Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
virus.pdf
|
PDF document, version 1.4, 2 pages
|
initial sample
|
 |
|
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4247a010-d08c-49fb-b524-d28c290a6313.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\81babc9d-fdbe-4570-befb-f7e9d5098d78.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4944c6.TMP (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log
|
data
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250318011748Z-159.bmp
|
PC bitmap, Windows 3.x format, 164 x -116 x 32, cbSize 76150, bits offset 54
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
|
SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8,
version-valid-for 2
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal
|
SQLite Rollback Journal
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D
|
Certificate, Version=3
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D
|
data
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
modified
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6356
|
PostScript document text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)
|
PostScript document text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
|
SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8,
version-valid-for 19
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal
|
SQLite Rollback Journal
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-03-17 21-17-47-465.log
|
ASCII text, with very long lines (393)
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log
|
ASCII text, with very long lines (393), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrocef_low\29086d70-6c62-4492-a5e4-7ac8afbc783a.tmp
|
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrocef_low\3ed50fb7-becc-4b71-9378-8299e9fcbda8.tmp
|
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrocef_low\7745a554-986b-4486-9a64-855e5b670b9a.tmp
|
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrocef_low\7e96f4f3-8c6d-48d4-aab1-cca13d62e1fb.tmp
|
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
|
dropped
|
||
|
Chrome Cache Entry: 165
|
Web Open Font Format (Version 2), TrueType, length 48556, version 1.0
|
downloaded
|
||
|
Chrome Cache Entry: 166
|
ASCII text, with very long lines (25852), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 167
|
HTML document, ASCII text
|
downloaded
|
||
|
Chrome Cache Entry: 168
|
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 169
|
ASCII text, with very long lines (65536), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 170
|
HTML document, ASCII text, with very long lines (4226), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 171
|
ASCII text, with very long lines (26799), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 172
|
ASCII text, with very long lines (15916)
|
downloaded
|
||
|
Chrome Cache Entry: 173
|
ASCII text, with very long lines (65536), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 174
|
ASCII text, with very long lines (65536), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 175
|
ASCII text, with very long lines (52504), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 177
|
ASCII text, with very long lines (65536), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 179
|
ASCII text, with very long lines (612), with no line terminators
|
downloaded
|
There are 48 hidden files, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://sdspprfd-tftfrtrghf34f3drrs3.net/_next/static/chunks/fd9d1056-4f5113e8da6db9c7.js
|
104.21.64.1
|
|
|
|
https://sdspprfd-tftfrtrghf34f3drrs3.net/lq3uzfH9rN/?S=bjones%40lakeland.cc.il.us
|
104.21.64.1
|
|
|
|
https://sdspprfd-tftfrtrghf34f3drrs3.net/_next/static/chunks/app/page-c71772bf3bad0174.js
|
104.21.64.1
|
|
|
|
https://sdspprfd-tftfrtrghf34f3drrs3.net/_next/static/chunks/webpack-20efd41c90b5bcbd.js
|
104.21.64.1
|
|
|
|
https://sdspprfd-tftfrtrghf34f3drrs3.net/_next/static/chunks/23-e33e3d623cf28c17.js
|
104.21.64.1
|
|
|
|
https://sdspprfd-tftfrtrghf34f3drrs3.net/?S=jjohns@lakeland.cc.il.us
|
104.21.64.1
|
|
|
|
https://sdspprfd-tftfrtrghf34f3drrs3.net/_next/static/chunks/main-app-653c0408c14c4864.js
|
104.21.64.1
|
|
|
|
https://sdspprfd-tftfrtrghf34f3drrs3.net/_next/static/media/a34f9d1faa5f3315.p.woff2
|
104.21.64.1
|
|
|
|
https://sdspprfd-tftfrtrghf34f3drrs3.net/lq3uzfH9rN?S=bjones@lakeland.cc.il.us
|
104.21.64.1
|
|
|
|
https://sdspprfd-tftfrtrghf34f3drrs3.net/_next/static/css/7b64cd318fb77179.css
|
104.21.64.1
|
|
|
|
https://sdspprfd-tftfrtrghf34f3drrs3.net/_next/static/chunks/92-2a0dad65b64d730c.js
|
104.21.64.1
|
|
|
|
https://sdspprfd-tftfrtrghf34f3drrs3.net/_next/static/chunks/app/not-found-9fcb5dc5d913bcdb.js
|
104.21.64.1
|
|
|
|
https://sdspprfd-tftfrtrghf34f3drrs3.net/?S=bjones@lakeland.cc.il.us
|
104.21.64.1
|
|
|
|
https://sdspprfd-tftfrtrghf34f3drrs3.net/_next/static/css/f796ea3b426fcf90.css
|
104.21.64.1
|
|
|
|
https://khfreightgroup.com/favicon.ico
|
192.185.25.215
|
||
|
https://khfreightgroup.com/wp-content/uploads/2024/05/cropped-KH-Freight-Icon-32x32.png
|
192.185.25.215
|
||
|
https://khfreightgroup.com/awsfrvc/wsrcfwasdesf/looosafvcsfe/wafcarrfw/?email=YmpvbmVzQGxha2VsYW5kLmNjLmlsLnVz
|
|||
|
https://a.nel.cloudflare.com/report/v4?s=Kka7siyfKKzh0DHyAAs5LLTT2aN7pS%2Bqrfw55tzojkxRCne0dyUrgcHj8QX6HpmOaB4%2FywnN39pt%2FyFZv335nnPj7C%2Fg3qvccqv3frvp99GFev5vl%2FNF0TpkY1svgF06d8Subml9hCqNAuueHB0E53zEzw%3D%3D
|
35.190.80.1
|
There are 8 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
khfreightgroup.com
|
192.185.25.215
|
|
|
|
sdspprfd-tftfrtrghf34f3drrs3.net
|
104.21.64.1
|
||
|
a.nel.cloudflare.com
|
35.190.80.1
|
||
|
e8652.dscx.akamaiedge.net
|
92.123.21.129
|
||
|
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
|
217.20.57.20
|
||
|
www.google.com
|
142.250.185.196
|
||
|
x1.i.lencr.org
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
192.185.25.215
|
khfreightgroup.com
|
United States
|
|
|
|
142.250.186.46
|
unknown
|
United States
|
||
|
3.219.243.226
|
unknown
|
United States
|
||
|
92.123.21.129
|
e8652.dscx.akamaiedge.net
|
European Union
|
||
|
1.1.1.1
|
unknown
|
Australia
|
||
|
217.20.57.20
|
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
|
Denmark
|
||
|
192.168.2.16
|
unknown
|
unknown
|
||
|
104.21.64.1
|
sdspprfd-tftfrtrghf34f3drrs3.net
|
United States
|
||
|
172.217.18.3
|
unknown
|
United States
|
||
|
142.250.185.227
|
unknown
|
United States
|
||
|
142.251.168.84
|
unknown
|
United States
|
||
|
142.250.185.196
|
www.google.com
|
United States
|
||
|
142.250.185.174
|
unknown
|
United States
|
||
|
192.168.2.15
|
unknown
|
unknown
|
||
|
35.190.80.1
|
a.nel.cloudflare.com
|
United States
|
||
|
92.123.20.204
|
unknown
|
European Union
|
||
|
172.217.16.195
|
unknown
|
United States
|
||
|
172.64.41.3
|
unknown
|
United States
|
||
|
172.217.16.142
|
unknown
|
United States
|
There are 9 hidden IPs, click here to show them.