705	162.241.114.35	192.168.2.6
Mar 19, 2025 06:29:10.617311954 CET	443	49705	162.241.114.35	192.168.2.6
Mar 19, 2025 06:29:10.618947983 CET	49705	443	192.168.2.6	162.241.114.35
Mar 19, 2025 06:29:10.622925997 CET	49705	443	192.168.2.6	162.241.114.35
Mar 19, 2025 06:29:10.622958899 CET	443	49705	162.241.114.35	192.168.2.6
Mar 19, 2025 06:29:10.623233080 CET	443	49705	162.241.114.35	192.168.2.6
Mar 19, 2025 06:29:10.806176901 CET	49705	443	192.168.2.6	162.241.114.35
Mar 19, 2025 06:29:10.806314945 CET	443	49705	162.241.114.35	192.168.2.6
Mar 19, 2025 06:29:10.806400061 CET	49705	443	192.168.2.6	162.241.114.35
Mar 19, 2025 06:29:14.067931890 CET	49714	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:29:14.067996979 CET	443	49714	142.250.186.36	192.168.2.6
Mar 19, 2025 06:29:14.068101883 CET	49714	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:29:14.068442106 CET	49714	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:29:14.068458080 CET	443	49714	142.250.186.36	192.168.2.6
Mar 19, 2025 06:29:14.731545925 CET	443	49714	142.250.186.36	192.168.2.6
Mar 19, 2025 06:29:14.731626034 CET	49714	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:29:14.735049963 CET	49714	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:29:14.735063076 CET	443	49714	142.250.186.36	192.168.2.6
Mar 19, 2025 06:29:14.735512018 CET	443	49714	142.250.186.36	192.168.2.6
Mar 19, 2025 06:29:14.782110929 CET	49714	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:29:15.187776089 CET	54648	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:29:15.192604065 CET	53	54648	1.1.1.1	192.168.2.6
Mar 19, 2025 06:29:15.192703962 CET	54648	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:29:15.192743063 CET	54648	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:29:15.197376013 CET	53	54648	1.1.1.1	192.168.2.6
Mar 19, 2025 06:29:15.697237015 CET	53	54648	1.1.1.1	192.168.2.6
Mar 19, 2025 06:29:15.697897911 CET	54648	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:29:15.702799082 CET	53	54648	1.1.1.1	192.168.2.6
Mar 19, 2025 06:29:15.702877998 CET	54648	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:29:18.934360027 CET	49714	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:29:18.976315975 CET	443	49714	142.250.186.36	192.168.2.6
Mar 19, 2025 06:29:19.146862030 CET	443	49714	142.250.186.36	192.168.2.6
Mar 19, 2025 06:29:19.146982908 CET	443	49714	142.250.186.36	192.168.2.6
Mar 19, 2025 06:29:19.147085905 CET	443	49714	142.250.186.36	192.168.2.6
Mar 19, 2025 06:29:19.147161961 CET	49714	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:29:19.147177935 CET	443	49714	142.250.186.36	192.168.2.6
Mar 19, 2025 06:29:19.147232056 CET	49714	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:29:19.147286892 CET	443	49714	142.250.186.36	192.168.2.6
Mar 19, 2025 06:29:19.147445917 CET	443	49714	142.250.186.36	192.168.2.6
Mar 19, 2025 06:29:19.147598982 CET	49714	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:29:19.148830891 CET	49714	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:29:19.148844957 CET	443	49714	142.250.186.36	192.168.2.6
Mar 19, 2025 06:29:26.932667017 CET	49686	443	192.168.2.6	184.86.251.22
Mar 19, 2025 06:29:26.932821035 CET	49689	80	192.168.2.6	2.23.77.188
Mar 19, 2025 06:29:49.999005079 CET	443	49680	2.23.227.215	192.168.2.6
Mar 19, 2025 06:29:49.999102116 CET	443	49680	2.23.227.215	192.168.2.6
Mar 19, 2025 06:29:49.999174118 CET	49680	443	192.168.2.6	2.23.227.215
Mar 19, 2025 06:29:49.999175072 CET	49680	443	192.168.2.6	2.23.227.215
Mar 19, 2025 06:30:11.992221117 CET	49684	80	192.168.2.6	2.23.77.188
Mar 19, 2025 06:30:11.992221117 CET	49682	443	192.168.2.6	20.190.160.5
Mar 19, 2025 06:30:11.997303009 CET	80	49684	2.23.77.188	192.168.2.6
Mar 19, 2025 06:30:11.997417927 CET	49684	80	192.168.2.6	2.23.77.188
Mar 19, 2025 06:30:11.997751951 CET	443	49682	20.190.160.5	192.168.2.6
Mar 19, 2025 06:30:11.997814894 CET	49682	443	192.168.2.6	20.190.160.5
Mar 19, 2025 06:30:14.118027925 CET	54667	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:30:14.118082047 CET	443	54667	142.250.186.36	192.168.2.6
Mar 19, 2025 06:30:14.118146896 CET	54667	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:30:14.118449926 CET	54667	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:30:14.118468046 CET	443	54667	142.250.186.36	192.168.2.6
Mar 19, 2025 06:30:14.789374113 CET	443	54667	142.250.186.36	192.168.2.6
