Edit tour

Windows Analysis Report
http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf

Overview

General Information

Sample URL:	http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf
Analysis ID:	1435387
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found potential malicious PDF (bad image similarity)

Drops files with a non-matching file extension (content does not match file extension)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6756 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5592 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2032,i,7147495927222513840,11287494638090544190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

Acrobat.exe (PID: 3924 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1632 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6784 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1584,i,4356616070282891647,6035698287288815363,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: keep-aliveContent-Length: 146Content-Type: text/htmlStrict-Transport-Security: max-age=15724800; includeSubDomainsVia: 1.1 varnish, 1.1 varnishAccess-Control-Allow-Origin: *Accept-Ranges: bytesDate: Thu, 02 May 2024 14:12:52 GMTAge: 2090X-Served-By: cache-fra-eddf8230094-FRA, cache-lga21962-LGAX-Cache: HIT, HITX-Cache-Hits: 107, 1X-Timer: S1714659172.202691,VS0,VE2Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: downloaded.pdf.crdownload.0.dr, chromecache_158.2.dr

String found in binary or memory: https://nabot.yftejum.com/9565112701457389466222?fopulenabatovadalatoludupozalabogufanexebopegopamuj

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown	HTTPS traffic detected: 23.41.168.93:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.41.168.93:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:49725 version: TLS 1.2

System Summary

Found potential malicious PDF (bad image similarity)

Source: downloaded.pdf.crdownload.0.dr	Static PDF information: Image stream: 7
Source: chromecache_158.2.dr	Static PDF information: Image stream: 7

Source: classification engine

Classification label: mal56.win@35/48@6/8

Source: chromecache_158.2.dr

Initial sample: https://nabot.yftejum.com/9565112701457389466222?fopulenabatovadalatoludupozalabogufanexebopegopamujenavufusefiwovawugekezuzuwubobogegoro=desoxefebovizoluregedolamoliwebererixitebaxivonesajevigekavumupirigaliwalegetokutivemapinozezobefedovefojojagusabumawukifudoxikufaletiviwinujovugodolozupanilalavegabavozusunaritiferibajefakoninavojugedevedifa&keyword=cbt+downward+arrow+worksheet&wupetobigojaritomozupunixezejuwokapezotomigexudugefuraza=xezajajajiwasozeserusuworanebosutamototevafebuwusubipizedibimedekabotudivatawexenokezuxujagipalunegaketizoganoxewivujov

Source: http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.41.168.93
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=UVgewHzVZFt3UPh&MD=6OvxsGTB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=UVgewHzVZFt3UPh&MD=6OvxsGTB HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: 89d789c4-e7e5-4f75-95a4-57139ab6811fx-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf HTTP/1.1Host: jimdo-storage.global.ssl.fastly.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: jimdo-storage.global.ssl.fastly.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdfAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf HTTP/1.1Host: jimdo-storage.global.ssl.fastly.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: jimdo-storage.global.ssl.fastly.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2032,i,7147495927222513840,11287494638090544190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf"
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1584,i,4356616070282891647,6035698287288815363,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2032,i,7147495927222513840,11287494638090544190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1584,i,4356616070282891647,6035698287288815363,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 158
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 158			Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Link
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
chrome.cloudflare-dns.com	0%	Virustotal	Browse
jimdo-storage.global.ssl.fastly.net	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://nabot.yftejum.com/9565112701457389466222?fopulenabatovadalatoludupozalabogufanexebopegopamuj	0%	Avira URL Cloud	safe
file:///C:/Users/user/Downloads/downloaded.pdf	0%	Avira URL Cloud	safe
http://jimdo-storage.global.ssl.fastly.net/favicon.ico	0%	Avira URL Cloud	safe
http://jimdo-storage.global.ssl.fastly.net/favicon.ico	1%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
jimdo-storage.global.ssl.fastly.net	151.101.1.194	true	false	0%, Virustotal, Browse	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.81.228	true	false		high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown

Name	Malicious	Antivirus Detection	Reputation
http://jimdo-storage.global.ssl.fastly.net/favicon.ico	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf	false		unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe URL Reputation: safe	unknown
file:///C:/Users/user/Downloads/downloaded.pdf	false	Avira URL Cloud: safe	low

