Edit tour

Windows Analysis Report
Factura.pdf

Overview

General Information

Sample name:	Factura.pdf
Analysis ID:	1485219
MD5:	88942c76544cdcfa2136c4ff876363d4
SHA1:	cbc00851174729d94188e79879ce1bfeba5cc3cc
SHA256:	60659cc770389bda5a31fd917555d0c494cec53e4a5cbfb10230cb117939eaa0
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected suspicious PDF

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Drops files with a non-matching file extension (content does not match file extension)

Form action URLs do not match main URL

HTML body contains low number of good links

HTML title does not match URL

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7308 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Factura.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7744 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1508,i,10463332442722132192,14218185456690274382,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://1drv.ms/b/s!AhJ7ZeBT5ZMfgRYDYmTU0jSOiix8?e=QbMPnu" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8700 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=2004,i,4560367953723847233,243234883886843712,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7936 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6120 --field-trial-handle=2004,i,4560367953723847233,243234883886843712,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7760 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 --field-trial-handle=2004,i,4560367953723847233,243234883886843712,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://login.microsoftonline.de

Avira URL Cloud: Label: phishing

Source: https://login.live.com/oauth20_authorize.srf?client_id=10fa57ef-4895-4ab2-872c-8c3613d4f7fb&scope=openid+profile+offline_access&redirect_uri=https%3a%2f%2fwww.microsoft.com%2fcascadeauth%2faccount%2fsignin-oidc&response_type=code&state=CfDJ8GIDTS11_mxJlLbEvLbfH9NfsH_gXXHiOvUwDKCDNmlM7ZSuQ27hGqkGLLr1RPLKcMipa8Y8_PCdDhwRUCQsmNoyNDFzdODvYNNDOvkMTVYiIkwlMkhsioHEXXQPIFR_ENzGrhLZF6V-JB2vCItkksh9U_ubLA1kXYRotprKE82XNpMD6eI0xzDZtpC9FoJnQCMMiJV0vtj55DqTYiWz87pMVCZ59pWJz8pDAvrjmBpNy4sE2c3z9TxRL_92qWI15iFkialEXT6NH29qTuiHYnfAffe8Yl0NM61aIzyrSMHcPc19L4yUElJXI8Om2qbluM5aia983VudopydqY44fctz-mcfqzDq--Lq9-XqEQk3KGh_DZ0sPvRYbeUYSbEympvKdqy83R-qLete80I-eSel23Ss1b-wnz_5m9aZ2afj9VyrJXyeUBM-585iVy2ReSQ0WBv34g7uSAtY2LFMdqk7qxh0TnDKV_JyJsuVePFhxPvxJyZrZDm-WAYIHJPaBg&response_mode=form_post&nonce=638580106116336992.Mjc4ZTAyYTUtMTA1MC00NWM0LWIwMDAtZTFkMWI1OTgyOTA0OWVmZDQwNjctMGRjYi00OThmLWFmYTItNThkMzU3ZTNmN2Fh&prompt=none&code_challenge=7JuYfZS3np5DkKthYUgtp9SeC5cVe4Nn73z4dwa7uTk&code_challenge_method=S256&x-client-SKU=ID_NET6_0&x-...

HTTP Parser: Form action: https://www.microsoft.com/cascadeauth/account/signin-oidc live microsoft