Mar 19, 2025 06:30:14.789623022 CET	54667	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:30:14.789644003 CET	443	54667	142.250.186.36	192.168.2.6
Mar 19, 2025 06:30:24.682969093 CET	443	54667	142.250.186.36	192.168.2.6
Mar 19, 2025 06:30:24.683118105 CET	443	54667	142.250.186.36	192.168.2.6
Mar 19, 2025 06:30:24.683248043 CET	54667	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:30:26.337841988 CET	54667	443	192.168.2.6	142.250.186.36
Mar 19, 2025 06:30:26.337877035 CET	443	54667	142.250.186.36	192.168.2.6
Mar 19, 2025 06:30:48.936906099 CET	62309	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:48.941569090 CET	53	62309	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:48.941653013 CET	62309	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:48.941685915 CET	62309	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:48.946408987 CET	53	62309	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:49.471191883 CET	53	62309	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:49.471667051 CET	62309	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:49.476586103 CET	53	62309	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:49.476670027 CET	62309	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:54.141084909 CET	49679	443	192.168.2.6	20.191.45.158

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 06:28:52.575351000 CET	55801	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:28:52.583966017 CET	53	55801	1.1.1.1	192.168.2.6
Mar 19, 2025 06:29:09.794711113 CET	61919	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:29:09.795110941 CET	62892	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:29:09.802721977 CET	53	61366	1.1.1.1	192.168.2.6
Mar 19, 2025 06:29:09.809566021 CET	53	62892	1.1.1.1	192.168.2.6
Mar 19, 2025 06:29:09.816272020 CET	53	61919	1.1.1.1	192.168.2.6
Mar 19, 2025 06:29:09.980459929 CET	53	55908	1.1.1.1	192.168.2.6
Mar 19, 2025 06:29:11.089633942 CET	53	64734	1.1.1.1	192.168.2.6
Mar 19, 2025 06:29:11.138333082 CET	53	56239	1.1.1.1	192.168.2.6
Mar 19, 2025 06:29:13.171996117 CET	53	56030	1.1.1.1	192.168.2.6
Mar 19, 2025 06:29:14.055361032 CET	54021	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:29:14.055707932 CET	50293	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:29:14.063479900 CET	53	54021	1.1.1.1	192.168.2.6
Mar 19, 2025 06:29:14.064038992 CET	53	50293	1.1.1.1	192.168.2.6
Mar 19, 2025 06:29:15.186443090 CET	53	49265	1.1.1.1	192.168.2.6
Mar 19, 2025 06:29:37.388778925 CET	138	138	192.168.2.6	192.168.2.255
Mar 19, 2025 06:30:09.380414009 CET	53	63108	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:12.968151093 CET	53	54383	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:20.339946032 CET	54405	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:20.340229034 CET	65091	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:20.346721888 CET	53	54405	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:20.346968889 CET	53	65091	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:21.366355896 CET	52228	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:21.366549969 CET	62205	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:21.373542070 CET	53	52228	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:21.373754978 CET	53	62205	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:23.397732019 CET	56666	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:23.404578924 CET	53	56666	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:24.413672924 CET	56666	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:24.421623945 CET	53	56666	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:25.428664923 CET	56666	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:25.435291052 CET	53	56666	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:27.428987026 CET	56666	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:27.435579062 CET	53	56666	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:31.459461927 CET	56666	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:31.466103077 CET	53	56666	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:36.340176105 CET	49745	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:36.340279102 CET	49938	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:36.346860886 CET	53	49745	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:36.347791910 CET	53	49938	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:37.366838932 