Loading... Additional Content is being loaded

Windows Analysis Report
Liftone ..pdf

Overview

General Information

Sample name:	Liftone ..pdf
Analysis ID:	1428249
MD5:	6cadac337776aba6aa6946d42f92a840
SHA1:	b8751f2c08df20b3294752afa5d7cc00a7812e55
SHA256:	8e62130c954dedb2e0ce62e3a007384ffa8101bb2d9144d955dde46488743c89
Infos:

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Misleading page title found

Yara detected HtmlPhish10

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

Invalid T&C link found

Phishing site detected (based on OCR NLP Model)

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

Misleading page title found

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/	Page Title: Microsoft \| Login
Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/	Page Title: Microsoft \| Login

Yara detected HtmlPhish10

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_189, type: DROPPED

HTML body contains low number of good links

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML title does not match URL

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: Title: Microsoft | Login does not match URL

Invalid T&C link found

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: Invalid link: Privacy statement

Phishing site detected (based on OCR NLP Model)

Source: Adobe Acrobat PDF

ML Model on OCR Text: Matched 99.5% probability on "Adobe PDF Document is enclosed with Adobe Pdf for Business MAT:2378 // INVOICE // YOUR REF:3210 // RAF Click Here For View Microsoft Adobe Pdf Microsoft respects your privacy. to learn more, please read our privacy statement Microsoft Corporation "

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: <input type="password" .../> found

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: No favicon

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: No <meta name="author".. found

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49749 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 28MB

Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250

Source: unknown

DNS traffic detected: queries for: code.jquery.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown

HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49749 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.winPDF@31/58@16/188

Source: Liftone ..pdf

Initial sample: https://roads.dentistsinchattanoogatennessee.com/signedbox/

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\1d8ad159-a7f1-4439-9e42-2297e6a0448b

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File created: C:\Users\user\AppData\Local\Temp\acrocef_low\ef81e8be-a043-4932-9f59-3b5cd8e6d19a.tmp