IP	Domain	Country	ASN	ASN Name	Malicious
54.227.187.23	unknown	United States	14618	AMAZON-AESUS	false
151.101.1.194	jimdo-storage.global.ssl.fastly.net	United States	54113	FASTLYUS	false
142.250.81.228	www.google.com	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
96.17.64.189	unknown	United States	16625	AKAMAI-ASUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1435387
Start date and time:	2024-05-02 16:11:57 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@35/48@6/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.1892504217417725
Encrypted:	false
SSDEEP:	6:DvwWM+q2P92nKuAl9OmbnIFUt86vwX4ZZmw+6vwX4MMVkwO92nKuAl9OmbjLJ:DYWM+v4HAahFUt86Y0/+6YvMV5LHAaSJ
MD5:	D8936A912B75E772108428A9A0F39C09
SHA1:	755E03A2F8EBF1CDC89FC6E8A0E5B8FC7EBE5B2D
SHA-256:	AF34BB8212D6806044E36E400982C542E9B36E42628B2B5ADD71F4063604AF48
SHA-512:	F8252C3E26F4DFFFAD85C16D501ACB10CF3BF3A87F3D63B51576830E53EE2A44A06F1D30C7C21D5B5F51E39100FB6308734817AB51DFA99D04E943D9ACA40B6A
Malicious:	false
Reputation:	low
Preview:	2024/05/02-16:14:06.431 48c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/05/02-16:14:06.432 48c Recovering log #3.2024/05/02-16:14:06.432 48c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 2 13:12:50 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.986006050017102
Encrypted:	false
SSDEEP:	48:8HMidVT9hGSEHxidAKZdA19ehwiZUklqehYgy+3:8HMo3XWfgy
MD5:	4959E4497B8D0878C121E19F61E5B3CA
SHA1:	8B2BD21A634E8CB3C94A19A3828A76A8BCBA014C
SHA-256:	1C4961A2FC8E4950063DE46DE00C4A6CA8C0C0D650F7B0B4462DED9110AB8C4B
SHA-512:	0BCB9787BB2FE30DA69FE2973532782C03536A34674003AE31849E2B9E4223F1959C79AABE5E37CB34C8C80C63C818B1370938CAF5CA41B0A484B6C884403707
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.q....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.q....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.q....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.q..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.q...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............v......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 2, 2024 16:12:47.903265953 CEST	53	51577	1.1.1.1	192.168.2.5
May 2, 2024 16:12:47.964910030 CEST	53	53126	1.1.1.1	192.168.2.5
May 2, 2024 16:12:48.684608936 CEST	53	57109	1.1.1.1	192.168.2.5
May 2, 2024 16:12:50.708009958 CEST	54864	53	192.168.2.5	1.1.1.1
May 2, 2024 16:12:50.708139896 CEST	51012	53	192.168.2.5	1.1.1.1
May 2, 2024 16:12:50.801464081 CEST	53	54864	1.1.1.1	192.168.2.5
May 2, 2024 16:12:50.802109957 CEST	53	51012	1.1.1.1	192.168.2.5
May 2, 2024 16:12:52.230307102 CEST	60737	53	192.168.2.5	1.1.1.1
May 2, 2024 16:12:52.238437891 CEST	64516	53	192.168.2.5	1.1.1.1
May 2, 2024 16:12:52.318958998 CEST	53	60737	1.1.1.1	192.168.2.5
May 2, 2024 16:12:52.326581955 CEST	53	64516	1.1.1.1	192.168.2.5
May 2, 2024 16:13:10.700592995 CEST	53	56964	1.1.1.1	192.168.2.5
May 2, 2024 16:13:34.995673895 CEST	53	53572	1.1.1.1	192.168.2.5
May 2, 2024 16:13:47.598731995 CEST	53	51035	1.1.1.1	192.168.2.5
May 2, 2024 16:13:58.801192045 CEST	53	58031	1.1.1.1	192.168.2.5
May 2, 2024 16:14:12.286506891 CEST	54921	53	192.168.2.5	1.1.1.1
May 2, 2024 16:14:12.374461889 CEST	53	54921	1.1.1.1	192.168.2.5
May 2, 2024 16:14:14.277069092 CEST	59780	443	192.168.2.5	162.159.61.3
May 2, 2024 16:14:14.366839886 CEST	443	59780	162.159.61.3	192.168.2.5
May 2, 2024 16:14:14.366916895 CEST	443	59780	162.159.61.3	192.168.2.5
May 2, 2024 16:14:14.366935015 CEST	443	59780	162.159.61.3	192.168.2.5
May 2, 2024 16:14:14.368568897 CEST	59780	443	192.168.2.5	162.159.61.3
May 2, 2024 16:14:14.369823933 CEST	59780	443	192.168.2.5	162.159.61.3
May 2, 2024 16:14:14.384859085 CEST	59780	443	192.168.2.5	162.159.61.3
May 2, 2024 16:14:14.385088921 CEST	59780	443	192.168.2.5	162.159.61.3
May 2, 2024 16:14:14.385556936 CEST	59780	443	192.168.2.5	162.159.61.3
May 2, 2024 16:14:14.472196102 CEST	443	59780	162.159.61.3	192.168.2.5
May 2, 2024 16:14:14.472279072 CEST	443	59780	162.159.61.3	192.168.2.5
May 2, 2024 16:14:14.472323895 CEST	443	59780	162.159.61.3	192.168.2.5
May 2, 2024 16:14:14.472367048 CEST	443	59780	162.159.61.3	192.168.2.5
May 2, 2024 16:14:14.473282099 CEST	443	59780	162.159.61.3	192.168.2.5
May 2, 2024 16:14:14.473500013 CEST	59780	443	192.168.2.5	162.159.61.3
May 2, 2024 16:14:14.473705053 CEST	59780	443	192.168.2.5	162.159.61.3
May 2, 2024 16:14:14.474590063 CEST	443	59780	162.159.61.3	192.168.2.5
May 2, 2024 16:14:14.502077103 CEST	59780	443	192.168.2.5	162.159.61.3
May 2, 2024 16:14:14.560684919 CEST	443	59780	162.159.61.3	192.168.2.5
May 2, 2024 16:14:14.586596012 CEST	59780	443	192.168.2.5	162.159.61.3
May 2, 2024 16:14:19.599879980 CEST	59780	443	192.168.2.5	162.159.61.3
May 2, 2024 16:14:19.689234018 CEST	443	59780	162.159.61.3	192.168.2.5
May 2, 2024 16:14:19.691106081 CEST	443	59780	162.159.61.3	192.168.2.5
May 2, 2024 16:14:19.775566101 CEST	59780	443	192.168.2.5	162.159.61.3
May 2, 2024 16:14:33.386205912 CEST	52292	53	192.168.2.5	1.1.1.1
May 2, 2024 16:14:33.478272915 CEST	53	52292	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 16:12:51.076334953 CEST	532	OUT	GET /file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf HTTP/1.1 Host: jimdo-storage.global.ssl.fastly.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 2, 2024 16:12:51.165029049 CEST	1289	IN	HTTP/1.1 200 OK Connection: keep-alive Content-Length: 322193 Content-Type: application/pdf referrer-policy: same-origin cache-control: max-age=31536000,public x-frame-options: DENY content-language: en x-content-type-options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains Via: 1.1 varnish, 1.1 varnish Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 1209391 Date: Thu, 02 May 2024 14:12:51 GMT X-Served-By: cache-fra-etou8220078-FRA, cache-ewr18175-EWR X-Cache: HIT, HIT X-Cache-Hits: 10, 0 X-Timer: S1714659171.118792,VS0,VE1 Data Raw: 25 50 44 46 2d 31 2e 34 0a 25 c3 a2 c3 a3 0a 31 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 54 69 74 6c 65 20 28 29 0a 2f 43 72 65 61 74 6f 72 20 28 fe ff 00 77 00 6b 00 68 00 74 00 6d 00 6c 00 74 00 6f 00 70 00 64 00 66 00 20 00 30 00 2e 00 31 00 32 00 2e 00 35 29 0a 2f 50 72 6f 64 75 63 65 72 20 28 fe ff 00 51 00 74 00 20 00 35 00 2e 00 31 00 31 00 2e 00 33 29 0a 2f 43 72 65 61 74 69 6f 6e 44 61 74 65 20 28 44 3a 32 30 32 33 31 30 30 38 30 33 32 38 35 35 2b 30 33 27 30 30 27 29 0a 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 0a 2f 50 61 67 65 73 20 33 20 30 20 52 0a 3e 3e 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 54 79 70 65 20 2f 45 78 74 47 53 74 61 74 65 0a 2f 53 41 20 74 72 75 65 0a 2f 53 4d 20 30 2e 30 32 0a 2f 63 61 20 31 2e 30 0a 2f 43 41 20 31 2e 30 0a 2f 41 49 53 20 66 61 6c 73 65 0a 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 5b 2f 50 61 74 74 65 72 6e 20 2f 44 65 76 69 63 65 [TRUNCATED] Data Ascii: %PDF-1.4%1 0 obj<</Title ()/Creator (wkhtmltopdf 0.12.5)/Producer (Qt 5.11.3)/CreationDate (D:20231008032855+03'00')>>endobj2 0 obj<</Type /Catalog/Pages 3 0 R>>endobj4 0 obj<</Type /ExtGState/SA true/SM 0.02/ca 1.0/CA 1.0/AIS false/SMask /None>>endobj5 0 obj[/Pattern /DeviceRGB]endobj7 0 obj<</Type /XObject/Subtype /Image/Width 625/Height 155/BitsPerComponent 8/ColorSpace /DeviceRGB/Length 8 0 R/Filter /DCTDecode>>streamJFIFddCCq"
May 2, 2024 16:12:51.165131092 CEST	1289	IN	Data Raw: 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 Data Ascii: }!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw
May 2, 2024 16:12:51.165220976 CEST	1289	IN	Data Raw: c9 e9 b8 a8 1d 7a d7 4c 92 a8 5d a3 67 1f 28 00 f3 9e fd bd 73 4f 6d a6 54 04 e0 86 25 49 1d 4f 39 fc b9 fc e8 b0 af cd b3 ed fd 7f 5f a9 cc 27 c2 4f 0d db b1 26 c3 ca db 95 3f bf 98 60 11 dc ef c7 e3 4f 5f 84 5e 1d 54 6c e9 ae b1 a3 1c 93 73 37 Data Ascii: zL]g(sOmT%IO9_'O&?`O_^Tls7#G?]~s;O})vG^v-}s_\|4KXT$]LN0IZt<=)_Hu#n:Ra8CeF7Vz_^}mgL>7^
May 2, 2024 16:12:51.165258884 CEST	1289	IN	Data Raw: 9f 2f 00 61 48 19 ff 00 38 14 28 2c a8 af 95 65 27 18 3f 5e 38 f6 fc 78 fc 28 69 0e 32 92 39 98 3e 0e 78 6c 0f f9 07 b4 80 60 17 37 52 92 7d 7f 8b db f3 34 f3 f0 8f c3 fe 60 51 a7 a9 18 2d cd cc bf 36 7f e0 47 de ba 40 aa ea 54 29 6e 77 1d dc 82 Data Ascii: /aH8(,e'?^8x(i29>xl`7R}4`Q-6G@T)nw3=?JDVXd-:[n)%:vFA+HkTqnviH1&e~1$x<qU,HPV#;_8<a=?$:rIS
May 2, 2024 16:12:51.165291071 CEST	1289	IN	Data Raw: 21 84 2a 8d a4 8f 94 01 8c 0c f6 ed 4b a9 a2 77 8e 88 51 b9 e4 39 55 c3 13 c8 3c 67 b5 41 25 c1 4c 8c a8 28 71 c9 e4 8f ae 72 32 47 53 e9 d2 a6 4d bb b0 a0 36 e2 58 10 39 27 fa f5 eb 4a a0 23 17 55 55 07 a9 27 af 3d 3f 3f d4 9a 13 14 a2 e4 b4 62 Data Ascii: !*KwQ9U<gA%L(qr2GSM6X9'J#UU'=??b1_1'JjR08?c'?pF&A?>>R89<?\b\| \|dzg_3w=qH>3q?_zvfpBsNF_,
May 2, 2024 16:12:51.165313959 CEST	1289	IN	Data Raw: 10 49 39 1c 74 38 ff 00 0a 10 a5 1b ed d7 fa f5 1e 65 f3 77 e0 82 c0 67 87 c7 1c e0 fe 9f a5 32 41 b9 93 b9 4f e1 27 04 8e de b9 ff 00 eb d4 84 ff 00 09 20 2a f5 18 23 ff 00 ad 4c 45 f2 f8 c6 e2 99 27 23 92 d9 eb 9e bd 09 a4 8d 65 77 b8 91 11 72 Data Ascii: I9t8ewg2AO' *#LE'#ewrPf9$E4$gF"g2s)@n'?!+HmPqP{~1,$A`28rr#~Cp(s
May 2, 2024 16:12:51.165343046 CEST	1289	IN	Data Raw: ca 9e bd 39 f5 27 3f e3 4b 20 0c 36 85 c9 1f 2f ca 36 e3 a0 3f 86 0f e4 2a 96 85 ad 5a f8 8b 4e b7 d4 34 eb ab 7b db 5b 85 12 47 3c 4d e6 47 22 b0 cf 05 4e 3d 39 f4 ac df 05 7c 4c d0 3c 79 aa ea f6 3a 36 a5 6b 7d 71 e1 e9 d6 d6 ff 00 c8 6f 96 09 Data Ascii: 9'?K 6/6?ZN4{[G<MG"N=9\|L<y:6k}qo`6N:#=vzo{VKCrrq~iIOtp QNs9:a??P[[b[pL\|f~jbc]02y0a2c&_/
May 2, 2024 16:12:51.165421963 CEST	1289	IN	Data Raw: ed df b7 ad 3b 72 87 40 5c 7c ad 8c 1f e2 eb c7 4f 5c 7e 54 a0 79 4a aa a7 92 0e 09 27 3c fd 73 ef 51 47 6e 88 b0 8d 8c 15 30 b9 dd ce 07 4f a8 ce 28 1d a5 1b 24 bf 3f 21 cd 02 5c c7 80 cf 82 31 95 3b 5b 9e b8 3d 47 e0 7e 94 4a c9 0a 87 60 cd b7 Data Ascii: ;r@\\|O\~TyJ'<sQGn0O($?!\1;[=G~J`?w,}&Y#z!2A\/#i6U3HLtv?:%TW-A *blO%>'hRz/,g)'=)n5S+2G1{s==J#(
May 2, 2024 16:12:51.165726900 CEST	1289	IN	Data Raw: d4 31 12 16 8c f2 48 39 03 19 03 f0 ce 78 22 9c cc 5d b0 57 2b d4 75 e4 72 3f 3f e7 9a 27 1b 95 94 0e 1c 16 e5 49 f7 e4 7f 4c 7a d2 06 b4 ba 3c c7 f6 b1 fd a3 2c 7f 66 ff 00 85 57 5a b4 8c a6 fa 5f dd 59 db f5 69 5c 9c 73 9e c0 64 e3 fd 9f c2 bf Data Ascii: 1H9x"]W+ur??'ILz<,fWZ_Yi\sd*>#xWKwQ&.yGP(?e.X?bIKT31xjx>rx$`q?<1jY~[mHE~/xP!oy;_.xx\g="ouo
May 2, 2024 16:12:51.165869951 CEST	1289	IN	Data Raw: 10 73 c0 a6 b6 22 6e d2 d3 fa ee 61 a7 c2 bf 0c a4 78 1e 1d d0 ce 06 3f e4 1f 10 03 d7 03 6d 21 f8 5d e1 96 21 8f 87 7c 3e 5b a6 7f b3 e2 63 8f 41 f2 83 d3 1f fd 7a dc 41 96 dc 5b 24 80 36 8c 0c f5 fc 7f fd 54 e5 90 6d c8 1b 49 1d c6 0f eb f5 a1 Data Ascii: s"nax?m!]!\|>[cAzA[$6TmIc;\|1#pv:1?G^G\|;(@{vj22@'{\|m93fiisk][[kk(?(#A;@S=6i+5`J?3u"q}k
May 2, 2024 16:12:51.167912006 CEST	1289	IN	Data Raw: c0 1b 8e 33 e8 3b ff 00 f5 a8 1b da ff 00 d7 e3 fd 7c 87 b4 60 32 8d a0 8c 10 72 09 cf b6 7f cf e9 4c e1 a7 07 e6 01 c7 4e 78 c6 7f 0e ff 00 a7 e4 92 a9 5d a4 2b 31 04 00 00 03 6e 4e 72 73 db 38 f7 e3 de 96 16 5e 1c 8d a8 30 77 1c af 51 d0 83 df Data Ascii: 3;\|`2rLNx]+1nNrs8^0wQ.&+Z#UJt,o2HV.6e3=~`/N#=[_B\(USs"f3XOL+lL&49GQ;8rN