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=1372215b-3f9a-4aab-addd-707eabddda1f&redirect_uri=https%3a%2f%2fcopilot.microsoft.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%222454AD396FBA465FAA21B85152FB9F0F%22%7d	HTTP Parser: Number of links: 0
Source: https://login.live.com/oauth20_authorize.srf?client_id=10fa57ef-4895-4ab2-872c-8c3613d4f7fb&scope=openid+profile+offline_access&redirect_uri=https%3a%2f%2fwww.microsoft.com%2fcascadeauth%2faccount%2fsignin-oidc&response_type=code&state=CfDJ8GIDTS11_mxJlLbEvLbfH9NfsH_gXXHiOvUwDKCDNmlM7ZSuQ27hGqkGLLr1RPLKcMipa8Y8_PCdDhwRUCQsmNoyNDFzdODvYNNDOvkMTVYiIkwlMkhsioHEXXQPIFR_ENzGrhLZF6V-JB2vCItkksh9U_ubLA1kXYRotprKE82XNpMD6eI0xzDZtpC9FoJnQCMMiJV0vtj55DqTYiWz87pMVCZ59pWJz8pDAvrjmBpNy4sE2c3z9TxRL_92qWI15iFkialEXT6NH29qTuiHYnfAffe8Yl0NM61aIzyrSMHcPc19L4yUElJXI8Om2qbluM5aia983VudopydqY44fctz-mcfqzDq--Lq9-XqEQk3KGh_DZ0sPvRYbeUYSbEympvKdqy83R-qLete80I-eSel23Ss1b-wnz_5m9aZ2afj9VyrJXyeUBM-585iVy2ReSQ0WBv34g7uSAtY2LFMdqk7qxh0TnDKV_JyJsuVePFhxPvxJyZrZDm-WAYIHJPaBg&response_mode=form_post&nonce=638580106116336992.Mjc4ZTAyYTUtMTA1MC00NWM0LWIwMDAtZTFkMWI1OTgyOTA0OWVmZDQwNjctMGRjYi00OThmLWFmYTItNThkMzU3ZTNmN2Fh&prompt=none&code_challenge=7JuYfZS3np5DkKthYUgtp9SeC5cVe4Nn73z4dwa7uTk&code_challenge_method=S256&x-client-SKU=ID_NET6_0&x-...	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=1372215b-3f9a-4aab-addd-707eabddda1f&redirect_uri=https%3a%2f%2fcopilot.microsoft.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%222454AD396FBA465FAA21B85152FB9F0F%22%7d	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.live.com/oauth20_authorize.srf?client_id=10fa57ef-4895-4ab2-872c-8c3613d4f7fb&scope=openid+profile+offline_access&redirect_uri=https%3a%2f%2fwww.microsoft.com%2fcascadeauth%2faccount%2fsignin-oidc&response_type=code&state=CfDJ8GIDTS11_mxJlLbEvLbfH9NfsH_gXXHiOvUwDKCDNmlM7ZSuQ27hGqkGLLr1RPLKcMipa8Y8_PCdDhwRUCQsmNoyNDFzdODvYNNDOvkMTVYiIkwlMkhsioHEXXQPIFR_ENzGrhLZF6V-JB2vCItkksh9U_ubLA1kXYRotprKE82XNpMD6eI0xzDZtpC9FoJnQCMMiJV0vtj55DqTYiWz87pMVCZ59pWJz8pDAvrjmBpNy4sE2c3z9TxRL_92qWI15iFkialEXT6NH29qTuiHYnfAffe8Yl0NM61aIzyrSMHcPc19L4yUElJXI8Om2qbluM5aia983VudopydqY44fctz-mcfqzDq--Lq9-XqEQk3KGh_DZ0sPvRYbeUYSbEympvKdqy83R-qLete80I-eSel23Ss1b-wnz_5m9aZ2afj9VyrJXyeUBM-585iVy2ReSQ0WBv34g7uSAtY2LFMdqk7qxh0TnDKV_JyJsuVePFhxPvxJyZrZDm-WAYIHJPaBg&response_mode=form_post&nonce=638580106116336992.Mjc4ZTAyYTUtMTA1MC00NWM0LWIwMDAtZTFkMWI1OTgyOTA0OWVmZDQwNjctMGRjYi00OThmLWFmYTItNThkMzU3ZTNmN2Fh&prompt=none&code_challenge=7JuYfZS3np5DkKthYUgtp9SeC5cVe4Nn73z4dwa7uTk&code_challenge_method=S256&x-client-SKU=ID_NET6_0&x-...	HTTP Parser: Title: Continue does not match URL

Source: https://onedrive.live.com/_forms/default.aspx?ReturnUrl=%2F%3Fid%3D1F93E553E0657B12%21150%26resid%3D1F93E553E0657B12%21150%26ithint%3Dfile%252cpdf%26authkey%3D%21AANiZNTSNI6KLHw%26cid%3D1f93e553e0657b12	HTTP Parser: No favicon
Source: about:blank	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=1372215b-3f9a-4aab-addd-707eabddda1f&redirect_uri=https%3a%2f%2fcopilot.microsoft.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%222454AD396FBA465FAA21B85152FB9F0F%22%7d	HTTP Parser: No favicon
Source: https://www.bing.com/secure/Passport.aspx?popup=1&ssl=1	HTTP Parser: No favicon
Source: https://fpt.microsoft.com/tags?session_id=d1ae26ef-75e1-4584-8788-cc8edbbe54d9	HTTP Parser: No favicon
Source: https://login.live.com/oauth20_authorize.srf?client_id=10fa57ef-4895-4ab2-872c-8c3613d4f7fb&scope=openid+profile+offline_access&redirect_uri=https%3a%2f%2fwww.microsoft.com%2fcascadeauth%2faccount%2fsignin-oidc&response_type=code&state=CfDJ8GIDTS11_mxJlLbEvLbfH9NfsH_gXXHiOvUwDKCDNmlM7ZSuQ27hGqkGLLr1RPLKcMipa8Y8_PCdDhwRUCQsmNoyNDFzdODvYNNDOvkMTVYiIkwlMkhsioHEXXQPIFR_ENzGrhLZF6V-JB2vCItkksh9U_ubLA1kXYRotprKE82XNpMD6eI0xzDZtpC9FoJnQCMMiJV0vtj55DqTYiWz87pMVCZ59pWJz8pDAvrjmBpNy4sE2c3z9TxRL_92qWI15iFkialEXT6NH29qTuiHYnfAffe8Yl0NM61aIzyrSMHcPc19L4yUElJXI8Om2qbluM5aia983VudopydqY44fctz-mcfqzDq--Lq9-XqEQk3KGh_DZ0sPvRYbeUYSbEympvKdqy83R-qLete80I-eSel23Ss1b-wnz_5m9aZ2afj9VyrJXyeUBM-585iVy2ReSQ0WBv34g7uSAtY2LFMdqk7qxh0TnDKV_JyJsuVePFhxPvxJyZrZDm-WAYIHJPaBg&response_mode=form_post&nonce=638580106116336992.Mjc4ZTAyYTUtMTA1MC00NWM0LWIwMDAtZTFkMWI1OTgyOTA0OWVmZDQwNjctMGRjYi00OThmLWFmYTItNThkMzU3ZTNmN2Fh&prompt=none&code_challenge=7JuYfZS3np5DkKthYUgtp9SeC5cVe4Nn73z4dwa7uTk&code_challenge_method=S256&x-client-SKU=ID_NET6_0&x-...	HTTP Parser: No favicon
Source: https://www.microsoft.com/store/buy/cartcount	HTTP Parser: No favicon
Source: https://www.microsoft.com/cascadeauth/account/silentauth?auth=None	HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=1372215b-3f9a-4aab-addd-707eabddda1f&redirect_uri=https%3a%2f%2fcopilot.microsoft.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%222454AD396FBA465FAA21B85152FB9F0F%22%7d	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/oauth20_authorize.srf?client_id=10fa57ef-4895-4ab2-872c-8c3613d4f7fb&scope=openid+profile+offline_access&redirect_uri=https%3a%2f%2fwww.microsoft.com%2fcascadeauth%2faccount%2fsignin-oidc&response_type=code&state=CfDJ8GIDTS11_mxJlLbEvLbfH9NfsH_gXXHiOvUwDKCDNmlM7ZSuQ27hGqkGLLr1RPLKcMipa8Y8_PCdDhwRUCQsmNoyNDFzdODvYNNDOvkMTVYiIkwlMkhsioHEXXQPIFR_ENzGrhLZF6V-JB2vCItkksh9U_ubLA1kXYRotprKE82XNpMD6eI0xzDZtpC9FoJnQCMMiJV0vtj55DqTYiWz87pMVCZ59pWJz8pDAvrjmBpNy4sE2c3z9TxRL_92qWI15iFkialEXT6NH29qTuiHYnfAffe8Yl0NM61aIzyrSMHcPc19L4yUElJXI8Om2qbluM5aia983VudopydqY44fctz-mcfqzDq--Lq9-XqEQk3KGh_DZ0sPvRYbeUYSbEympvKdqy83R-qLete80I-eSel23Ss1b-wnz_5m9aZ2afj9VyrJXyeUBM-585iVy2ReSQ0WBv34g7uSAtY2LFMdqk7qxh0TnDKV_JyJsuVePFhxPvxJyZrZDm-WAYIHJPaBg&response_mode=form_post&nonce=638580106116336992.Mjc4ZTAyYTUtMTA1MC00NWM0LWIwMDAtZTFkMWI1OTgyOTA0OWVmZDQwNjctMGRjYi00OThmLWFmYTItNThkMzU3ZTNmN2Fh&prompt=none&code_challenge=7JuYfZS3np5DkKthYUgtp9SeC5cVe4Nn73z4dwa7uTk&code_challenge_method=S256&x-client-SKU=ID_NET6_0&x-	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=1372215b-3f9a-4aab-addd-707eabddda1f&redirect_uri=https%3a%2f%2fcopilot.microsoft.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%222454AD396FBA465FAA21B85152FB9F0F%22%7d	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/oauth20_authorize.srf?client_id=10fa57ef-4895-4ab2-872c-8c3613d4f7fb&scope=openid+profile+offline_access&redirect_uri=https%3a%2f%2fwww.microsoft.com%2fcascadeauth%2faccount%2fsignin-oidc&response_type=code&state=CfDJ8GIDTS11_mxJlLbEvLbfH9NfsH_gXXHiOvUwDKCDNmlM7ZSuQ27hGqkGLLr1RPLKcMipa8Y8_PCdDhwRUCQsmNoyNDFzdODvYNNDOvkMTVYiIkwlMkhsioHEXXQPIFR_ENzGrhLZF6V-JB2vCItkksh9U_ubLA1kXYRotprKE82XNpMD6eI0xzDZtpC9FoJnQCMMiJV0vtj55DqTYiWz87pMVCZ59pWJz8pDAvrjmBpNy4sE2c3z9TxRL_92qWI15iFkialEXT6NH29qTuiHYnfAffe8Yl0NM61aIzyrSMHcPc19L4yUElJXI8Om2qbluM5aia983VudopydqY44fctz-mcfqzDq--Lq9-XqEQk3KGh_DZ0sPvRYbeUYSbEympvKdqy83R-qLete80I-eSel23Ss1b-wnz_5m9aZ2afj9VyrJXyeUBM-585iVy2ReSQ0WBv34g7uSAtY2LFMdqk7qxh0TnDKV_JyJsuVePFhxPvxJyZrZDm-WAYIHJPaBg&response_mode=form_post&nonce=638580106116336992.Mjc4ZTAyYTUtMTA1MC00NWM0LWIwMDAtZTFkMWI1OTgyOTA0OWVmZDQwNjctMGRjYi00OThmLWFmYTItNThkMzU3ZTNmN2Fh&prompt=none&code_challenge=7JuYfZS3np5DkKthYUgtp9SeC5cVe4Nn73z4dwa7uTk&code_challenge_method=S256&x-client-SKU=ID_NET6_0&x-...	HTTP Parser: No <meta name="copyright".. found

Source: Joe Sandbox View	IP Address: 13.107.246.42 13.107.246.42
Source: Joe Sandbox View	IP Address: 18.66.102.98 18.66.102.98
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45

Source: chromecache_792.10.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/sharer/sharer.php?m2w\u0026s\u003d100\u0026u\u003dhttps://www.microsoft.com/en-us/surface/home","https://twitter.com/share?url\u003dhttps://www.microsoft.com/en-us/surface/home","https://www.linkedin.com/cws/share?url\u003dhttps://www.microsoft.com/en-us/surface/home"] equals www.facebook.com (Facebook)
Source: chromecache_792.10.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/sharer/sharer.php?m2w\u0026s\u003d100\u0026u\u003dhttps://www.microsoft.com/en-us/surface/home","https://twitter.com/share?url\u003dhttps://www.microsoft.com/en-us/surface/home","https://www.linkedin.com/cws/share?url\u003dhttps://www.microsoft.com/en-us/surface/home"] equals www.linkedin.com (Linkedin)
Source: chromecache_792.10.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/sharer/sharer.php?m2w\u0026s\u003d100\u0026u\u003dhttps://www.microsoft.com/en-us/surface/home","https://twitter.com/share?url\u003dhttps://www.microsoft.com/en-us/surface/home","https://www.linkedin.com/cws/share?url\u003dhttps://www.microsoft.com/en-us/surface/home"] equals www.twitter.com (Twitter)
Source: chromecache_792.10.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/surface","https://www.twitter.com/surface","https://www.instagram.com/surface","https://www.linkedin.com/showcase/microsoft-surface"] equals www.facebook.com (Facebook)
Source: chromecache_792.10.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/surface","https://www.twitter.com/surface","https://www.instagram.com/surface","https://www.linkedin.com/showcase/microsoft-surface"] equals www.linkedin.com (Linkedin)
Source: chromecache_792.10.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/surface","https://www.twitter.com/surface","https://www.instagram.com/surface","https://www.linkedin.com/showcase/microsoft-surface"] equals www.twitter.com (Twitter)
Source: chromecache_792.10.dr	String found in binary or memory: <a class="d-inline-block action-trigger" href="https://twitter.com/share?url=https://www.microsoft.com/en-us/surface/home" target="_blank" aria-label="Share this page on Twitter" data-bi-ecn="SHARE MICROSOFT SURFACE ON TWITTER" data-bi-bhvr="126" data-bi-cn="Share this page on Twitter" data-bi-socchn="Share this page on Twitter" data-bi-ct="Social Button" data-bi-pa="body" data-bi-compnm="Social Follow - horizontal"> equals www.twitter.com (Twitter)
Source: chromecache_792.10.dr	String found in binary or memory: <a class="d-inline-block action-trigger" href="https://www.facebook.com/sharer/sharer.php?m2w&s=100&u=https://www.microsoft.com/en-us/surface/home" target="_blank" aria-label="Share this page on Facebook" data-bi-ecn="SHARE MICROSOFT SURFACE ON FACEBOOK" data-bi-bhvr="126" data-bi-cn="Share this page on Facebook" data-bi-socchn="Share this page on Facebook" data-bi-ct="Social Button" data-bi-pa="body" data-bi-compnm="Social Follow - horizontal"> equals www.facebook.com (Facebook)
Source: chromecache_792.10.dr	String found in binary or memory: <a class="d-inline-block action-trigger" href="https://www.facebook.com/surface" target="_blank" aria-label="Follow this page on Facebook" data-bi-ecn="FOLLOW MICROSOFT SURFACE ON FACEBOOK" data-bi-bhvr="126" data-bi-cn="Follow this page on Facebook" data-bi-socchn="Follow this page on Facebook" data-bi-ct="Social Button" data-bi-pa="body" data-bi-compnm="Social Follow - horizontal"> equals www.facebook.com (Facebook)
Source: chromecache_792.10.dr	String found in binary or memory: <a class="d-inline-block action-trigger" href="https://www.linkedin.com/cws/share?url=https://www.microsoft.com/en-us/surface/home" target="_blank" aria-label="Share this page on LinkedIn" data-bi-ecn="SHARE MICROSOFT SURFACE ON LINKEDIN" data-bi-bhvr="126" data-bi-cn="Share this page on LinkedIn" data-bi-socchn="Share this page on LinkedIn" data-bi-ct="Social Button" data-bi-pa="body" data-bi-compnm="Social Follow - horizontal"> equals www.linkedin.com (Linkedin)
Source: chromecache_792.10.dr	String found in binary or memory: <a class="d-inline-block action-trigger" href="https://www.linkedin.com/showcase/microsoft-surface" target="_blank" aria-label="Follow this page on LinkedIn" data-bi-ecn="FOLLOW MICROSOFT SURFACE ON LINKEDIN" data-bi-bhvr="126" data-bi-cn="Follow this page on LinkedIn" data-bi-socchn="Follow this page on LinkedIn" data-bi-ct="Social Button" data-bi-pa="body" data-bi-compnm="Social Follow - horizontal"> equals www.linkedin.com (Linkedin)
Source: chromecache_792.10.dr	String found in binary or memory: <a class="d-inline-block action-trigger" href="https://www.twitter.com/surface" target="_blank" aria-label="Follow this page on Twitter" data-bi-ecn="FOLLOW MICROSOFT SURFACE ON TWITTER" data-bi-bhvr="126" data-bi-cn="Follow this page on Twitter" data-bi-socchn="Follow this page on Twitter" data-bi-ct="Social Button" data-bi-pa="body" data-bi-compnm="Social Follow - horizontal"> equals www.twitter.com (Twitter)
Source: chromecache_867.10.dr	String found in binary or memory: (function() { var sharingGlobalConfig ={"thumbnailUrlFormat":"https://www.bing.com/th?id={0}","defaultFormCode":"EX0023","facebookShareFormat":"https://www.facebook.com/dialog/feed?app_id={3}\u0026display=popup\u0026link={0}\u0026redirect_uri={1}\u0026ref={2}","facebookMessengerUrlFormat":"http://www.facebook.com/dialog/send?app_id={0}\u0026display=popup\u0026link={1}\u0026redirect_uri={2}","facebookFormCode":"EX0023","fbInitialHeight":576,"fbmInitialWidth":640,"facebookAppId":"3732605936979161","twitterApi":"https://twitter.com/intent/tweet?hashtags={0}\u0026text={1}\u0026url={2}","twitterFormCode":"EX0024","twitterInitialHeight":576,"twitterInitialWidth":720,"defaultInitialHeight":255,"whatsAppSchema":"whatsapp://send?text={0}","whatsAppStoreUrl":"","whatsAppFormCode":"EX0053","mailLauncherUrl":"mailto:?subject={0} \u0026body={1}","mailFormCode":"EX0025","smsProtocol":"","smsFormCode":"EX0052","loadingUrl":"/loading","useBlankLoadingPage":false,"closeRedirectUrl":"/share/fbre","pinterestUrlFormat":"https://pinterest.com/pin/create/button/?url={0}\u0026media={1}\u0026description={2}","pinterestFormCode":"EX0051","mybingFormCode":"shtomb","mybingRedirectUrl":"https://www.bing.com/myprofile?tid=id_chatmessagetab\u0026FORM=shtomb","skypeUrlFormat":"https://web.skype.com/share?url={0}\u0026source=button\u0026text={1}","skypeInitialHeight":665,"skypeInitialWidth":305,"outlookComLauncherUrl":"https://outlook.live.com/owa/?subject={0}\u0026body={1}\u0026path=/mail/action/compose","gmailLauncherUrl":"https://mail.google.com/mail/?view=cm\u0026fs=1\u0026tf=1\u0026su={0}\u0026body={1}","linkedInUrlFormat":"https://www.linkedin.com/shareArticle?mini=true\u0026url={0}\u0026title={1}\u0026summary={2}","linkedInFormCode":"EX0062","oneNoteUrlFormat":"https://www.onenote.com/clipper/save?attributionUrl={0}\u0026sourceUrl={1}\u0026imgUrl={1}\u0026title={2}\u0026description={3}","oneNoteInitialHeight":565,"oneNoteInitialWidth":550,"oneNoteFormCode":"EX0060","checkAppInstall":"","checkAppTimeout":200,"weiboShareFormat":"https://service.weibo.com/share/share.php?title={0}\u0026placeholder=Bing\u0026url={1}\u0026pic={2}","weiboFormCode":"SHDLWE","qzoneShareFormat":"https://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?title={0}\u0026summary={1}\u0026url={2}\u0026pics={3}","qzoneFormCode":"SHDLQZ","isCNEnglishSearch":false,"redditShareFormat":"https://www.reddit.com/submit?url={0}\u0026title={1}","redditFormCode":"EX0061","useLocationReplace":false,"getUrlFormCode":"EX0050","enableGetShareLinkFromServerForGetUrl":true,"isUnderside":false}; if(sj_evt) { sj_evt.fire("GlobalActionMenuV2Wrapper.InitSharingGlobalConfig", sharingGlobalConfig); } })();; equals www.facebook.com (Facebook)
Source: chromecache_1239.10.dr, chromecache_867.10.dr	String found in binary or memory: (function() { var sharingGlobalConfig ={"thumbnailUrlFormat":"https://www.bing.com/th?id={0}","defaultFormCode":"EX0023","facebookShareFormat":"https://www.facebook.com/dialog/feed?app_id={3}\u0026display=popup\u0026link={0}\u0026redirect_uri={1}\u0026ref={2}","facebookMessengerUrlFormat":"http://www.facebook.com/dialog/send?app_id={0}\u0026display=popup\u0026link={1}\u0026redirect_uri={2}","facebookFormCode":"EX0023","fbInitialHeight":576,"fbmInitialWidth":640,"facebookAppId":"3732605936979161","twitterApi":"https://twitter.com/intent/tweet?hashtags={0}\u0026text={1}\u0026url={2}","twitterFormCode":"EX0024","twitterInitialHeight":576,"twitterInitialWidth":720,"defaultInitialHeight":255,"whatsAppSchema":"whatsapp://send?text={0}","whatsAppStoreUrl":"","whatsAppFormCode":"EX0053","mailLauncherUrl":"mailto:?subject={0} \u0026body={1}","mailFormCode":"EX0025","smsProtocol":"","smsFormCode":"EX0052","loadingUrl":"/loading","useBlankLoadingPage":false,"closeRedirectUrl":"/share/fbre","pinterestUrlFormat":"https://pinterest.com/pin/create/button/?url={0}\u0026media={1}\u0026description={2}","pinterestFormCode":"EX0051","mybingFormCode":"shtomb","mybingRedirectUrl":"https://www.bing.com/myprofile?tid=id_chatmessagetab\u0026FORM=shtomb","skypeUrlFormat":"https://web.skype.com/share?url={0}\u0026source=button\u0026text={1}","skypeInitialHeight":665,"skypeInitialWidth":305,"outlookComLauncherUrl":"https://outlook.live.com/owa/?subject={0}\u0026body={1}\u0026path=/mail/action/compose","gmailLauncherUrl":"https://mail.google.com/mail/?view=cm\u0026fs=1\u0026tf=1\u0026su={0}\u0026body={1}","linkedInUrlFormat":"https://www.linkedin.com/shareArticle?mini=true\u0026url={0}\u0026title={1}\u0026summary={2}","linkedInFormCode":"EX0062","oneNoteUrlFormat":"https://www.onenote.com/clipper/save?attributionUrl={0}\u0026sourceUrl={1}\u0026imgUrl={1}\u0026title={2}\u0026description={3}","oneNoteInitialHeight":565,"oneNoteInitialWidth":550,"oneNoteFormCode":"EX0060","checkAppInstall":"","checkAppTimeout":200,"weiboShareFormat":"https://service.weibo.com/share/share.php?title={0}\u0026placeholder=Bing\u0026url={1}\u0026pic={2}","weiboFormCode":"SHDLWE","qzoneShareFormat":"https://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?title={0}\u0026summary={1}\u0026url={2}\u0026pics={3}","qzoneFormCode":"SHDLQZ","isCNEnglishSearch":false,"redditShareFormat":"https://www.reddit.com/submit?url={0}\u0026title={1}","redditFormCode":"EX0061","useLocationReplace":false,"getUrlFormCode":"EX0050","enableGetShareLinkFromServerForGetUrl":true,"isUnderside":false}; if(sj_evt) { sj_evt.fire("GlobalActionMenuV2Wrapper.InitSharingGlobalConfig", sharingGlobalConfig); } })();; equals www.linkedin.com (Linkedin)