CET	59091	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:37.373869896 CET	53	59091	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:39.399251938 CET	65166	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:39.407368898 CET	53	65166	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:40.413794041 CET	65166	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:40.420823097 CET	53	65166	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:41.414314985 CET	65166	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:41.421144962 CET	53	65166	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:43.429482937 CET	65166	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:43.436476946 CET	53	65166	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:47.444370031 CET	65166	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:47.451404095 CET	53	65166	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:48.936248064 CET	53	59144	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:52.339299917 CET	53197	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:52.339660883 CET	51402	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:52.346232891 CET	53	53197	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:52.346740961 CET	53	51402	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:53.366890907 CET	59352	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:53.373564005 CET	53	59352	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:55.398116112 CET	53080	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:55.404915094 CET	53	53080	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:56.398003101 CET	53080	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:56.406218052 CET	53	53080	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:57.398212910 CET	53080	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:57.405270100 CET	53	53080	1.1.1.1	192.168.2.6
Mar 19, 2025 06:30:59.413395882 CET	53080	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:30:59.421472073 CET	53	53080	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:03.413352013 CET	53080	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:03.419858932 CET	53	53080	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:08.338198900 CET	61991	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:08.338329077 CET	56479	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:08.345325947 CET	53	61991	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:08.345746994 CET	53	56479	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:09.353789091 CET	51273	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:09.360670090 CET	53	51273	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:11.382407904 CET	55538	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:11.389492989 CET	53	55538	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:12.382380009 CET	55538	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:12.389046907 CET	53	55538	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:13.398049116 CET	55538	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:13.405006886 CET	53	55538	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:15.399756908 CET	55538	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:15.406471014 CET	53	55538	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:19.413208008 CET	55538	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:19.419720888 CET	53	55538	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:24.341272116 CET	53826	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:24.341415882 CET	57376	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:24.348397970 CET	53	53826	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:24.348975897 CET	53	57376	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:25.366173983 CET	57899	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:25.373451948 CET	53	57899	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:27.397821903 CET	53383	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:27.405148029 CET	53	53383	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:28.398372889 CET	53383	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:28.405328035 CET	53	53383	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:29.412903070 CET	53383	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:29.433923960 CET	53	53383	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:31.413674116 CET	53383	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:31.420876980 CET	53	53383	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:35.428949118 CET	53383	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:35.436256886 CET	53	53383	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:36.325819969 CET	60891	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:36.326111078 CET	58048	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:36.332798958 CET	53	58048	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:36.333242893 CET	53	60891	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:37.351221085 CET	63959	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:37.351357937 CET	62548	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:37.357846975 CET	53	63959	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:37.358799934 CET	53	62548	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:39.383111000 CET	51286	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:39.389981031 CET	53	51286	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:40.397691965 CET	51286	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:40.406289101 CET	53	51286	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:41.411660910 CET	51286	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:41.419151068 CET	53	51286	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:43.413343906 CET	51286	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:43.420348883 CET	53	51286	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:47.428469896 CET	51286	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:47.435333014 CET	53	51286	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:52.339654922 CET	56272	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:52.339787960 CET	50092	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:52.340152025 CET	60254	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:52.340297937 CET	61893	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:52.346765995 CET	53	60254	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:52.346791983 CET	53	61893	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:52.347059011 CET	53	56272	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:52.347444057 CET	53	50092	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:53.351605892 CET	51446	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:53.351605892 CET	55670	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:53.351736069 CET	50831	53	192.168.2.6	1.1.1.1
Mar 19, 2025 06:31:53.358748913 CET	53	51446	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:53.358803034 CET	53	50831	1.1.1.1	192.168.2.6
Mar 19, 2025 06:31:53.358833075 CET	53	55670	1.1.1.1	192.168.2.6

Timestamp	Bytes transferred	Direction	Data
Mar 19, 2025 06:28:52.592924118 CET	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Mar 19, 2025 06:28:53.249305964 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=62642 Expires: Wed, 19 Mar 2025 22:52:55 GMT Date: Wed, 19 Mar 2025 05:28:53 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urIAv5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0*HUX
Mar 19, 2025 06:28:53.249320984 CET	224	IN	Data Raw: a9 bc b2 a8 50 d0 0c b1 d8 1a 69 20 27 29 08 ac 61 75 5c 8a 6e f8 82 e5 69 2f d5 f6 56 4b b9 b8 73 10 59 d3 21 97 7e e7 4c 71 fb b2 d2 60 ad 39 a8 0b ea 17 21 56 85 f1 50 0e 59 eb ce e0 59 e9 ba c9 15 ef 86 9d 8f 84 80 f6 e4 e9 91 90 dc 17 9b 62 Data Ascii: Pi ')au\ni/VKsY!~Lq`9!VPYYbEf\|o;'}~"+"4[XT&3L-<W,N;1"ss993#L<U)"k;W:pMMl]+NE
Mar 19, 2025 06:28:53.389328957 CET	285	IN	Data Raw: d6 4a d0 26 cc e5 72 ca 08 6a a5 95 e3 15 a1 f7 a4 ed c9 2c 5f a5 fb ff ac 28 02 2e be d7 7b bb e3 71 7b 90 16 d3 07 5e 46 53 7c 37 07 42 8c d3 c4 96 9c d5 99 b5 2a e0 95 1a 80 48 ae 4c 39 07 ce cc 47 a4 52 95 2b ba b8 fb ad d2 33 53 7d e5 1d 4d Data Ascii: J&rj,_(.{q{^FS\|7BHL9GR+3S}MmBo@'5\(3#PylFn~:R-?[$jCa[;v-u3l=S{A_a8]7u3AruAB_g$H'?OtQz#(<1zl

Timestamp	Bytes transferred	Direction	Data
2025-03-19 05:29:18 UTC	487	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CO6MywE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 05:29:19 UTC	1303	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 05:29:19 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-47vJZPa-tJO_zkioUUoUNQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-19 05:29:19 UTC	87	IN	Data Raw: 63 65 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 66 72 6f 7a 65 6e 20 6d 65 61 6c 73 20 72 65 63 61 6c 6c 65 64 22 2c 22 73 6e 6f 77 20 73 74 6f 72 6d 20 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 22 2c 22 73 61 6d 73 75 6e 67 20 67 61 6c 61 78 79 20 6f 6e Data Ascii: ce7)]}'["",["frozen meals recalled","snow storm weather forecast","samsung galaxy on
2025-03-19 05:29:19 UTC	1390	IN	Data Raw: 65 20 75 69 20 37 22 2c 22 67 65 6e 65 72 61 6c 20 68 6f 73 70 69 74 61 6c 20 68 6f 73 70 69 74 61 6c 20 73 70 6f 69 6c 65 72 73 22 2c 22 61 6d 61 72 69 20 63 6f 6f 70 65 72 22 2c 22 70 65 70 73 69 63 6f 20 62 75 79 73 20 70 72 65 62 69 6f 74 69 63 20 73 6f 64 61 20 62 72 61 6e 64 20 70 6f 70 70 69 22 2c 22 61 6c 65 78 61 20 61 6d 61 7a 6f 6e 20 65 63 68 6f 22 2c 22 6e 65 77 20 6d 6f 72 74 61 6c 20 6b 6f 6d 62 61 74 20 6d 6f 76 69 65 20 74 72 61 69 6c 65 72 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 Data Ascii: e ui 7","general hospital hospital spoilers","amari cooper","pepsico buys prebiotic soda brand poppi","alexa amazon echo","new mortal kombat movie trailer"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"C
2025-03-19 05:29:19 UTC	1390	IN	Data Raw: 49 34 57 57 4e 74 54 33 68 34 56 6c 41 7a 53 33 4a 46 53 55 4e 79 5a 32 52 31 55 58 46 51 55 45 70 4f 4e 6d 59 77 56 7a 45 30 64 45 78 61 61 44 51 33 51 31 70 6f 4e 6c 5a 43 56 32 35 57 65 58 56 69 57 44 6b 32 56 69 39 42 65 56 4e 59 63 32 39 35 56 30 77 7a 59 6d 70 55 62 6b 56 30 4e 7a 64 68 56 6b 70 54 64 6d 4a 31 63 7a 42 61 63 57 70 55 53 6c 4d 7a 62 57 74 31 53 56 56 30 53 58 5a 78 55 58 4a 5a 4e 32 4e 79 4f 48 49 77 5a 79 74 43 61 6d 70 70 57 56 64 4e 65 46 5a 49 65 58 52 35 52 55 77 77 4d 6b 64 35 62 45 70 4a 53 6e 59 34 51 58 52 49 4e 47 39 79 64 47 4a 49 57 6d 6f 33 5a 47 6c 6f 56 6c 5a 57 56 6d 68 44 56 6c 5a 57 57 55 64 4e 4e 44 46 6f 64 55 4a 34 52 6c 4e 7a 56 6d 31 4e 65 47 31 6e 51 31 4a 34 52 6d 64 47 57 6b 46 32 57 6b 6b 31 63 56 42 33 54 Data Ascii: I4WWNtT3h4VlAzS3JFSUNyZ2R1UXFQUEpONmYwVzE0dExaaDQ3Q1poNlZCV25WeXViWDk2Vi9BeVNYc295V0wzYmpUbkV0NzdhVkpTdmJ1czBacWpUSlMzbWt1SVV0SXZxUXJZN2NyOHIwZytCamppWVdNeFZIeXR5RUwwMkd5bEpJSnY4QXRING9ydGJIWmo3ZGloVlZWVmhDVlZWWUdNNDFodUJ4RlNzVm1NeG1nQ1J4RmdGWkF2Wkk1cVB3T
2025-03-19 05:29:19 UTC	443	IN	Data Raw: 54 44 42 6e 64 45 46 6e 51 6e 56 53 64 32 6c 75 63 41 5a 77 42 77 5c 75 30 30 33 64 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 65 76 65 6e 74 69 64 22 3a 22 2d 33 33 39 36 39 34 30 31 35 38 30 38 31 33 35 32 30 34 35 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 31 2c 31 32 35 30 2c 37 30 35 2c 37 30 34 2c 37 30 33 2c 37 30 32 2c 37 30 31 2c 37 30 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c Data Ascii: TDBndEFnQnVSd2lucAZwBw\u003d\u003d","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggesteventid":"-3396940158081352045","google:suggestrelevance":[1251,1250,705,704,703,702,701,700],"google:suggestsubtypes":[[3,143,362,308],[3,143,362,308],
2025-03-19 05:29:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	01:28:37
Start date:	19/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\processed-ach-remittance-031925 (2).pdf"
Imagebase:	0x7ff767a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	01:28:39
Start date:	19/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6fe940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	01:28:40
Start date:	19/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1664 --field-trial-handle=1568,i,4038913409643386264,5492468394634696909,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6fe940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	01:29:03
Start date:	19/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://sexa.xftprojects.com/"
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	14
Start time:	01:29:08
Start date:	19/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --subproc-heap-profiling --field-trial-handle=2040,i,6421133465372305949,14597510339509831683,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report processed-ach-remittance-031925 (2).pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c069825f-57e8-461d-95b7-7806e3978d61.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250319052844Z-194.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Windows Analysis Report
processed-ach-remittance-031925 (2).pdf

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre