Edit tour

Windows Analysis Report
Yttrande.pdf

Overview

General Information

Sample name:	Yttrande.pdf
Analysis ID:	1528036
MD5:	97087a457449fa32f062fefa68e41ec2
SHA1:	a47d690ccf3dd4fe396a43484c9f80396f019728
SHA256:	f82e00f4790966afdc8f736def4ee118d42fc57da67a39d4c900ff9757913c7b
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 6284 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Yttrande.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6788 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1592,i,8582882510026395687,116098319397815873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

HxOutlook.exe (PID: 7992 cmdline: "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe" -ServerName:microsoft.windowslive.mail.AppXfbjsbkxvprcgqg6q4c9jfr0pn3kv9x5s.mca MD5: 6F8EAC2C377C8F16D91CB5AC8B8DBF5F)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443

Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.16:49711
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.16:49711
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.16:49711
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.16:49711
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.16:49711
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.16:49711
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.16:49711
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.16:49711
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.16:49711
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 192.168.2.16:49711 -> 23.41.168.139:443
Source: global traffic	TCP traffic: 23.41.168.139:443 -> 192.168.2.16:49711

Source: Joe Sandbox View

IP Address: 23.41.168.139 23.41.168.139

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.139
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Yttrande.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1592,i,8582882510026395687,116098319397815873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe" -ServerName:microsoft.windowslive.mail.AppXfbjsbkxvprcgqg6q4c9jfr0pn3kv9x5s.mca
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1592,i,8582882510026395687,116098319397815873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Yttrande.pdf	Initial sample: PDF keyword /JS count = 0
Source: Yttrande.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsym.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsym.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	3 Exploitation for Client Execution	1 Scripting	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	13 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://api.diagnosticssdf.office.com	0%	URL Reputation	safe
https://login.microsoftonline.com/	0%	URL Reputation	safe
https://shell.suite.office.com:1443	0%	URL Reputation	safe
https://designerapp.azurewebsites.net	0%	URL Reputation	safe
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/	0%	URL Reputation	safe
https://useraudit.o365auditrealtimeingestion.manage.office.com	0%	URL Reputation	safe
https://outlook.office365.com/connectors	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://api.addins.omex.office.net/appinfo/query	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/tenantassociationkey	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://lookup.onenote.com/lookup/geolocation/v1	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://cloudfiles.onenote.com/upload.aspx	0%	URL Reputation	safe
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://entitlement.diagnosticssdf.office.com	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://canary.designerapp.	0%	URL Reputation	safe
https://ic3.teams.office.com	0%	URL Reputation	safe
https://www.yammer.com	0%	URL Reputation	safe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	0%	URL Reputation	safe
https://cr.office.com	0%	URL Reputation	safe
https://messagebroker.mobile.m365.svc.cloud.microsoft	0%	URL Reputation	safe
https://portal.office.com/account/?ref=ClientMeControl	0%	URL Reputation	safe
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory	0%	URL Reputation	safe
https://edge.skype.com/registrar/prod	0%	URL Reputation	safe
https://graph.ppe.windows.net	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://tasks.office.com	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	0%	URL Reputation	safe
https://api.scheduler.	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://edge.skype.com/rps	0%	URL Reputation	safe
https://globaldisco.crm.dynamics.com	0%	URL Reputation	safe
https://messaging.engagement.office.com/	0%	URL Reputation	safe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.diagnosticssdf.office.com/v2/feedback	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/groups	0%	URL Reputation	safe
https://web.microsoftstream.com/video/	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://graph.windows.net	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://analysis.windows.net/powerbi/api	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://substrate.office.com	0%	URL Reputation	safe
https://outlook.office365.com/autodiscover/autodiscover.json	0%	URL Reputation	safe
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	0%	URL Reputation	safe
https://consent.config.office.com/consentcheckin/v1.0/consents	0%	URL Reputation	safe
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	0%	URL Reputation	safe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	0%	URL Reputation	safe
https://safelinks.protection.outlook.com/api/GetPolicy	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	0%	URL Reputation	safe
http://weather.service.msn.com/data.aspx	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://officepyservice.office.net/service.functionality	0%	URL Reputation	safe
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	0%	URL Reputation	safe
https://templatesmetadata.office.net/	0%	URL Reputation	safe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	0%	URL Reputation	safe
https://messaging.lifecycle.office.com/	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	0%	URL Reputation	safe
https://mss.office.com	0%	URL Reputation	safe
https://pushchannel.1drv.ms	0%	URL Reputation	safe
https://management.azure.com	0%	URL Reputation	safe
https://outlook.office365.com	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://incidents.diagnostics.office.com	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/ios	0%	URL Reputation	safe
https://make.powerautomate.com	0%	URL Reputation	safe
https://api.addins.omex.office.net/api/addins/search	0%	URL Reputation	safe
https://insertmedia.bing.office.net/odc/insertmedia	0%	URL Reputation	safe
https://outlook.office365.com/api/v1.0/me/Activities	0%	URL Reputation	safe
https://api.office.net	0%	URL Reputation	safe
https://incidents.diagnosticssdf.office.com	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/android/policies	0%	URL Reputation	safe
https://entitlement.diagnostics.office.com	0%	URL Reputation	safe
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	0%	URL Reputation	safe
https://substrate.office.com/search/api/v2/init	0%	URL Reputation	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		unknown
x1.i.lencr.org	unknown	unknown	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://shell.suite.office.com:1443	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://designerapp.azurewebsites.net	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://useraudit.o365auditrealtimeingestion.manage.office.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/connectors	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://cdn.entity.	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/tenantassociationkey	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://powerlift.acompli.net	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://cortana.ai	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://cloudfiles.onenote.com/upload.aspx	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://entitlement.diagnosticssdf.office.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com/	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://canary.designerapp.	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://ic3.teams.office.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://www.yammer.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://api.microsoftstream.com/api/	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false		unknown
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://cr.office.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false		unknown
https://messagebroker.mobile.m365.svc.cloud.microsoft	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://otelrules.svc.static.microsoft	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false		unknown
https://portal.office.com/account/?ref=ClientMeControl	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/registrar/prod	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://graph.ppe.windows.net	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://res.getmicrosoftkey.com/api/redemptionevents	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://officeci.azurewebsites.net/api/	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://api.scheduler.	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://my.microsoftpersonalcontent.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false		unknown
https://store.office.cn/addinstemplate	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/rps	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false		unknown
https://globaldisco.crm.dynamics.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://messaging.engagement.office.com/	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://dev0-api.acompli.net/autodetect	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://web.microsoftstream.com/video/	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://api.addins.store.officeppe.com/addinstemplate	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://dataservice.o365filtering.com/	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://prod-global-autodetect.acompli.net/autodetect	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://substrate.office.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://consent.config.office.com/consentcheckin/v1.0/consents	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://d.docs.live.net	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false		unknown
https://safelinks.protection.outlook.com/api/GetPolicy	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://ncus.contentsync.	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false		unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
http://weather.service.msn.com/data.aspx	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://apis.live.net/v5.0/	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://officepyservice.office.net/service.functionality	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://templatesmetadata.office.net/	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://messaging.lifecycle.office.com/	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://mss.office.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://pushchannel.1drv.ms	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://management.azure.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://wus2.contentsync.	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/ios	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://make.powerautomate.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/api/addins/search	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/odc/insertmedia	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/api/v1.0/me/Activities	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://api.office.net	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://incidents.diagnosticssdf.office.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://asgsmsproxyapi.azurewebsites.net/	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://entitlement.diagnostics.office.com	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown
https://substrate.office.com/search/api/v2/init	41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	false	URL Reputation: safe	unknown

Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.aadrm.com
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.aadrm.com/
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.cortana.ai
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.microsoftstream.com
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.office.net
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.onedrive.com
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 41F53B72-CEBD-4903-A429-55FC8FE17023.13.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528036
Start date and time:	2024-10-07 14:29:43 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Yttrande.pdf
Detection:	CLEAN
Classification:	clean4.winPDF@16/49@2/1
Cookbook Comments:	Found application associated with file extension: .pdf

Time	Type	Description
08:30:39	API Interceptor	3x Sleep call for process: AcroCEF.exe modified
08:30:59	API Interceptor	1x Sleep call for process: Acrobat.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.41.168.139	S4dd5N5VuJ.lnk	Get hash	malicious	Unknown	Browse
	[MALICIOUS]_Secured_Doc-[yBv-26104].pdf	Get hash	malicious	Unknown	Browse
	2FA Updating-2226-YZW.pdf	Get hash	malicious	Unknown	Browse
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
	Sales_Contract_Main_417053608_09.2024.pdf	Get hash	malicious	Unknown	Browse
	Sales_Contract_Main_417053608_09.2024.pdf	Get hash	malicious	Unknown	Browse
	140AEcuVy7.lnk	Get hash	malicious	LonePage	Browse
	XnQmVRj5g0.lnk	Get hash	malicious	LonePage	Browse
	Advisory23-UCDMS04-11-01.pdf.lnk	Get hash	malicious	Unknown	Browse
	Callus+1(814)-310-9943.pdf	Get hash	malicious	PayPal Phisher	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	http://twbcompany.com	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://emmaway-my.sharepoint.com/:f:/g/personal/jessica_emmaway_uk/Eodal0AmsKFKtMeEeNJG0V0B3d0_hcKMrsOYen-8p5FxhQ?e=bBSdNW	Get hash	malicious	Unknown	Browse	199.232.214.172
	5fe2eenspI.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://46.27.141.62	Get hash	malicious	Unknown	Browse	199.232.214.172
	SecuriteInfo.com.Win32.PWSX-gen.19312.293.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	REQUEST FOR QUOTE-INQUIRY#87278.SAMPLE AND PRODUCTS.exe	Get hash	malicious	AsyncRAT, StormKitty, VenomRAT	Browse	199.232.214.172
	https://sneamcomnnumnlty.com/h474823487284/geting/active	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://nextmytelstraaucurelinkisityou.web.app/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://pub-3432fdbad0cc4319a435ac6e41d4a0f1.r2.dev/scrpt.html	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	https://pub-7571f8ffd5b243f892961d4b09c69e36.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ZAYO-6461US	S4dd5N5VuJ.lnk	Get hash	malicious	Unknown	Browse	23.41.168.139
	[MALICIOUS]_Secured_Doc-[yBv-26104].pdf	Get hash	malicious	Unknown	Browse	23.41.168.139
	2FA Updating-2226-YZW.pdf	Get hash	malicious	Unknown	Browse	23.41.168.139
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse	23.41.168.139
	Sales_Contract_Main_417053608_09.2024.pdf	Get hash	malicious	Unknown	Browse	23.41.168.139
	Sales_Contract_Main_417053608_09.2024.pdf	Get hash	malicious	Unknown	Browse	23.41.168.139
	140AEcuVy7.lnk	Get hash	malicious	LonePage	Browse	23.41.168.139
	XnQmVRj5g0.lnk	Get hash	malicious	LonePage	Browse	23.41.168.139
	Advisory23-UCDMS04-11-01.pdf.lnk	Get hash	malicious	Unknown	Browse	23.41.168.139
	Callus+1(814)-310-9943.pdf	Get hash	malicious	PayPal Phisher	Browse	23.41.168.139

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.206162711758201
Encrypted:	false
SSDEEP:	6:fVUWq2PRN2nKuAl9OmbnIFUt8oJZmw+oDkwORN2nKuAl9OmbjLJ:fZvaHAahFUt8oJ/+oD5JHAaSJ
MD5:	8B5994F1C6E669DCDACA8E946F59EEEB
SHA1:	3EAFA3AA6ED8C5305BE4379FCA7F85626101ED67
SHA-256:	BA033A96894B434D7FB6005FE05EA38BE81830BD1CAD5A065637538E9BAB24F1
SHA-512:	3B64F0EA15AEF2B93A0E79A103DD6A589F0BF405269C653A6E375418F62BB234D7E3A2B2D2A3B2DD1A47F706E8B7806FD4663342D64A9DBA98A90D1B109E2301
Malicious:	false
Reputation:	low
Preview:	2024/10/07-08:30:10.962 1a54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/07-08:30:10.965 1a54 Recovering log #3.2024/10/07-08:30:10.965 1a54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	174570
Entropy (8bit):	5.290036032391311
Encrypted:	false
SSDEEP:	1536:7i2XPRAqIbz41gwErLe7HW8bM/hMdcAZl1p5ihs7gXXWEIJROdYvo:eHe7HW8bM/FXTZWo
MD5:	3C700BD34D90410D8B33D6C381C74A4F
SHA1:	11CC873266DD161575068D64B54A5CF9ABA8EB0B
SHA-256:	415F6CAB716E6138500D0690C9A6271930080933D8CA1AA366121EFA74F6AF2F
SHA-512:	7F028750FF5397E0BD4046D91E06F8F54A1015C6CA7A290A0C18AB0D0024E6B92F1823CF5A04393FFC6EB57C377A0F638B05934983EA11AE38948A1BE4BE0568
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-07T12:31:02">.. Build: 16.0.18124.40132-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

File type:	PDF document, version 1.7, 1 pages (zip deflate encoded)
Entropy (8bit):	7.982288218454279
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Yttrande.pdf
File size:	311'053 bytes
MD5:	97087a457449fa32f062fefa68e41ec2
SHA1:	a47d690ccf3dd4fe396a43484c9f80396f019728
SHA256:	f82e00f4790966afdc8f736def4ee118d42fc57da67a39d4c900ff9757913c7b
SHA512:	2fcec5f20fda7d0223292ef1eae42353cad1ea4c27c182e43f990b9bc6abbf13dce4f7c69c67f0f305ae4fd0062668800d350d329aba0f0ab6e6d8fe097dc2e0
SSDEEP:	6144:Ay5o0xtdmnvUm7ybSDna8dY/oBv4UxvCeMyZnPi:H5o0xtEvSbwCgN4UDMKK
TLSH:	43641264DA4A588DE055838D6765382C4B8C717630C835A97E2FC3871F90FBDEC6B993
File Content Preview:	%PDF-1.7.%......96 0 obj.<</Filter/FlateDecode/First 270/Length 481/N 36/Type/ObjStm>>stream..h...Qk.1.......J...!Om_BKp.V...#..:......[S..K.p....'........../......ZV...j...T..RX....y........@.F..T.`.@3$..-.. X$...t.....$...up..)<........s.y....i)0..SG.e.

General
Header:	%PDF-1.7
Total Entropy:	7.982288
Total Bytes:	311053
Stream Entropy:	7.996044
Stream Bytes:	300103
Entropy outside Streams:	4.940460
Bytes outside Streams:	10950
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	50
endobj	50
stream	22
endstream	22
xref	2
trailer	2
startxref	1
/Page	1
/Encrypt	0
/ObjStm	2
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Yttrande.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\00db9ccb-c756-4788-ae89-641bdcdedc16.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4deb24.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cd0b842e-f780-45a6-927e-c76c9f56dacf.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241007123014Z-160.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Windows Analysis Report
Yttrande.pdf

ID	DHASH	MD5
22	63a9c92b0b183c00	be9e290921deede5d16c22df2143753b
23	406460766d656360	c7ab782cb2390cb74b87cb9134880da2
24	00d0d0ec95d7c0da	12251e7b08a52556f2a6a7772351e438
25	e894b3716969b2dc	b7dd8b52e429e1f753858e4abb74ad9d
26	e896333369b3b2d8	540498412df0d748907335b253a06715

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 14:30:39.492741108 CEST	49711	443	192.168.2.16	23.41.168.139
Oct 7, 2024 14:30:39.492779016 CEST	443	49711	23.41.168.139	192.168.2.16
Oct 7, 2024 14:30:39.492871046 CEST	49711	443	192.168.2.16	23.41.168.139
Oct 7, 2024 14:30:39.493081093 CEST	49711	443	192.168.2.16	23.41.168.139
Oct 7, 2024 14:30:39.493091106 CEST	443	49711	23.41.168.139	192.168.2.16
Oct 7, 2024 14:30:40.103874922 CEST	443	49711	23.41.168.139	192.168.2.16
Oct 7, 2024 14:30:40.104217052 CEST	49711	443	192.168.2.16	23.41.168.139
Oct 7, 2024 14:30:40.104243040 CEST	443	49711	23.41.168.139	192.168.2.16
Oct 7, 2024 14:30:40.107785940 CEST	443	49711	23.41.168.139	192.168.2.16
Oct 7, 2024 14:30:40.107918024 CEST	49711	443	192.168.2.16	23.41.168.139
Oct 7, 2024 14:30:40.128932953 CEST	49711	443	192.168.2.16	23.41.168.139
Oct 7, 2024 14:30:40.129101992 CEST	49711	443	192.168.2.16	23.41.168.139
Oct 7, 2024 14:30:40.129123926 CEST	443	49711	23.41.168.139	192.168.2.16
Oct 7, 2024 14:30:40.179934978 CEST	49711	443	192.168.2.16	23.41.168.139
Oct 7, 2024 14:30:40.179940939 CEST	443	49711	23.41.168.139	192.168.2.16
Oct 7, 2024 14:30:40.227905989 CEST	49711	443	192.168.2.16	23.41.168.139
Oct 7, 2024 14:30:40.247700930 CEST	443	49711	23.41.168.139	192.168.2.16
Oct 7, 2024 14:30:40.247878075 CEST	443	49711	23.41.168.139	192.168.2.16
Oct 7, 2024 14:30:40.247937918 CEST	49711	443	192.168.2.16	23.41.168.139
Oct 7, 2024 14:30:40.248898029 CEST	49711	443	192.168.2.16	23.41.168.139
Oct 7, 2024 14:30:40.248914957 CEST	443	49711	23.41.168.139	192.168.2.16

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 14:30:39.121702909 CEST	53995	53	192.168.2.16	1.1.1.1
Oct 7, 2024 14:30:52.861748934 CEST	52027	53	192.168.2.16	1.1.1.1

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 14:30:18.136480093 CEST	1.1.1.1	192.168.2.16	0x17b1	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:30:18.136480093 CEST	1.1.1.1	192.168.2.16	0x17b1	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:30:39.129761934 CEST	1.1.1.1	192.168.2.16	0xf3c5	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 14:30:52.871085882 CEST	1.1.1.1	192.168.2.16	0xe	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-10-07 12:30:40 UTC	390	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br
2024-10-07 12:30:40 UTC	247	IN	HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Accept-Ranges: bytes Content-Length: 120 Content-Type: text/plain; charset=UTF-8 Date: Mon, 07 Oct 2024 12:30:40 GMT Connection: close
2024-10-07 12:30:40 UTC	120	IN	Data Raw: 46 69 6c 65 20 74 68 61 74 20 61 63 74 73 20 6c 69 6b 65 20 61 20 4b 69 6c 6c 20 73 77 69 74 63 68 20 66 6f 72 20 53 4d 53 20 66 75 6e 63 74 69 6f 6e 61 6c 69 74 79 20 69 6e 20 52 65 61 64 65 72 2e 20 44 65 6c 65 74 65 20 74 68 69 73 20 66 69 6c 65 20 74 6f 20 65 6e 61 62 6c 65 20 74 68 65 20 6b 69 6c 6c 20 73 77 69 74 63 68 20 69 6e 20 52 65 61 64 65 72 2e Data Ascii: File that acts like a Kill switch for SMS functionality in Reader. Delete this file to enable the kill switch in Reader.

Target ID:	0
Start time:	08:30:08
Start date:	07/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Yttrande.pdf"
Imagebase:	0x7ff78e6c0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	2
Start time:	08:30:09
Start date:	07/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff634ad0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	08:30:10
Start date:	07/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1592,i,8582882510026395687,116098319397815873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff634ad0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre