Windows Analysis Report
Crystaphase Pricing Increase Notification - For BP - 15Dec2024.pdf

Overview

General Information

Sample name:	Crystaphase Pricing Increase Notification - For BP - 15Dec2024.pdf
Analysis ID:	1523653
MD5:	5f18350c3c41665fb08135a75c9ad220
SHA1:	4380f4a153d734b50f68170c242f95904d33970c
SHA256:	036e795f64a81d6c8413251b3c2c493c5bd8a0c0806cc3924b6b8b425a4000a6

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Classification

Signatures

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49727 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.16:64103 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64103 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64103 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64103 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64103 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64103 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64103 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.104.175
Source: unknown	TCP traffic detected without corresponding DNS query: 204.11.58.229

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64106

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49727 version: TLS 1.2

Source: classification engine

Classification label: clean1.winPDF@43/47@3/137

Source: Crystaphase Pricing Increase Notification - For BP - 15Dec2024.pdf	Initial sample: https://uniqueinternationalonline.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPU1UaDZNMnc9JnVpZD1VU0VSMzAwOTIwMjRVMzYwOTMwMDE=N0123N%5bEMAIL%5d
Source: Crystaphase Pricing Increase Notification - For BP - 15Dec2024.pdf	Initial sample: https://uniqueinternationalonline.com/n/?c3y9bzm2nv8xx25vbszyyw5kpu1uadznmnc9jnvpzd1vu0vsmzawotiwmjrvmzywotmwmde=n0123n%5bemail%5d

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5724

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 16-18-19-541.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Crystaphase Pricing Increase Notification - For BP - 15Dec2024.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1572,i,4366761118859515717,13940811876800436482,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 8A021AC4F6863322F9ACFB31B7FD8A85
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://uniqueinternationalonline.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPU1UaDZNMnc9JnVpZD1VU0VSMzAwOTIwMjRVMzYwOTMwMDE=N0123N%5bEMAIL%5d
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1948,i,8743573594670315975,5055157744585797366,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1572,i,4366761118859515717,13940811876800436482,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://uniqueinternationalonline.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPU1UaDZNMnc9JnVpZD1VU0VSMzAwOTIwMjRVMzYwOTMwMDE=N0123N%5bEMAIL%5d
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1960,i,16745212707192947683,16265443620512226316,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://uniqueinternationalonline.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPU1UaDZNMnc9JnVpZD1VU0VSMzAwOTIwMjRVMzYwOTMwMDE=N0123N%5bEMAIL%5d
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://uniqueinternationalonline.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPU1UaDZNMnc9JnVpZD1VU0VSMzAwOTIwMjRVMzYwOTMwMDE=N0123N%5bEMAIL%5d
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1948,i,8743573594670315975,5055157744585797366,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1960,i,16745212707192947683,16265443620512226316,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Crystaphase Pricing Increase Notification - For BP - 15Dec2024.pdf	Initial sample: PDF keyword /JS count = 0
Source: Crystaphase Pricing Increase Notification - For BP - 15Dec2024.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Crystaphase Pricing Increase Notification - For BP - 15Dec2024.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false
172.217.16.206	unknown	United States	15169	GOOGLEUS	false
172.217.18.3	unknown	United States	15169	GOOGLEUS	false
2.23.197.184	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
142.250.181.227	unknown	United States	15169	GOOGLEUS	false
64.233.167.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
199.232.214.172	bg.microsoft.map.fastly.net	United States	54113	FASTLYUS	false
18.207.85.246	unknown	United States	14618	AMAZON-AESUS	false
23.203.104.175	unknown	United States	16625	AKAMAI-ASUS	false
172.217.18.110	unknown	United States	15169	GOOGLEUS	false
204.11.58.229	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
www.google.com	142.250.185.68	true
windowsupdatebg.s.llnwi.net	46.228.146.0	true
x1.i.lencr.org	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://uniqueinternationalonline.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPU1UaDZNMnc9JnVpZD1VU0VSMzAwOTIwMjRVMzYwOTMwMDE=N0123N%5bEMAIL%5d	false		unknown

ID:	1523653
Product:	CloudBasic
Start time:	22:17:47
Start date:	01.10.2024
Sample:	Crystaphase Pricing Increase Notification - For BP - 15Dec2024.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	5f18350c3c41665fb08135a75c9ad220
SHA1:	4380f4a153d734b50f68170c242f95904d33970c
SHA256:	036e795f64a81d6c8413251b3c2c493c5bd8a0c0806cc3924b6b8b425a4000a6
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	3446A9E3E1B0D62C237503B25116C3B6	A071DFF7D97492A9477534D9896DC3641EE853E0	54C809E879184022A46963450E6D71A8B460B644C074C5E29288AEE8A54D5FE1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	A17409B90109C4A40C81853BE1B407A3	143E45E405014BF1C481701DB34377B81801858A	18E3C8E9176885A49AA9C6F73576EA2838DEE172C61FA7FB4605072305990A43
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4874da23-60c9-4f9d-9c71-3992fcb9fca9.tmp	JSON data	D968A511AD8973554A0DF2F4CA9934F6	CCBA9083B2793424ED2DB94C04862B095DBBD30C	F2F5B5A4C914331D7A5710B5B6A3AF24260B79F12B5D7B7F508C161B394ED9EB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	D968A511AD8973554A0DF2F4CA9934F6	CCBA9083B2793424ED2DB94C04862B095DBBD30C	F2F5B5A4C914331D7A5710B5B6A3AF24260B79F12B5D7B7F508C161B394ED9EB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	15A1CB9D64E99B78E47D841C2F3B622C	77E104F88EF7112AD12B6E90DAE5B4E427A0E124	7DDD0B7ED62444A34F384355E41670AB8588E284EAF68B2052E86FDF3874763B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	7F563520EC0D83F7EAEC1A93238177ED	B17086AD5BA26A81BEA4ECFBEC3EB33F0DD17DE4	4ADE510F5D30CF4D3EE7B4B7C9DB3C0914484D916B7487C7A4BD5CC8D4FAD90D
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241001201821Z-158.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	CB4CAEE72F3171A2FC1D42E679700C65	543CA4D1BC480F59950AD8DCC3B1AFAA8ED0AF34	F3B2D0DA9A4EE74DC6BC5269D5CA3B241926D4D775EB51CA90E117FE1382E771
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	3B7B55E840D899FA3053D663163C8F00	D40AF775E07D1A6AD246F0E6E35B43A789BE68C2	AD0EEF2473016C5B027DDB57B2F0B9F5CA5052BBE9BFBFDFE175B7ED7149DA90
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	8D3C7AB86E327ABB502FBE1AC17F8C9C	957E859BCC9D4B9FBEB658EB4C067130F60ADED7	73BE1E5E91F1D6D3E8298B5052CA0AA2E27634AD7DE00A6169A2128DDEC1D586
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	6651DB4B8ADC6D9E46515C4A42FBE8E0	0F621EB0B4BA41C01266F3F5CF21B4B963D7C39E	628A60F41842DC53FF3F7B29009B0441B3102998A9AC9038AAC76736CFC53658
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5724	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	D3DD2D6D6F85696B5E501FA8F4B167B0	A5C9AD1A44BA090910434B351A697936C7730F90	FC841A22BDACA4A5E7A297C1FA3DAC0AD1C16CC689A2B2918942367771A76425
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	4486C461F4773D8C6170E8B0E27F79DD	6C28956D9F88166F0CA09BDAE94ACB2AB06BAD9E	5DED834448C5854F6CC28BD8B0CEC6E2C55BE9549F2B4A9D03EB5A9AAE720A7F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	166314DAFC870A74964940311176E733	AF76815506FF743A90CA1C68590EF225032F5B5E	2737EB76291652F7919A49667422B3F2C86059BFEE3514DEF9CDEC44A2A9E64B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	C170CA09E545CC140AADFD298967054A	1081F6B7537F51CD20C29996CB9DD8C2152BDDAB	A2AA599DAD25BFBB0A18F725383314AF4757FA137FC997AA352884140A420819
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	76B123CB5389EC96522C63CB9E98F248	C64EEE08A1EBCFB55FD958DB530019AE58470647	1E5DEA99C8D0B5FAFF9B855ED44F69569B1BE99F6388596BB358134CAE158AA1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	7E8F2F07B5D9E1A932FD9A28C466A180	D9CB8820C1D66EEA1E9BA8B9E2D7832647EB9977	A39BAB6B0F2D1C2B803884914277D0783B6A89716BBA863ACA55019B9FB79E17
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	9AA7598A2D51728354E6134BEBF1182E	B1549103379E74F755CF6ED296061AD9575C0248	5C15FBD215CBFAC61CE34D8251C9A1A51FB5FEA6E8587C7F272302420F026607
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	6133CBDA9648140014D018DD66304B2E	74DB62B42A0DC27740DCA528FADFD6BE38EC6F08	97DE38C5BC6FF677B12344A0055F275D244A2B9A5A92B783C4B8959225152ABF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	FCB087BE92273E945C1638E97AC05709	63359B89191592C59ABA25D118E948D44B875C9B	D90CE036722B27038C016FEEA6B96D898F4C86666D84ACF0CC7977A71C6B0D0A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	8C580CFADDE2238A9B33BF27E4C3A0D6	10315300C8331498D49E660E08357CF77D60237A	D23F1772E10263B04301B224F1EB90A59ECE8CA273E8B1E36013E84242206253
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	D88EF26AAADBF1FD82B725EFB342C24F	10642CA918134CDA54E17670A5E9BC7F57DEF62C	71038A46504B7B1DA2C07CEAF61CEF398CA44AEC3B1C2F120AD14637B4ABB6E0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	2EAC98DFA60DBEDC8B59E1DCF3D27763	C28FCEC89E47D81F92046105EDFBAC1A1590B129	79FBD8328F57A4C12879833C1F954EA2CE67DC0EFD8E031EF2162CCEA2F0F555
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	9A4749C60EF8F35511E65519FD218140	E40AD19170B8C1C32AF5A1CD2AF8C3550CB32D38	3E24029FA9BBB0D5328A1B1ED6A87BE4FBAF38BE2517EBC4723182A38B9052D4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	C3D5A3188497C2A5937BADFD6B17F441	23630882421901258FD6981802A305A8BABD8D1E	4D9D11B49BD19290EA64B10BC0A8EEE2EDB5574D300C8AC417D3E3B9FC59C367
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	67F117D8B97DFB9D08281A88C4FAC50E	681565CEC3496FDED8A0CA55D407F42AEDA2EA3E	8C52729E53202762A795117539607C7FD8F8A7C9AF4AC7A6B45B2BC1556F49B2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	9494F9F1F25C0EB559C83D62977760DB	B9ED44543754B21A859D6C69A263CF9661FEE7CD	600442FD985DBA8C071D55D6D07FCF41E92AE2727D3DF827C6B4C2641A0A2C29
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	ED99F391125BE538D06B4EAE857DDC42	0831F3440B7C65041FA3E04ED6A4749DBC5A357D	554D6A08E6756EFFF5FD46AB2A369A0575E30C3DC705D440915064645D58D3F7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	D9E4E94B92DEEA41E7A0FAB899CCC783	203BAFE0C479280D470B1B47CA2ABFF2F696E459	26C7751B2FB9A500AB487D211A4A8CF191022C31834F60AC784C0EBDFBC215F9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	7ECFA91606645775F6D599C7C4DDB775	3200412B4AC9901823FB37718646701DF428AFA0	AE520BAEA62012CDDB23A1F63F3E954D889BBA455CB8E82A8EDA6CF86417ACEA
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 16-18-19-541.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	9AA1013DE61AAEC204F33C7323E270AB	C476CC4954C7D065380CD7F91DA1B378FDD8485F	A3F2E1FF1C52FC2FA4A0FA6C93AC2758C4BC8CE04904B2DA59CB30F578F9391B
C:\Users\user\AppData\Local\Temp\acrocef_low\2d6d1e73-37a5-4c9e-900d-74a014c6354c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	1D64D25345DD73F100517644279994E6	DE807F82098D469302955DCBE1A963CD6E887737	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
C:\Users\user\AppData\Local\Temp\acrocef_low\51c5b795-1042-4f6f-8b42-34720f745771.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 468454	867BDB4816CA7DA521446D3E303B83EA	9DDE1D42F56FFFDD9C6EF758641A4321FF78DD95	20121E1A1954EB63892ADAB2CD9A00439F6D9E54500813C9F6E84BBDB62D1C24
C:\Users\user\AppData\Local\Temp\acrocef_low\bbf9627a-daed-4ff6-8ca2-6c800e3cf670.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\e81b776f-fc2c-42c5-aeb2-b3010c23d790.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	1A39CAAE4C5F8AD2A98F0756FFCBA562	279F2B503A0B10E257674D31532B01EA7DE0473F	57D198C7BDB9B002B8C9C1E1CCFABFE81C00FE0A1E30A237196A7C133237AA95
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 19:18:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3B27BF0DC558CF8B4B7F57B53BC2E218	F000F1401240CE9D6A491B11DD3209A87D45DAF9	C27ABCC18767C14F599EB8DFF73CEAAD823A29AB9D1322C6465B6878F6DD50E7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 19:18:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	853521512C0301FD315E413EA9162F3D	97D770DCEDE1E4F6D20A34C741BE088A4F50049E	70940A3727482F57295EEED291AD6BF767BACC3985D88313D5650304D478D386
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	AA6F2317B87F9B7354A92D4B55D70019	0D9DFCC1E23E1B6A06E405BEC91090B393999A29	A8C2054F57620991923E977E05CBBFE58131457EA33683834DC0C2E3714CD052
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 19:18:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	46772B9BC1917EED2C3144570F99A117	3A61B7379C0FE09D1BEC6590D31F5F42D171A5B8	38EF6F5C90EC32305C5E7DEA546AD657D0312E467291123F3C458275245B7B68
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 19:18:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	34EA41F5B5A07CFE7BE704CBBD68C2FB	E24512E2CDB1FC1C2A1B7615909FA0878A8BDB59	ECF2FA8A0D5501A760BF1AABBAE8D5D7FAC9CB819F6D69C43834073DBE2B3D65
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 19:18:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E37C30541C1B3692FE14FF60355EB892	D3306D75CD60AA32013D6810E5317F92099CD43C	F030D246C96C4F0F69AF9A2898B44BAAD071C1DB8E3FB93B9DFDEB8FB06CF1B0
Chrome Cache Entry: 227	very short file (no magic)	68B329DA9893E34099C7D8AD5CB9C940	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
Chrome Cache Entry: 228	gzip compressed data, from Unix, original size modulo 2^32 583	CB50B952A1A41C3358018129E081D511	9B3CE22F173597240FD0C22FF649F3FFB9C6EA99	791B5CB893932898C350D1EC9888EE9C2FEAEA002431D12E9A1BA29331813BE0

Windows Analysis Report
Crystaphase Pricing Increase Notification - For BP - 15Dec2024.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report Crystaphase Pricing Increase Notification - For BP - 15Dec2024.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
Crystaphase Pricing Increase Notification - For BP - 15Dec2024.pdf