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Liftone ..pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1544,i,1241296826629441675,870163600650370802,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1544,i,1241296826629441675,870163600650370802,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding C8984F0D7C7DD55BD636CEF6738EF8EB
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://roads.dentistsinchattanoogatennessee.com/signedbox/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=1912,i,329899899613058535,11907109387911769218,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://roads.dentistsinchattanoogatennessee.com/signedbox/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=1912,i,329899899613058535,11907109387911769218,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Liftone ..pdf	Initial sample: PDF keyword /JS count = 0
Source: Liftone ..pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Liftone ..pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.47.193	unknown	United States		13335	CLOUDFLARENETUS	false
162.159.61.3	unknown	United States		13335	CLOUDFLARENETUS	false
13.107.213.41	part-0013.t-0009.t-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.9.95	unknown	United States		15169	GOOGLEUS	false
172.67.167.250	unknown	United States		13335	CLOUDFLARENETUS	false
64.233.185.84	unknown	United States		15169	GOOGLEUS	false
142.251.15.95	unknown	United States		15169	GOOGLEUS	false
142.250.9.94	unknown	United States		15169	GOOGLEUS	false
151.101.194.137	code.jquery.com	United States		54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States		15169	GOOGLEUS	false
23.36.68.10	unknown	United States		16625	AKAMAI-ASUS	false
107.22.247.231	unknown	United States		14618	AMAZON-AESUS	false
184.25.164.138	unknown	United States		9498	BBIL-APBHARTIAirtelLtdIN	false
104.17.24.14	cdnjs.cloudflare.com	United States		13335	CLOUDFLARENETUS	false
172.217.215.113	unknown	United States		15169	GOOGLEUS	false
172.253.124.99	www.google.com	United States		15169	GOOGLEUS	false
142.250.105.94	unknown	United States		15169	GOOGLEUS	false
142.250.105.95	unknown	United States		15169	GOOGLEUS	false
13.107.246.70	part-0042.t-0009.t-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.11.207	maxcdn.bootstrapcdn.com	United States		13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false
104.21.27.152	unknown	United States		13335	CLOUDFLARENETUS	false
172.67.172.36	dashboard.spamfather.com	United States		13335	CLOUDFLARENETUS	false
104.21.74.57	unknown	United States		13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
part-0013.t-0009.t-msedge.net	13.107.213.41	true
a.nel.cloudflare.com	35.190.80.1	true
dashboard.spamfather.com	172.67.172.36	true
code.jquery.com	151.101.194.137	true
cdnjs.cloudflare.com	104.17.24.14	true
maxcdn.bootstrapcdn.com	104.18.11.207	true
www.google.com	172.253.124.99	true
part-0042.t-0009.t-msedge.net	13.107.246.70	true
use.fontawesome.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://roads.dentistsinchattanoogatennessee.com/signedbox/	true		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	4783FFEB2A7AE4F552636D25CF47F394	EDCF2560C389C9BDC3AD26CCDD2879FC5D8090A5	16E5C3337FFC70AEFBE04A7429B5B67F49F0F2B92ADD8EB23811E49AFB634B05
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	7D90EC8A88B860836F28845CA7EC13BA	76548DD0529502B8A3EABA725BE2249C3D98DE7A	BD790418593513A5CA46651EC61C956B905B4F7C9368CB05151824888309C73E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3fcf2670-2d7a-48f8-b35e-7e53356ee444.tmp	JSON data	99F60F872E7776ED390D9BF72A92917A	D25E06FB8CD7B6CB9F6643FAF6652AA62F10E182	F2EB62F245701C0D5687B27D30A5ECB21762DC67A2DA2AECDE6509227BF2EF69
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\81981eb1-134a-47a6-b15d-e3656fd94179.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF47b721.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	8056F0411F9BC2D9EAA324BA4D2E7087	7F4765EFDC5A8D8117CB03A4E4A929FC9B858E5A	0B79B7310C9AFAC6D88BA4F260565C5D08F881E96C69DF1BDA8FAC369E4544DB
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	4357F2779AC08B3F9FA552144E8E69D4	A739A1928F4747A798512CA2189072963CA3FB3C	7D3C3C07A96B0C24314295E560A734075B29D22C5DDC91E5300DDDF621CEBF4E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240418161708Z-163.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	3B56FF93BBF148C3CA52F9B26F9B866F	23E85C5D21B3C28BF999359954E2D294C87EF981	DE3A12FA87B4204A1725D81065804E1C425CF28A143FE3AC67432B53C9B172E0
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	E49864340E53046178278D607E80E7F6	3BAA19F1B0D2A3C88F223DD4B1E05CD60C03EBDD	E7E41E59E2BE900445D884597B82915C41A8981AEAF6B91C65CBB0E799FAD699
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6732	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	4FDD9B2CC6805110E51FABE4628133C0	C933C1672D532055649C22A321CEAF97EACB819E	C4E817FC67C8862FB4712D4CBDE40D0CD72B6C87244C82CCAB78BE50526E195B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	083E2ADB9BE6623D8D165D02F2B9E924	C6D261D4F745883132D875BA76CFEB5E60DD1726	400865BA260162495B7C87D5D8D0B31885D2B1E519FE0E855788D6DFAEBBD1F8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	F5D3A40B46BDB2ED44CF5F80C2DD8834	4AE2497249FAC265E313F25D0762515F4C206211	062D2B97987ECC2763CFC4078875CB3E3A502E2EB0863C61FBF0A0935BBBB149
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	54C0FCA89732624971E339D1B25B7370	C604ECB3635E18DDE897DA59E4B1968DD5255BE8	32077FDD64400FADCD48A87A19127DED484A686C4EC77D8F8D174B2646791757
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	BA6A53D334D5873F6EC7EA1D0DFCD821	CD003D2842F050BE3D6092321F27F79919888B1A	A5A7FDC01B8DDDD93B10033976AABC12194E3F83764AC9693501762FF05334F3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	25830B912E8CC9DEF8CD5F43119BC6FE	855B1C1179F159A8920B2FBD0B1B471400D79F0C	1A9FDD3E617D0B1B3C9B229146D3644DC727C19085169941C7BA5B9B6F5B23D3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	50C11E38F2597C92B9C9F50457C5A694	139B0A29E0B25864CF39E6D2A80F74C88C976014	A3636A783F356E62354A37E5FBDC54C5AA8CC3AA6ACD6722908D81EF7597971F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	ED0262883E52B01BFDB570369227F425	4C272D1C09757171D703823BC9C9D1BA3D0F146A	150FE0B9A1F748A302EDB93BAF70460FAF214C08B7D69FD06F19D9F0F8EFAD50
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	CE2C94A688C2BAB25B39905D0B259DAD	7F97DE18ACCB6091AFC6B0B0397F4C95C82088E7	83C6A8308002FB77AA886270660F976D386BD582C33DDF6F609CBBA2257408CF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	4053F03E968E801E365014682D1D77A8	01AEBE22D9C1D30983F21665BC18DA0BC623AA8D	D153CC0F39B3AF32E2936F8E9EEAD62C0C92B3E2B96EEF18152EACC4142E9E2F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	683887C9B0987E8F78EE87D497A35DC1	17DF5867F59D581CE909D0BDE0CF9D8503A40CA0	C210B194B1CE6BB8DCB48B810D8D6351E62772D05FDC1A299D2FFE02FB594CE6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	1A61EE420518C37D45B56348795EA4F0	0BD536B19B9897AEA0F7E8CAB57A84E89B5C615F	614C09CB1587A26C9F9306C5CDFFCEA27299B91610E5D09E4A85681FBFAF29F2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	00A401F9A3169071D7CA6A730C6F93A6	DB49B4547006C79EBC477853B47B5F7AC088FFDE	866E19D759ADB0977FBBE1CCE99D4F43D69260DEA233FFDEAF33A779C029E429
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	4335BCD2A955713517377A4CEBEB79C7	C332C6C7977B01056C201DA827022E4B68338CD6	28783425E759DA825D067294BF3689D167E4714C84132ACE1D152C6A932528CB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	770239EC1B1BF88F0341DFD4D1719109	C6350F49646682A3261B520834D66298D970ADDF	D4A78C0367873E2156CB0A460DBC9335E02571FA0BE9F478671EEDB920D92B52
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	29F8DC1A80EA906F2126337B5388C0C4	BFD4F71B5FF2BCF64D9EC76161561D0B257D494C	4C5A30FC68F249C3DBDFBA7961DE7F3BA96D253CCE085D12BE448BD1B41A16CE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	3F804B89896876FA17D4E77D4C55B312	0A6F9B2074184B594F12C3C98654D7E3A58C6845	D5E139508D620B22128C41B8953AAAC9038C884F94DDFD92119BD41EA78E387C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	98506EF0AAA61A5BD2E4361AA4C1D638	59AC132E021E3D312DF5B1570A712AE7746FE95B	C2B27DAC1B481FD5A023E00B02F5287D5A1966B1140FE7C7642E94D50E6DE241
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	D1716501B88A868247D63EF41E4DFFC2	53EE98F9D6EF85BE8D1B65D9F89D03F3E6D0427E	F3DCFF755A02CEABD7CBE3FA13EEFE6B58EDCF2D0F937995F02192127651D22C
C:\Users\user\AppData\Local\Temp\MSI6aaa3.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	05240A60EF483E381FBEB9B20B0B3C77	CF7B417ED93320E4F1C620CF72640A3B7687BE07	78CC8541FEA2E18A0A4611BF0EE3DB28A7DD95D6898E446FF5A078DD5D0A59AA
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-18 18-17-06-581.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	E28E9031ED06B9B669D0247143BA8477	75823ED7E01EA583E44AD1EE0064FAD97F5A126E	7CA3A539D4E5AC25A76373794AD02D7B4393314A2AE222CE5C2F14AEBFF04425
C:\Users\user\AppData\Local\Temp\acrocef_low\72924dba-dc29-4722-b4a6-355abeaea7ea.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\782fb5c9-ad23-4488-8dd4-0dc9d49c7e3e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\7e7aab82-895f-4863-8137-87e76f94ef80.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	22B260CB8C51C0D68C6550E4B061E25A	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
C:\Users\user\AppData\Local\Temp\acrocef_low\ef81e8be-a043-4932-9f59-3b5cd8e6d19a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	F4058A9619A8A6E9B90852CDC593A3A5	97C7CD56D5DA56FC9AB8AA04EB5704178B017310	237014787D4547E2418AF2D490AD45AFBF7893AAE2F655AA6ABB91CA21EF11F6
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 15:17:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A380A51696500E65686DD91A7AF04C73	6BDD7366E21F95440A84D482123317610D1D1AC3	C67CFC328391F6891650027AADE366ED9B04CE80F2809A96367AAA91EC60AC28
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 15:17:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E9224C1C3BB0FE9D9212EA7DE68311BF	C069834A2CAB2AB31430FA88EEE16BB5C8934D51	E91EF5055B3C811183024F3E678C2E5CF2B578BB531668A7914F3100E36EFE5E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C8F604F52B70F674154664BA099092AA	E457E3D213BA4E4DBB28F13B0ED7461D40F40D20	1B5EBD02BFB5B5E029DEAFE56440EDA45D4B62B413104421725B1AF5AA37E5AC
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 15:17:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	7D958A884753B0E9C362625B2FB7A8D7	31C4C1CFA091018721CE5B5B305A8605BF445261	CF0683E57E3E56421473715026C1DA073E8A2D5191D51D9F1D0347F65338DC9E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 15:17:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	83DBEE9918E2B151CBBC9AB4B3A11F4C	8C57BCE7F51E91A0913286EF6542BFA55C4A0A96	85253BFF29CA796DE0DBFC5BE151F93D1331DC5C49A023E29ED0DCD2E790D242
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 15:17:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	EF3E42496B774974D63995EBB5ED9BA1	171FC410157BF646CFED4A77F22E68C3D15585B1	7377908BEF0A47DB3CB5CCE98539B3CA5981099894F4FA08E41B906568DDE804
Chrome Cache Entry: 177	HTML document, ASCII text	A34AC19F4AFAE63ADC5D2F7BC970C07F	A82190FC530C265AA40A045C21770D967F4767B8	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
Chrome Cache Entry: 178	ASCII text, with very long lines (32065)	2F6B11A7E914718E0290410E85366FE9	69BB69E25CA7D5EF0935317584E6153F3FD9A88C	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
Chrome Cache Entry: 179	HTML document, ASCII text, with very long lines (1238)	9E8F56E8E1806253BA01A95CFC3D392C	A8AF90D7482E1E99D03DE6BF88FED2315C5DD728	2595496FE48DF6FCF9B1BC57C29A744C121EB4DD11566466BC13D2E52E6BBCC8
Chrome Cache Entry: 180	ASCII text, with very long lines (19015)	70D3FDA195602FE8B75E0097EED74DDE	C3B977AA4B8DFB69D651E07015031D385DED964B	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
Chrome Cache Entry: 181	JPEG image data, baseline, precision 8, 1920x1080, components 3	7916A894EBDE7D29C2CC29B267F1299F	78345CA08F9E2C3C2CC9B318950791B349211296	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
Chrome Cache Entry: 182	ASCII text, with no line terminators	EB3CE3190D8A58E048D35E620747D3A5	76B5B6461189F839B018EF5C785DB4836B818B7D	2D670E2962D8D805B95912CACA0822CE7C6913636BA40373C6E6AEA73CAC8457
Chrome Cache Entry: 183	ASCII text	CBA4ED6C809962AC6C2A26842183B67A	3F8E077AFC8EF5BAB7FA626EA782DAE34D419BBE	AAE65C231008861C6430EBE296C926E728C4D2CCB1492F86E42D760E9B67D9A5
Chrome Cache Entry: 184	ASCII text, with very long lines (48664)	14D449EB8876FA55E1EF3C2CC52B0C17	A9545831803B1359CFEED47E3B4D6BAE68E40E99	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
Chrome Cache Entry: 185	JSON data	C73BFB3D2FEBE6A8B37A1B76D39B164D	71037FA792E298C52F77870A3214775DC8D67834	FA6B47916793235789A40DF7E5ABB3F219BE7C3BE0C88B41E915A302E86B7BFE
Chrome Cache Entry: 186	ASCII text, with very long lines (54456)	251D28BD755F5269A4531DF8A81D5664	C0F035B41B23C6E8FAB735F618AA3CFF0897B4F9	AFDC6BF2DE981FFD7D370B76F44E7580572F197EFBE214B9CFA4005D189D8EAE
Chrome Cache Entry: 188	ASCII text	6A07DA9FAE934BAF3F749E876BBFDD96	46A436EBA01C79ACDB225757ED80BF54BAD6416B	D8AA24ECC6CECB1A60515BC093F1C9DA38A0392612D9AB8AE0F7F36E6EEE1FAD
Chrome Cache Entry: 189	HTML document, Unicode text, UTF-8 text, with very long lines (44749), with CRLF line terminators	E5B092EBE9C62DDA644B20CFADAAD465	6536141EC59052BABF125B92163F29D2A76A2DFD	04FF1AA0D349B007653F0BF27D4E707000E6D6D8D17AF49FA062A5DB1663F71C
Chrome Cache Entry: 190	ASCII text, with very long lines (32012)	5F48FC77CAC90C4778FA24EC9C57F37D	9E89D1515BC4C371B86F4CB1002FD8E377C1829F	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
Chrome Cache Entry: 191	ASCII text, with very long lines (32030)	E071ABDA8FE61194711CFC2AB99FE104	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
Chrome Cache Entry: 192	ASCII text, with very long lines (65325)	450FC463B8B1A349DF717056FBB3E078	895125A4522A3B10EE7ADA06EE6503587CBF95C5	2C0F3DCFE93D7E380C290FE4AB838ED8CADFF1596D62697F5444BE460D1F876D

Phishing

Misleading page title found

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/	Page Title: Microsoft \| Login
Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/	Page Title: Microsoft \| Login

Yara detected HtmlPhish10

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_189, type: DROPPED

HTML body contains low number of good links

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML title does not match URL

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: Title: Microsoft | Login does not match URL

Invalid T&C link found

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: Invalid link: Privacy statement

Phishing site detected (based on OCR NLP Model)

Source: Adobe Acrobat PDF

ML Model on OCR Text: Matched 99.5% probability on "Adobe PDF Document is enclosed with Adobe Pdf for Business MAT:2378 // INVOICE // YOUR REF:3210 // RAF Click Here For View Microsoft Adobe Pdf Microsoft respects your privacy. to learn more, please read our privacy statement Microsoft Corporation "

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: <input type="password" .../> found

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: No favicon

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: No <meta name="author".. found

Source: https://roads.dentistsinchattanoogatennessee.com/signedbox/

HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49749 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 28MB

Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.25.164.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.167.250

Source: unknown

DNS traffic detected: queries for: code.jquery.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown

HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49749 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.winPDF@31/58@16/188

Source: Liftone ..pdf

Initial sample: https://roads.dentistsinchattanoogatennessee.com/signedbox/

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\1d8ad159-a7f1-4439-9e42-2297e6a0448b

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File created: C:\Users\user\AppData\Local\Temp\acrocef_low\ef81e8be-a043-4932-9f59-3b5cd8e6d19a.tmp

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Liftone ..pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1544,i,1241296826629441675,870163600650370802,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1544,i,1241296826629441675,870163600650370802,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding C8984F0D7C7DD55BD636CEF6738EF8EB
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://roads.dentistsinchattanoogatennessee.com/signedbox/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=1912,i,329899899613058535,11907109387911769218,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://roads.dentistsinchattanoogatennessee.com/signedbox/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=1912,i,329899899613058535,11907109387911769218,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Liftone ..pdf	Initial sample: PDF keyword /JS count = 0
Source: Liftone ..pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Liftone ..pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation