Edit tour

Windows Analysis Report
ReInvest Capital .pdf

Overview

General Information

Sample name:	ReInvest Capital .pdf
Analysis ID:	1432391
MD5:	fb82e75bc86557f800a9b6a6683cf6b1
SHA1:	936a5f0e4eae6e87e68f4eda75d51e3be8bbe526
SHA256:	8ae6974611a7ce7d03e22d5d6fc5e6840e1c19e4cfb8b7158ebb748e9ef389df
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found potential malicious PDF (bad image similarity)

Multi AV Scanner detection for submitted file

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Phishing site detected (based on OCR NLP Model)

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7128 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ReInvest Capital .pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2520 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5908 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1636,i,6048400525593136051,16366284519615366679,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8136 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://btweb.top" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6204 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1992,i,8589298334556741863,1996516174095378037,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ReInvest Capital .pdf

Avira: detected

Multi AV Scanner detection for submitted file

Source: ReInvest Capital .pdf

ReversingLabs: Detection: 41%

Source: Adobe Acrobat PDF

ML Model on OCR Text: Matched 80.3% probability on "OneDrive for Business A document has been sent to you with OneDrive, access the document by clicking the button below. Access Document OneDrive OneDrive for for Business "

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49737 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49738 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 23.47.168.24 23.47.168.24
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49737 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=o7Mc8GUSlbOUKpk&MD=xkXvzFLG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=o7Mc8GUSlbOUKpk&MD=xkXvzFLG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: btweb.top
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714170139007&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: ReInvest Capital .pdf	Static PDF information: Image stream: 10
Source: ReInvest Capital .pdf	Static PDF information: Image stream: 11
Source: ReInvest Capital .pdf	Static PDF information: Image stream: 16

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ReInvest Capital .pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1636,i,6048400525593136051,16366284519615366679,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://btweb.top"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1992,i,8589298334556741863,1996516174095378037,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1636,i,6048400525593136051,16366284519615366679,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1992,i,8589298334556741863,1996516174095378037,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: ReInvest Capital .pdf	Initial sample: PDF keyword /JS count = 0
Source: ReInvest Capital .pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91fh6ov0_a5jczy_13w.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91fh6ov0_a5jczy_13w.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
ReInvest Capital .pdf	42%	ReversingLabs	Document-PDF.Trojan.Heuristic
ReInvest Capital .pdf	100%	Avira	TR/AVI.PhishingX.rdoxl