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 16:12:52.160238028 CEST	496	OUT	GET /favicon.ico HTTP/1.1 Host: jimdo-storage.global.ssl.fastly.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 2, 2024 16:12:52.249914885 CEST	577	IN	HTTP/1.1 404 Not Found Connection: keep-alive Content-Length: 146 Content-Type: text/html Strict-Transport-Security: max-age=15724800; includeSubDomains Via: 1.1 varnish, 1.1 varnish Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Thu, 02 May 2024 14:12:52 GMT Age: 2090 X-Served-By: cache-fra-eddf8230094-FRA, cache-lga21962-LGA X-Cache: HIT, HIT X-Cache-Hits: 107, 1 X-Timer: S1714659172.202691,VS0,VE2 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
May 2, 2024 16:13:00.156702995 CEST	357	OUT	GET /file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf HTTP/1.1 Host: jimdo-storage.global.ssl.fastly.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 2, 2024 16:13:00.245773077 CEST	583	IN	HTTP/1.1 200 OK Connection: keep-alive Content-Length: 322193 Content-Type: application/pdf referrer-policy: same-origin cache-control: max-age=31536000,public x-frame-options: DENY content-language: en x-content-type-options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains Via: 1.1 varnish, 1.1 varnish Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 1209400 Date: Thu, 02 May 2024 14:13:00 GMT X-Served-By: cache-fra-etou8220078-FRA, cache-lga21962-LGA X-Cache: MISS, HIT X-Cache-Hits: 0, 0 X-Timer: S1714659180.199774,VS0,VE1
May 2, 2024 16:13:00.246529102 CEST	1289	IN	Data Raw: 25 50 44 46 2d 31 2e 34 0a 25 c3 a2 c3 a3 0a 31 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 54 69 74 6c 65 20 28 29 0a 2f 43 72 65 61 74 6f 72 20 28 fe ff 00 77 00 6b 00 68 00 74 00 6d 00 6c 00 74 00 6f 00 70 00 64 00 66 00 20 00 30 00 2e 00 31 00 32 00 2e Data Ascii: %PDF-1.4%1 0 obj<</Title ()/Creator (wkhtmltopdf 0.12.5)/Producer (Qt 5.11.3)/CreationDate (D:20231008032855+03'00')>>endobj2 0 obj<</Type /Catalog/Pages 3 0 R>>endobj4 0 obj<</Type /ExtGSta
May 2, 2024 16:13:00.246546030 CEST	1289	IN	Data Raw: fa 63 fc f3 4d 6c 4b dd 2f eb a7 63 9d 9b e1 07 86 d2 43 9d 39 49 72 48 53 73 29 2d eb fc 5f ca 9a 3e 0c 78 75 65 04 d8 12 1f 24 8f 3a 63 e9 df 77 15 d3 ba 85 70 39 03 1b 71 db eb e8 33 48 9b c4 6d 80 e1 87 76 39 38 1e 98 eb fc fa 50 b6 29 bb cb Data Ascii: cMlK/cC9IrHSs)-_>xue$:cwp9q3Hmv98P)Ts?\|4gqw7i370'POL!s@?'9/fL%C 93ryp~nMfqL4R2Wfc8
May 2, 2024 16:13:00.246567965 CEST	1289	IN	Data Raw: d7 87 22 04 36 9c 24 c3 f7 9e 5c 0e 49 e3 e6 eb 83 8f 7c 57 4b 18 d9 33 0d ea 59 8f 7e 31 fd 7a e7 f2 eb ea a4 b4 05 d8 21 2a 07 23 1c e3 3c 90 07 24 f7 fc a9 be c2 8b da 4f a5 ff 00 af eb fc ce 64 fc 22 f0 fc b2 02 9a 73 fc 8d c6 2e e6 00 91 c0 Data Ascii: "6$\I\|WK3Y~1z!#<$Od"s.Up~lzS.y;HR6y0?uBA,@JEG3{n:>oilVIo\wwm@BG_O^VVa%)#J~=v9xsk
May 2, 2024 16:13:00.246583939 CEST	1289	IN	Data Raw: a4 04 24 0f 5e d9 f4 ff 00 1a 58 47 ef 09 57 0e ad 95 e4 8e 3a 71 f9 e6 81 ab df 5f eb fa fe bc f9 a3 f0 73 c3 6f 20 df a6 ed 00 e3 fe 3e 26 c7 5e 3f 8b d4 ff 00 9e 70 37 c2 5d 02 4c ee b0 3b 58 82 36 cd 37 1e c7 e6 e9 9c 57 4c 30 80 11 9c 07 e7 Data Ascii: $^XGW:q_so >&^?p7]L;X67WL0#B(bAaLsMAv]9h'zSeG)_/W8?p7sOV9H\|]~xj@i'nCZX>x~JXsJ}7u}N<
May 2, 2024 16:13:00.246620893 CEST	1289	IN	Data Raw: d9 24 10 30 e5 9b 90 9c 72 41 cf 19 c7 23 af 5e 9d e9 32 24 95 b6 b1 c0 1b 58 1e 7b 76 ed 9f d3 9a 22 1e 52 6d d9 b6 46 cf dd e8 3b fb 64 64 ff 00 fa a8 b0 39 5f 44 3b 76 1a 43 91 86 21 57 60 3c 1e e3 8e fe ff 00 4a 54 50 55 b0 0e d6 c9 20 f4 c7 Data Ascii: $0rA#^2$X{v"RmF;dd9_D;vC!W`<JTPU 3Nxs1*#9/9}}~B0NdL28=d$;8T@rF<?COFteNzm*J,iz8y[&
May 2, 2024 16:13:00.246649027 CEST	1289	IN	Data Raw: 18 48 48 ce d0 dc 74 04 36 47 ff 00 af f5 a8 fe 58 27 45 79 23 5f 37 e5 8f 76 14 b9 00 93 f5 c8 52 71 8e d9 a4 68 c8 84 37 2a d1 a9 55 dd 93 f9 e4 ff 00 3f 6e 7b d3 b1 31 6d 5d a5 eb fd 7c ef ff 00 0e 4c e3 c9 8d 48 52 c1 14 9c 92 06 07 f9 fc 38 Data Ascii: HHt6GX'Ey#_7vRqh7*U?n{1m]\|LHR8M%fA9sBm%W#ryfF I<T=ShB?SfKE==5".s-2[JfD\`c#< ?t?f
May 2, 2024 16:13:00.246675968 CEST	1289	IN	Data Raw: b6 df b1 6f 03 a9 2c c5 8f 2b d3 23 f1 fe 86 88 95 16 dd 48 00 2a f2 a7 af 1e b9 e7 b7 7e f9 af 2c ff 00 86 b1 f0 c4 52 ba 2e 9f ad 32 ff 00 08 fb 3c 41 48 eb d0 c9 df 39 e9 df 9e 94 df f8 6b bf 0f 43 0b 95 b0 d7 18 a9 c0 fd cc 4c 47 3c 1e 24 27 Data Ascii: o,+#H*~,R.2<AH9kCLG<$'MZw=Y8i499yb~^Z,D=(Hln+bcih^`+zF8^<+zs^W7q7El<i'\|4f[/V,
May 2, 2024 16:13:00.246702909 CEST	1289	IN	Data Raw: bf d3 34 c9 26 fb 39 0a cd 99 31 bc 2a 8c 90 be c3 bd 34 0e 56 d5 ed fd 7f 5e a0 00 89 dc 81 b5 43 12 fe 8d c1 eb 9f f3 c0 a7 00 cf 9d aa 19 94 70 59 4e 3b e3 b7 e8 3a 66 94 b9 75 04 e3 39 18 38 07 df d7 db fc f5 a5 f2 88 54 46 62 5b a9 ea 01 e7 Data Ascii: 4&914V^CpYN;:fu98TFb[lQ[m#6/N?^?4,r~yMPqtpvNp;=})\k_EO=7mVg#8jX?sjY ?hw1$Nv
May 2, 2024 16:13:00.254547119 CEST	1289	IN	Data Raw: c8 da 54 9e b9 23 23 18 c5 7d f9 ff 00 06 cc f8 8a f3 c5 7f 05 be 29 5e df 5c dc 5c df dd 78 95 66 96 79 cf 98 d2 b3 5b c6 49 3d f9 e3 ad 7e 29 bd c0 f3 1f 6b b2 b9 38 1b 0e 78 ee 09 c0 c9 ea 0e 3d 3d 6b f6 83 fe 0d 7b 91 24 f8 03 f1 28 96 39 1e Data Ascii: T##})^\\xfy[I=~)k8x==k{$(9#F>q+1eRPrij2LV6;^.2dy&e9aqzT\|Qnfd<+3jF]IP\?Z0UpC18
May 2, 2024 16:13:00.254575014 CEST	1289	IN	Data Raw: 8e f9 f6 cf e3 42 b1 8f 21 46 e6 62 72 48 da 59 bb 7e 83 af b5 1a 74 2d 5d 6b 2e a2 46 a8 ac c1 46 3a 3b 72 70 4e 4f af 7e 3d 73 9f d5 15 4f 99 85 27 68 25 b2 09 24 e7 39 e7 9f 51 8c 7d 29 cf 18 28 42 85 1b 48 21 47 63 d4 53 7c c2 f2 16 54 43 26 Data Ascii: B!FbrHY~t-]k.FF:;rpNO~=sO'h%$9Q})(BH!GcS\|TC&1#&k_(qdLno*C>h >})%<[8?#}p:vCrFA#!6yoc O>t^=)A\|

Timestamp	Bytes transferred	Direction	Data
2024-05-02 14:13:01 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-02 14:13:01 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=41004 Date: Thu, 02 May 2024 14:13:01 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-05-02 14:13:02 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-02 14:13:02 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 08K+nYgAAAACXC/Ywsy9UQ60qHfPpvzYzU0pDRURHRTA1MTIAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=60668 Date: Thu, 02 May 2024 14:13:02 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-02 14:13:02 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240502141412Z-215.bmp

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Windows Analysis Report
http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf

Timestamp	Bytes transferred	Direction	Data
2024-05-02 14:13:04 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=UVgewHzVZFt3UPh&MD=6OvxsGTB HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-02 14:13:05 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f2e5a27b-1311-4690-8633-017da742e3fc MS-RequestId: 8d93ed8f-7b7a-4411-8d66-52ed1cb581ae MS-CV: Jlcqhi2D8E+H8h5N.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 02 May 2024 14:13:04 GMT Connection: close Content-Length: 24490
2024-05-02 14:13:05 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-05-02 14:13:05 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-05-02 14:13:47 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=UVgewHzVZFt3UPh&MD=6OvxsGTB HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-02 14:13:48 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 896f0043-929f-468c-a175-b6730fecb4eb MS-RequestId: 31086ed6-9551-4ae3-b743-a65059d11b78 MS-CV: GWXx/nj0nEG5ulZs.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 02 May 2024 14:13:47 GMT Connection: close Content-Length: 25457
2024-05-02 14:13:48 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-05-02 14:13:48 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Timestamp	Bytes transferred	Direction	Data
2024-05-02 14:14:12 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-05-02 14:14:12 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-05-02 14:14:13 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 02 May 2024 14:14:13 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 87d89dcad86a43e0-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 14:14:13 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fc 00 04 8e fa b0 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Timestamp	Bytes transferred	Direction	Data
2024-05-02 14:14:14 UTC	1353	OUT	OPTIONS /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1 Host: p13n.adobe.io Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-adobe-uuid,x-adobe-uuid-type,x-api-key Origin: https://rna-resource.acrobat.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://rna-resource.acrobat.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-02 14:14:14 UTC	508	IN	HTTP/1.1 204 No Content Server: openresty Date: Thu, 02 May 2024 14:14:14 GMT Content-Type: text/plain Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Authorization,Content-Type,X-Api-Key,cache-control,User-Agent,If-None-Match,x-adobe-uuid,x-adobe-uuid-type, X-Request-Id Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: x-request-id X-Request-Id: WhcgwdoobslBRdNwV4O6yldxnPthX3HV

Timestamp	Bytes transferred	Direction	Data
2024-05-02 14:14:15 UTC	1473	OUT	GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1 Host: p13n.adobe.io Connection: keep-alive sec-ch-ua: "Chromium";v="105" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 x-adobe-uuid: 89d789c4-e7e5-4f75-95a4-57139ab6811f x-adobe-uuid-type: visitorId x-api-key: AdobeReader9 sec-ch-ua-platform: "Windows" Origin: https://rna-resource.acrobat.com Accept-Language: en-US,en;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rna-resource.acrobat.com/ Accept-Encoding: gzip, deflate, br
2024-05-02 14:14:15 UTC	544	IN	HTTP/1.1 200 Server: openresty Date: Thu, 02 May 2024 14:14:15 GMT Content-Type: application/json;charset=UTF-8 Content-Length: 3120 Connection: close x-request-id: ZlMjttlh3hnfePkSk2BTweL2UA3rKaFv vary: accept-encoding Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Authorization,Content-Type,X-Api-Key,cache-control,User-Agent,If-None-Match,x-adobe-uuid,x-adobe-uuid-type, X-Request-Id Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: x-request-id
2024-05-02 14:14:15 UTC	3120	IN	Data Raw: 7b 22 73 75 72 66 61 63 65 73 22 3a 7b 22 44 43 5f 52 65 61 64 65 72 5f 52 48 50 5f 42 61 6e 6e 65 72 22 3a 7b 22 63 6f 6e 74 61 69 6e 65 72 73 22 3a 5b 7b 22 63 6f 6e 74 61 69 6e 65 72 49 64 22 3a 31 2c 22 63 6f 6e 74 61 69 6e 65 72 4c 61 62 65 6c 22 3a 22 4a 53 4f 4e 20 66 6f 72 20 52 65 61 64 65 72 20 44 43 20 52 48 50 20 42 61 6e 6e 65 72 22 2c 22 64 61 74 61 54 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 2c 22 64 61 74 61 22 3a 22 65 79 4a 6a 64 47 45 69 4f 6e 73 69 64 48 6c 77 5a 53 49 36 49 6d 4a 31 64 48 52 76 62 69 49 73 49 6e 52 6c 65 48 51 69 4f 69 4a 47 63 6d 56 6c 49 44 63 74 52 47 46 35 49 46 52 79 61 57 46 73 49 69 77 69 5a 32 39 66 64 58 4a 73 49 6a 6f 69 61 48 52 30 63 48 4d 36 4c 79 39 68 59 33 4a 76 59 6d 46 30 Data Ascii: {"surfaces":{"DC_Reader_RHP_Banner":{"containers":[{"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","dataType":"application/json","data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0

Timestamp	Bytes transferred	Direction	Data
2024-05-02 14:14:20 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-05-02 14:14:20 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Thu, 02 May 2024 14:14:20 GMT Connection: close

Target ID:	0
Start time:	16:12:41
Start date:	02/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	16:12:46
Start date:	02/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2032,i,7147495927222513840,11287494638090544190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	16:12:49
Start date:	02/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://jimdo-storage.global.ssl.fastly.net/file/a45fef49-77a5-4e4b-b081-f19dd1b9626e/b0aa30c8-07ba-4acf-a6e6-856aaa7da320.pdf"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	16:14:05
Start date:	02/05/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false