Name	IP	Active	Malicious	Reputation
google.com	142.250.80.46	true	false	high
www.google.com	142.250.80.36	true	false	high
btweb.top	unknown	unknown	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.80.36	www.google.com	United States	15169	GOOGLEUS	false
23.47.168.24	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432391
Start date and time:	2024-04-27 00:21:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ReInvest Capital .pdf
Detection:	MAL
Classification:	mal64.winPDF@45/48@23/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.47.168.24	http://6.imimg.com/data6/Rfq/2024/3/404696953/HX/AW/IV/217882449/square-breathing-pdf.pdf	Get hash	malicious	Unknown	Browse
	phish_alert_iocp_v1.4.48 (23).eml	Get hash	malicious	HTMLPhisher	Browse
	https://app.nihaocloud.com/f/bf027d5695e84bac920c/	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_f29ce0d93859cca71356213c6e187a644debf0c9.zip	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://docvmentdrive.au1.cdn-alpha.com/wordplusnero/Payment.pdf	Get hash	malicious	Unknown	Browse
	qqeng.pdf.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	D21 .pdf.exe	Get hash	malicious	Unknown	Browse
	D21 .pdf.exe	Get hash	malicious	Unknown	Browse
	PURCHASE ORDER.xls	Get hash	malicious	Unknown	Browse
	J-JeremieKarg-78462.js	Get hash	malicious	Unknown	Browse
239.255.255.250	https://qdorbb80j410g85n.azureedge.net/010au/	Get hash	malicious	TechSupportScam	Browse
	https://wvijwiyjap-xn----90at1dc-xn----p1ai.translate.goog/hdiw/zqteil/efdfdqgb?ZEdOcFFIUmtZMm91ZEdWNFlYTXVaMjkyOml5YXBpdndiY20=+&_x_tr_sch=http&_x_tr_sl=dosderma&_x_tr_tl=bempjhrl	Get hash	malicious	Unknown	Browse
	https://worker-curly-silence-18d1.pistisarte.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://1st2844kxjperro04264.z31.web.core.windows.net/ErW0ind0SmW0Security04/index.html	Get hash	malicious	TechSupportScam	Browse
	https://3rdkxalxjperror10427.z31.web.core.windows.net/ErW0ind0SmW0Security04/index.html	Get hash	malicious	TechSupportScam	Browse
	https://palmettoanimalclinic.aweb.page/p/0ac693e3-6f85-4fd6-86d7-f770e6e73d32	Get hash	malicious	Unknown	Browse
	Lab5-3.exe	Get hash	malicious	Chaos, Conti, LockBit ransomware, TrojanRansom	Browse
	http://www.superiorbillingsolutions.com	Get hash	malicious	Unknown	Browse
	Document_a51_19i793302-14b09981a5569-3684u8.js	Get hash	malicious	Latrodectus	Browse
	https://rise.articulate.com/share/zO8B8EFq4bxdit8kVRcUzBOZMbkl1WSz#/lessons/2GyyR-D75sLlZcXDanN5dOaLxSSkgNvo	Get hash	malicious	HTMLPhisher	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	file.exe	Get hash	malicious	Vidar	Browse	23.194.234.100
	https://gjyefv.degaris.com/	Get hash	malicious	HTMLPhisher	Browse	23.193.106.20
	file.exe	Get hash	malicious	Unknown	Browse	23.50.112.29
	file.exe	Get hash	malicious	Unknown	Browse	23.50.112.28
	factura - ztcpyqiqtfiewxjhesna.msi	Get hash	malicious	Unknown	Browse	23.44.94.139
	file.exe	Get hash	malicious	Vidar	Browse	23.194.234.100
	RemotePCHost.exe	Get hash	malicious	Unknown	Browse	184.31.62.93
	https://autode.sk/4bb5BeV	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	23.214.187.157
	aios3.exe	Get hash	malicious	Unknown	Browse	184.31.60.185
	http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	Get hash	malicious	HTMLPhisher	Browse	23.59.235.214

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	360total.dll.dll	Get hash	malicious	Latrodectus	Browse	23.1.237.91
	MSG.docx	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.clktoro.com/feed/click/?t1=128&tid=859&uid=26&subid=remotescripps.org&id=62b00eca6d15ba41d06e054ec8234620:c5cc33c8f67a8e2157054b6a1a46513330d8d1b9ba254759e28d5e39682faf3a0c638282c2c64e9d5352d1ed667ebaaf8201abc8c47aea233add3225b515fb85693743b12c7509aae6fe6327275ef08dc3f481903563d1550be49405e93a390c41176fe292821b7d6098f34b28b9e7b3c1a327f168218dd37d959e1d8326a3dc7910042cd769fb91dfb171de393907f5870d1100482cb158754118b401727ac226cffc957846c78b0e9abcca8d32d5a6ad75dd1af64e7feee6f847ba1695ac8b9515c5fe28cc4005f0012c33f25f14967186986fa0130af2fc961a6ad412c9b4aa8c9bb8de73d1c785c14d432fe083fc1215c9564a8991d6fc9805ac127a42ffdfadf6dae0f2731324a242c43e3fceec3023a2155939fe1a27676e4a6a87cfc84b770a7bc9f80a549fd09cfb1ad645853bdfb1b7639d71e11035e1789b964e38c91352f7c5a319e5df29671022a79d04	Get hash	malicious	Unknown	Browse	23.1.237.91
	neo.msi	Get hash	malicious	Latrodectus	Browse	23.1.237.91
	https://unilever3.demdex.net/firstevent?d_event=click&d_bu=317196&c_medium=display&c_destination=Retailer&c_country=BD&c_campaignname=L-LifebuoyHandsanitizerLaunchComm&c_prodcat=CH1097&c_brandcode=BH0300&d_adgroup=All_KV&c_contenttype=display&c_source=Dhaka%20Tribune&d_rd=https://campaign-statistics.com/link_click/PidJvkyg2S_O4JTm/159dfdb0ade49a7c5597d3c1d9bd3d8a	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTAxOTIyLCJtZXNzYWdlX2lkIjoiMGd4d3poYXc3czloeGZoZWNuNjNuYnFwIzg0YjRlN2VjLTdhZjUtNDU5Yi1hNTYxLWE1ZmVlMTE3NTllNiIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjM3OTIyLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGphbWVzLmZheUBjb3VudHluYXRpb25hbGJhbmsuY29tJnBhdGhzPWFib3ZlJmxpbms9RmF4X091dGxvb2siLCJpbmRpdmlkdWFsX2lkIjoiNDA4YWI4OGRlY2JmNDFjMjRhYTZhMDRlOWU1OWMzZDAifQ.i-tkK1Lnys-MM487ot1MrSYQb6ExLgZNRQbgsH8B2K0	Get hash	malicious	Captcha Phish	Browse	23.1.237.91
	Settlement DOL 08262024 - Victoria Brignon - Reference #27224675-2722934.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	23.1.237.91
	https://runrun.it/share/form/0GZMCgHSxRh4PBOM	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	InmateExport.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	https://qdorbb80j410g85n.azureedge.net/010au/	Get hash	malicious	TechSupportScam	Browse	13.85.23.86 23.51.58.94
	https://wvijwiyjap-xn----90at1dc-xn----p1ai.translate.goog/hdiw/zqteil/efdfdqgb?ZEdOcFFIUmtZMm91ZEdWNFlYTXVaMjkyOml5YXBpdndiY20=+&_x_tr_sch=http&_x_tr_sl=dosderma&_x_tr_tl=bempjhrl	Get hash	malicious	Unknown	Browse	13.85.23.86 23.51.58.94
	https://worker-curly-silence-18d1.pistisarte.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 23.51.58.94
	https://1st2844kxjperro04264.z31.web.core.windows.net/ErW0ind0SmW0Security04/index.html	Get hash	malicious	TechSupportScam	Browse	13.85.23.86 23.51.58.94
	https://3rdkxalxjperror10427.z31.web.core.windows.net/ErW0ind0SmW0Security04/index.html	Get hash	malicious	TechSupportScam	Browse	13.85.23.86 23.51.58.94
	https://palmettoanimalclinic.aweb.page/p/0ac693e3-6f85-4fd6-86d7-f770e6e73d32	Get hash	malicious	Unknown	Browse	13.85.23.86 23.51.58.94
	Lab5-3.exe	Get hash	malicious	Chaos, Conti, LockBit ransomware, TrojanRansom	Browse	13.85.23.86 23.51.58.94
	http://www.superiorbillingsolutions.com	Get hash	malicious	Unknown	Browse	13.85.23.86 23.51.58.94
	Document_a51_19i793302-14b09981a5569-3684u8.js	Get hash	malicious	Latrodectus	Browse	13.85.23.86 23.51.58.94
	https://rise.articulate.com/share/zO8B8EFq4bxdit8kVRcUzBOZMbkl1WSz#/lessons/2GyyR-D75sLlZcXDanN5dOaLxSSkgNvo	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 23.51.58.94

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.149216021009419
Encrypted:	false
SSDEEP:	6:5Xap09+q2P92nKuAl9OmbnIFUt86XapN5BZmw+6XapN5VVkwO92nKuAl9OmbjLJ:5IS+v4HAahFUt86IN5B/+6IN5VV5LHAR
MD5:	6B0D5C93DB92EC2ABE316E95EB223E48
SHA1:	A693EDCC1B8A2EDACAEFBCF31186EA6EDDEDBBCC
SHA-256:	0CDA83C17637863FBD734B1C4C0353377DB69B4293CDE5E8520133AEB4C224D8
SHA-512:	05526E017AEFAF9E67F48C64F7E38AE2D20A902E9340570A638B77F8314067F532E14398DB5795E6C2D5B7891A3974284EBC3549F726468FFB1AC609D9C7DBA2
Malicious:	false
Reputation:	low
Preview:	2024/04/27-00:22:30.809 f7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/27-00:22:30.811 f7c Recovering log #3.2024/04/27-00:22:30.811 f7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 21:23:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9823094882817327
Encrypted:	false
SSDEEP:	48:8ZdzjTPTqfHuidAKZdA19ehwiZUklqehDy+3:8/j3qMMy
MD5:	A8419B7C4154CCB22E08BE038F064998
SHA1:	84DE1B1D10FC0964CC85C69B7C16A881EC60B8A9
SHA-256:	8EF0C3011036EFEE1F2C57065CB13667FA68BFF86784959A777BEEE608D90543
SHA-512:	57E2E6DB3ED929755312E45AFDC6A414FD43DE8509A885D41E6D30B115438C8986CE1035FF4AD3D15294544892556C10BFC96C23EBBDC9F42E3CDBCE1458582E
Malicious:	false
Preview:	L..................F.@.. ...$+.,......YL(...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	PDF document, version 1.7, 1 pages
Entropy (8bit):	7.956001669519529
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	ReInvest Capital .pdf
File size:	128'407 bytes
MD5:	fb82e75bc86557f800a9b6a6683cf6b1
SHA1:	936a5f0e4eae6e87e68f4eda75d51e3be8bbe526
SHA256:	8ae6974611a7ce7d03e22d5d6fc5e6840e1c19e4cfb8b7158ebb748e9ef389df
SHA512:	f6261b9f61fac350f409e194a704a207b9e638963a5dd4396e543ce1c1f386a8e3e954b90f4afe83e54b1401d0ad9ca656b31af062fa90cb896b7340faaf88da
SSDEEP:	3072:8Z585pIikLQ8jlil3DWQY2sDLJjYrcrt8ojcmj:8Z585peLQ8sl3y5fJjYrItjck
TLSH:	31C3021CC1E5BCDEE11126B79E0BB9AF673A3163A0C0805435FC23934B51AB52D57A6B
File Content Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 18 0 R/MarkInfo<</Marked true>>/Metadata 49 0 R/ViewerPreferences 50 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 1/Kids[ 3 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/R

General
Header:	%PDF-1.7
Total Entropy:	7.956002
Total Bytes:	128407
Stream Entropy:	7.970591
Stream Bytes:	123384
Entropy outside Streams:	5.259223
Bytes outside Streams:	5023
Number of EOF found:	2
Bytes after EOF:

Name	Count
obj	23
endobj	23
stream	10
endstream	10
xref	2
trailer	2
startxref	2
/Page	1
/Encrypt	0
/ObjStm	1
/URI	6
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ReInvest Capital .pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\62a7fbb7-19da-43f1-8cc7-7ff90d965ff8.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240426222235Z-173.bmp

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1436

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Windows Analysis Report
ReInvest Capital .pdf

ID	DHASH	MD5
10	c994948accc8cace	92f9ae82b1cc16d32c503fe11a6bb0db
11	c994948accc8cace	c042abf7c34e8133b1b8f2a5c07a8743
13	8023c86923370080	edc5164163bd5d574bafed1f89aadeee
14	8000000000000080	780a9bd91a9a3ec8085a0c4c490ad83e
16	d4919ccad5ddd4d2	1395dfa68087127d156010d691a7e1c2

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 27, 2024 00:22:29.358407021 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:22:29.358515978 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:22:29.467793941 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:22:38.970958948 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:22:38.970959902 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:22:39.080312967 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:22:40.534140110 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 27, 2024 00:22:40.534219027 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:22:41.606653929 CEST	49715	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:41.606688976 CEST	443	49715	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:41.606760025 CEST	49715	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:41.608175993 CEST	49715	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:41.608191013 CEST	443	49715	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:41.795476913 CEST	443	49715	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:41.795553923 CEST	49715	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:41.797617912 CEST	49715	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:41.797626972 CEST	443	49715	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:41.797869921 CEST	443	49715	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:41.832078934 CEST	49715	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:41.876116037 CEST	443	49715	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:42.084994078 CEST	443	49715	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:42.085068941 CEST	443	49715	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:42.085143089 CEST	49715	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:42.085261106 CEST	49715	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:42.085287094 CEST	443	49715	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:42.085305929 CEST	49715	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:42.085311890 CEST	443	49715	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:42.232526064 CEST	49716	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:42.232552052 CEST	443	49716	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:42.232639074 CEST	49716	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:42.233143091 CEST	49716	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:42.233154058 CEST	443	49716	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:42.419080973 CEST	443	49716	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:42.419161081 CEST	49716	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:42.420186996 CEST	49716	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:42.420192003 CEST	443	49716	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:42.420506954 CEST	443	49716	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:42.421521902 CEST	49716	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:42.468126059 CEST	443	49716	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:42.598140955 CEST	443	49716	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:42.598340988 CEST	443	49716	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:42.598445892 CEST	49716	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:42.598845005 CEST	49716	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:42.598855972 CEST	443	49716	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:42.598870039 CEST	49716	443	192.168.2.5	23.51.58.94
Apr 27, 2024 00:22:42.598875046 CEST	443	49716	23.51.58.94	192.168.2.5
Apr 27, 2024 00:22:43.742248058 CEST	49717	443	192.168.2.5	23.47.168.24
Apr 27, 2024 00:22:43.742290974 CEST	443	49717	23.47.168.24	192.168.2.5
Apr 27, 2024 00:22:43.742364883 CEST	49717	443	192.168.2.5	23.47.168.24
Apr 27, 2024 00:22:43.742521048 CEST	49717	443	192.168.2.5	23.47.168.24
Apr 27, 2024 00:22:43.742543936 CEST	443	49717	23.47.168.24	192.168.2.5
Apr 27, 2024 00:22:44.015667915 CEST	443	49717	23.47.168.24	192.168.2.5
Apr 27, 2024 00:22:44.015892029 CEST	49717	443	192.168.2.5	23.47.168.24
Apr 27, 2024 00:22:44.015918970 CEST	443	49717	23.47.168.24	192.168.2.5
Apr 27, 2024 00:22:44.017395020 CEST	443	49717	23.47.168.24	192.168.2.5
Apr 27, 2024 00:22:44.017455101 CEST	49717	443	192.168.2.5	23.47.168.24
Apr 27, 2024 00:22:44.019201994 CEST	49717	443	192.168.2.5	23.47.168.24
Apr 27, 2024 00:22:44.019284964 CEST	443	49717	23.47.168.24	192.168.2.5
Apr 27, 2024 00:22:44.019484997 CEST	49717	443	192.168.2.5	23.47.168.24
Apr 27, 2024 00:22:44.019494057 CEST	443	49717	23.47.168.24	192.168.2.5
Apr 27, 2024 00:22:44.070341110 CEST	49717	443	192.168.2.5	23.47.168.24
Apr 27, 2024 00:22:44.109832048 CEST	443	49717	23.47.168.24	192.168.2.5
Apr 27, 2024 00:22:44.110007048 CEST	443	49717	23.47.168.24	192.168.2.5
Apr 27, 2024 00:22:44.110078096 CEST	49717	443	192.168.2.5	23.47.168.24
Apr 27, 2024 00:22:44.110316992 CEST	49717	443	192.168.2.5	23.47.168.24
Apr 27, 2024 00:22:44.110335112 CEST	443	49717	23.47.168.24	192.168.2.5
Apr 27, 2024 00:22:44.110348940 CEST	49717	443	192.168.2.5	23.47.168.24
Apr 27, 2024 00:22:44.110527992 CEST	49717	443	192.168.2.5	23.47.168.24
Apr 27, 2024 00:22:49.419701099 CEST	49718	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:22:49.419790030 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:49.419893026 CEST	49718	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:22:49.420845985 CEST	49718	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:22:49.420861959 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:49.833317041 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:49.833409071 CEST	49718	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:22:49.836071968 CEST	49718	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:22:49.836093903 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:49.836510897 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:49.882817984 CEST	49718	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:22:50.201678038 CEST	49718	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:22:50.248125076 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:50.464545965 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:50.464608908 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:50.464629889 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:50.464670897 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:50.464687109 CEST	49718	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:22:50.464719057 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:50.464740038 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:50.464755058 CEST	49718	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:22:50.464766979 CEST	49718	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:22:50.464797974 CEST	49718	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:22:50.465003014 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:50.465075970 CEST	49718	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:22:50.465081930 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:50.465260029 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:50.465313911 CEST	49718	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:22:50.673194885 CEST	49718	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:22:50.673264980 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:22:50.673295021 CEST	49718	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:22:50.673310995 CEST	443	49718	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:03.967811108 CEST	49728	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:23:03.967840910 CEST	443	49728	142.250.80.36	192.168.2.5
Apr 27, 2024 00:23:03.967899084 CEST	49728	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:23:03.968319893 CEST	49728	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:23:03.968333006 CEST	443	49728	142.250.80.36	192.168.2.5
Apr 27, 2024 00:23:04.551054955 CEST	443	49728	142.250.80.36	192.168.2.5
Apr 27, 2024 00:23:04.551331997 CEST	49728	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:23:04.551362038 CEST	443	49728	142.250.80.36	192.168.2.5
Apr 27, 2024 00:23:04.553037882 CEST	443	49728	142.250.80.36	192.168.2.5
Apr 27, 2024 00:23:04.553114891 CEST	49728	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:23:04.554208994 CEST	49728	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:23:04.554290056 CEST	443	49728	142.250.80.36	192.168.2.5
Apr 27, 2024 00:23:04.603458881 CEST	49728	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:23:04.603485107 CEST	443	49728	142.250.80.36	192.168.2.5
Apr 27, 2024 00:23:04.650310040 CEST	49728	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:23:14.529325008 CEST	443	49728	142.250.80.36	192.168.2.5
Apr 27, 2024 00:23:14.529464960 CEST	443	49728	142.250.80.36	192.168.2.5
Apr 27, 2024 00:23:14.529542923 CEST	49728	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:23:14.591238976 CEST	49728	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:23:14.591259956 CEST	443	49728	142.250.80.36	192.168.2.5
Apr 27, 2024 00:23:20.147258997 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:23:20.147471905 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:23:20.147959948 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:23:20.148046970 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 27, 2024 00:23:20.148145914 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:23:20.149313927 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:23:20.149363041 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 27, 2024 00:23:20.302792072 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 27, 2024 00:23:20.302951097 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 27, 2024 00:23:20.526118994 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 27, 2024 00:23:20.526206970 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:23:20.558583975 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:23:20.558624983 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 27, 2024 00:23:20.559672117 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 27, 2024 00:23:20.559751034 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:23:20.560229063 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:23:20.560287952 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 27, 2024 00:23:20.560648918 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:23:20.560657978 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 27, 2024 00:23:20.945996046 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 27, 2024 00:23:20.946177959 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:23:20.946468115 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:23:20.946578026 CEST	443	49737	23.1.237.91	192.168.2.5
Apr 27, 2024 00:23:20.946651936 CEST	49737	443	192.168.2.5	23.1.237.91
Apr 27, 2024 00:23:28.030034065 CEST	49738	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:23:28.030086994 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.030184984 CEST	49738	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:23:28.030602932 CEST	49738	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:23:28.030621052 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.441028118 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.441148996 CEST	49738	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:23:28.442931890 CEST	49738	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:23:28.442944050 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.443340063 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.452245951 CEST	49738	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:23:28.500113010 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.827775002 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.827837944 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.827897072 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.828037024 CEST	49738	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:23:28.828037024 CEST	49738	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:23:28.828062057 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.828097105 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.828110933 CEST	49738	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:23:28.828140020 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.828171015 CEST	49738	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:23:28.828171968 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.828202009 CEST	49738	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:23:28.828207016 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.828250885 CEST	49738	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:23:28.828255892 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.828349113 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.828392029 CEST	49738	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:23:28.833219051 CEST	49738	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:23:28.833237886 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:23:28.833255053 CEST	49738	443	192.168.2.5	13.85.23.86
Apr 27, 2024 00:23:28.833261013 CEST	443	49738	13.85.23.86	192.168.2.5
Apr 27, 2024 00:24:02.434396982 CEST	49740	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:24:02.434479952 CEST	443	49740	142.250.80.36	192.168.2.5
Apr 27, 2024 00:24:02.434643030 CEST	49740	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:24:02.434990883 CEST	49740	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:24:02.435028076 CEST	443	49740	142.250.80.36	192.168.2.5
Apr 27, 2024 00:24:02.694947004 CEST	443	49740	142.250.80.36	192.168.2.5
Apr 27, 2024 00:24:02.695563078 CEST	49740	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:24:02.695621967 CEST	443	49740	142.250.80.36	192.168.2.5
Apr 27, 2024 00:24:02.695974112 CEST	443	49740	142.250.80.36	192.168.2.5
Apr 27, 2024 00:24:02.696388960 CEST	49740	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:24:02.696480036 CEST	443	49740	142.250.80.36	192.168.2.5
Apr 27, 2024 00:24:02.744582891 CEST	49740	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:24:12.705112934 CEST	443	49740	142.250.80.36	192.168.2.5
Apr 27, 2024 00:24:12.705185890 CEST	443	49740	142.250.80.36	192.168.2.5
Apr 27, 2024 00:24:12.705271006 CEST	49740	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:24:14.592149019 CEST	49740	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:24:14.592217922 CEST	443	49740	142.250.80.36	192.168.2.5
Apr 27, 2024 00:25:02.498070955 CEST	49742	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:25:02.498138905 CEST	443	49742	142.250.80.36	192.168.2.5
Apr 27, 2024 00:25:02.498362064 CEST	49742	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:25:02.499068022 CEST	49742	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:25:02.499102116 CEST	443	49742	142.250.80.36	192.168.2.5
Apr 27, 2024 00:25:02.763825893 CEST	443	49742	142.250.80.36	192.168.2.5
Apr 27, 2024 00:25:02.764543056 CEST	49742	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:25:02.764576912 CEST	443	49742	142.250.80.36	192.168.2.5
Apr 27, 2024 00:25:02.764940977 CEST	443	49742	142.250.80.36	192.168.2.5
Apr 27, 2024 00:25:02.765824080 CEST	49742	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:25:02.765904903 CEST	443	49742	142.250.80.36	192.168.2.5
Apr 27, 2024 00:25:02.806984901 CEST	49742	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:25:12.767656088 CEST	443	49742	142.250.80.36	192.168.2.5
Apr 27, 2024 00:25:12.767812014 CEST	443	49742	142.250.80.36	192.168.2.5
Apr 27, 2024 00:25:12.767884016 CEST	49742	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:25:14.355036974 CEST	49742	443	192.168.2.5	142.250.80.36
Apr 27, 2024 00:25:14.355062962 CEST	443	49742	142.250.80.36	192.168.2.5

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 27, 2024 00:23:00.120579004 CEST	53	50427	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:00.234497070 CEST	52478	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:00.234641075 CEST	53957	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:00.322910070 CEST	53	61971	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:00.324565887 CEST	53	53957	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:00.325809002 CEST	53	52478	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:00.326494932 CEST	56239	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:00.417361975 CEST	53	56239	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:00.472013950 CEST	63013	53	192.168.2.5	8.8.8.8
Apr 27, 2024 00:23:00.472440958 CEST	63001	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:00.560609102 CEST	53	63001	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:00.571613073 CEST	53	63013	8.8.8.8	192.168.2.5
Apr 27, 2024 00:23:01.025789022 CEST	53	53221	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:01.486215115 CEST	59621	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:01.486963034 CEST	63590	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:01.577368975 CEST	53	59621	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:01.579629898 CEST	53	63590	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:03.861740112 CEST	51079	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:03.862185001 CEST	60719	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:03.951802015 CEST	53	51079	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:03.952521086 CEST	53	60719	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:04.420332909 CEST	53	63600	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:06.597225904 CEST	62638	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:06.597465038 CEST	53605	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:06.686712027 CEST	53	62638	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:06.686956882 CEST	53	53605	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:06.688550949 CEST	58051	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:06.780628920 CEST	53	58051	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:18.072659969 CEST	53	58202	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:33.058851957 CEST	54757	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:33.230986118 CEST	53	54757	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:36.804850101 CEST	50841	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:36.805067062 CEST	62490	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:36.855567932 CEST	53	52654	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:36.899630070 CEST	53	62490	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:37.134198904 CEST	53	50841	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:37.135410070 CEST	54849	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:37.305118084 CEST	53	54849	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:53.464845896 CEST	56653	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:23:53.558691025 CEST	53	56653	1.1.1.1	192.168.2.5
Apr 27, 2024 00:23:59.327374935 CEST	53	54405	1.1.1.1	192.168.2.5
Apr 27, 2024 00:24:01.165611029 CEST	53	52969	1.1.1.1	192.168.2.5
Apr 27, 2024 00:24:11.996272087 CEST	59363	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:24:12.087721109 CEST	53	59363	1.1.1.1	192.168.2.5
Apr 27, 2024 00:24:27.930052996 CEST	53	56902	1.1.1.1	192.168.2.5
Apr 27, 2024 00:24:37.358407021 CEST	60481	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:24:37.358613968 CEST	63710	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:24:37.451714039 CEST	53	60481	1.1.1.1	192.168.2.5
Apr 27, 2024 00:24:37.453264952 CEST	53	63710	1.1.1.1	192.168.2.5
Apr 27, 2024 00:24:37.454189062 CEST	57078	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:24:37.545886993 CEST	53	57078	1.1.1.1	192.168.2.5
Apr 27, 2024 00:25:14.446913004 CEST	53	63531	1.1.1.1	192.168.2.5
Apr 27, 2024 00:25:29.402000904 CEST	64524	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:25:29.494379997 CEST	53	64524	1.1.1.1	192.168.2.5
Apr 27, 2024 00:25:53.981163979 CEST	51417	53	192.168.2.5	1.1.1.1
Apr 27, 2024 00:25:54.076594114 CEST	53	51417	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:22:41 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 22:22:42 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=31274 Date: Fri, 26 Apr 2024 22:22:41 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:22:42 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 22:22:42 UTC	455	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0778) X-CID: 11 Cache-Control: public, max-age=31209 Date: Fri, 26 Apr 2024 22:22:42 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 22:22:42 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:22:44 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-04-26 22:22:44 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Fri, 26 Apr 2024 22:22:44 GMT Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:22:50 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=o7Mc8GUSlbOUKpk&MD=xkXvzFLG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 22:22:50 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b503b24d-1113-45c5-b13f-5f5570caa75e MS-RequestId: cd707e73-470c-46cb-8c7e-aa91fe36bebb MS-CV: xdQ+GrBE/Eu45Lzi.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 22:22:50 GMT Connection: close Content-Length: 24490
2024-04-26 22:22:50 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-26 22:22:50 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:23:20 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714170139007&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-04-26 22:23:20 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-04-26 22:23:20 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-04-26 22:23:20 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 87C244A4A6FC4B63821305F66E650792 Ref B: LAX311000115017 Ref C: 2024-04-26T22:23:20Z Date: Fri, 26 Apr 2024 22:23:20 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1714170200.13e00159

Timestamp	Bytes transferred	Direction	Data
2024-04-26 22:23:28 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=o7Mc8GUSlbOUKpk&MD=xkXvzFLG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 22:23:28 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 349e8dfd-9d79-4724-8c3e-78ce9b33ee5f MS-RequestId: bb999244-4c77-4c6e-994e-f3dc5cc6b717 MS-CV: 3cHLKm+68EWlTvFu.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 22:23:28 GMT Connection: close Content-Length: 25457
2024-04-26 22:23:28 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-26 22:23:28 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	00:22:29
Start date:	27/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ReInvest Capital .pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true