Source: chromecache_1239.10.dr, chromecache_867.10.dr	String found in binary or memory: (function() { var sharingGlobalConfig ={"thumbnailUrlFormat":"https://www.bing.com/th?id={0}","defaultFormCode":"EX0023","facebookShareFormat":"https://www.facebook.com/dialog/feed?app_id={3}\u0026display=popup\u0026link={0}\u0026redirect_uri={1}\u0026ref={2}","facebookMessengerUrlFormat":"http://www.facebook.com/dialog/send?app_id={0}\u0026display=popup\u0026link={1}\u0026redirect_uri={2}","facebookFormCode":"EX0023","fbInitialHeight":576,"fbmInitialWidth":640,"facebookAppId":"3732605936979161","twitterApi":"https://twitter.com/intent/tweet?hashtags={0}\u0026text={1}\u0026url={2}","twitterFormCode":"EX0024","twitterInitialHeight":576,"twitterInitialWidth":720,"defaultInitialHeight":255,"whatsAppSchema":"whatsapp://send?text={0}","whatsAppStoreUrl":"","whatsAppFormCode":"EX0053","mailLauncherUrl":"mailto:?subject={0} \u0026body={1}","mailFormCode":"EX0025","smsProtocol":"","smsFormCode":"EX0052","loadingUrl":"/loading","useBlankLoadingPage":false,"closeRedirectUrl":"/share/fbre","pinterestUrlFormat":"https://pinterest.com/pin/create/button/?url={0}\u0026media={1}\u0026description={2}","pinterestFormCode":"EX0051","mybingFormCode":"shtomb","mybingRedirectUrl":"https://www.bing.com/myprofile?tid=id_chatmessagetab\u0026FORM=shtomb","skypeUrlFormat":"https://web.skype.com/share?url={0}\u0026source=button\u0026text={1}","skypeInitialHeight":665,"skypeInitialWidth":305,"outlookComLauncherUrl":"https://outlook.live.com/owa/?subject={0}\u0026body={1}\u0026path=/mail/action/compose","gmailLauncherUrl":"https://mail.google.com/mail/?view=cm\u0026fs=1\u0026tf=1\u0026su={0}\u0026body={1}","linkedInUrlFormat":"https://www.linkedin.com/shareArticle?mini=true\u0026url={0}\u0026title={1}\u0026summary={2}","linkedInFormCode":"EX0062","oneNoteUrlFormat":"https://www.onenote.com/clipper/save?attributionUrl={0}\u0026sourceUrl={1}\u0026imgUrl={1}\u0026title={2}\u0026description={3}","oneNoteInitialHeight":565,"oneNoteInitialWidth":550,"oneNoteFormCode":"EX0060","checkAppInstall":"","checkAppTimeout":200,"weiboShareFormat":"https://service.weibo.com/share/share.php?title={0}\u0026placeholder=Bing\u0026url={1}\u0026pic={2}","weiboFormCode":"SHDLWE","qzoneShareFormat":"https://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?title={0}\u0026summary={1}\u0026url={2}\u0026pics={3}","qzoneFormCode":"SHDLQZ","isCNEnglishSearch":false,"redditShareFormat":"https://www.reddit.com/submit?url={0}\u0026title={1}","redditFormCode":"EX0061","useLocationReplace":false,"getUrlFormCode":"EX0050","enableGetShareLinkFromServerForGetUrl":true,"isUnderside":false}; if(sj_evt) { sj_evt.fire("GlobalActionMenuV2Wrapper.InitSharingGlobalConfig", sharingGlobalConfig); } })();; equals www.twitter.com (Twitter)
Source: chromecache_1031.10.dr	String found in binary or memory: return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(a){var b=new URL(a);b=b.hostname.endsWith(".facebook.com")&&b.pathname=="/signals/iwl.js";if(!b)throw new Error("Disallowed script URL");return a}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_1031.10.dr	String found in binary or memory: return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_1031.10.dr	String found in binary or memory: return function(f,g,h,i){var j={exports:{}};j.exports;(function(){"use strict";var a={ENDPOINT:"https://www.facebook.com/tr/",INSTAGRAM_TRIGGER_ATTRIBUTION:"https://www.instagram.com/tr/",AEM_ENDPOINT:"https://www.facebook.com/.well-known/aggregated-event-measurement/",GPS_ENDPOINT:"https://www.facebook.com/privacy_sandbox/pixel/register/trigger/"};j.exports=a})();return j.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)

Source: chromecache_1078.10.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_866.10.dr, chromecache_1151.10.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: chromecache_685.10.dr, chromecache_792.10.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_1325.10.dr, chromecache_1038.10.dr, chromecache_1342.10.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_773.10.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: chromecache_792.10.dr	String found in binary or memory: https://2e6ce2ab2870e62cb4620de77fa717.1b.environment.api.powerplatform.com/powervirtualagents/botsb
Source: chromecache_685.10.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
Source: chromecache_792.10.dr	String found in binary or memory: https://aka.ms/KeySupport
Source: chromecache_792.10.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_736.10.dr	String found in binary or memory: https://api.company-target.com/api/v2/ip.json?key=70aff8023e038d56ea636f68e5c5922b
Source: chromecache_972.10.dr, chromecache_715.10.dr	String found in binary or memory: https://api.onedrive.com/inappmessaging/v1/messages
Source: chromecache_760.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RC41f734c2179b4d00846945b0cfa3afc
Source: chromecache_789.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RC4eca6d570e2d4f919d49e225bf4ba06
Source: chromecache_949.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RC6748f5eec85041a7b8ee9604dc3252f
Source: chromecache_1002.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RC76581c113f0946488673bcaeca24b72
Source: chromecache_673.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RC78870d1e7c7c41c8aff3132202d3668
Source: chromecache_963.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RC8dac0e603b784cc98512fa2cc05157b
Source: chromecache_1115.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RC94654658f4b44b62b99fffadbedb572
Source: chromecache_690.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RCbb43ab0df0dc49d88347b60b3b8cda8
Source: chromecache_1244.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RCdc5dfc7e9fe0429fb792428307bc538
Source: chromecache_1202.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RCf07f548ff3904e6aae2cc165a2846cf
Source: chromecache_1055.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RCf45be8e1e9f44c998e8838d62a6d847
Source: chromecache_651.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RCf9d4fd36645544efa0585a0aa842070
Source: chromecache_956.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RCfa369b9143484cedad051491c3008a7
Source: chromecache_764.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RCfcde619ed7cf405ea5c6a7dad8eed27
Source: chromecache_792.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/launch-EN7506e353034849faa4a18bc4c20e727c.min.
Source: chromecache_1254.10.dr, chromecache_1141.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/e6b4ca74378c/1d3e0e32d7b0/RC355448c6d3834d9fba0c2ccbf9a8ae1
Source: chromecache_1333.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/e6b4ca74378c/1d3e0e32d7b0/RC35e4a1f0d3004449843265f8ca658f8
Source: chromecache_1119.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/e6b4ca74378c/1d3e0e32d7b0/RC5dfb7683390e4ce4adc35c15e5af254
Source: chromecache_1049.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/e6b4ca74378c/1d3e0e32d7b0/RC60d8da8de9104095af71971521df199
Source: chromecache_1012.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/e6b4ca74378c/1d3e0e32d7b0/RC80124a8a463144529d78fa07ef2f18c
Source: chromecache_1255.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/e6b4ca74378c/1d3e0e32d7b0/RC8c957989c33d47e7a8ba18f7ec8dd93
Source: chromecache_838.10.dr, chromecache_840.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/e6b4ca74378c/1d3e0e32d7b0/RC93f13680e05d408ab467967b05045a7
Source: chromecache_812.10.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/e6b4ca74378c/1d3e0e32d7b0/RC9f989b7d1558417facc059918f89cba
Source: chromecache_1358.10.dr	String found in binary or memory: https://assets.adobedtm.com/launch-ENbb9d0de7cc374dc99259df2c4b823cef.js
Source: chromecache_685.10.dr	String found in binary or memory: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c
Source: chromecache_1090.10.dr, chromecache_956.10.dr	String found in binary or memory: https://ats.everesttech.net/ats/ats?cmd=RT&AdvertiserID=4249&platform=TUMRI&ActionID=20114&ActionNam
Source: chromecache_824.10.dr, chromecache_1262.10.dr	String found in binary or memory: https://axios-http.com
Source: chromecache_1001.10.dr	String found in binary or memory: https://breeze.aimon.applicationinsights.io
Source: chromecache_952.10.dr	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=12681
Source: chromecache_952.10.dr	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=3334
Source: chromecache_952.10.dr	String found in binary or memory: https://bugzil.la/548397
Source: chromecache_952.10.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=277178
Source: chromecache_952.10.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=308064
Source: chromecache_792.10.dr	String found in binary or memory: https://cdn.botframework.com/botframework-webchat/latest/webchat.js
Source: chromecache_792.10.dr	String found in binary or memory: https://cdnssl.clicktale.net/www32/ptc/05d32363-d534-4d93-9b65-cde674775e71.js
Source: chromecache_1031.10.dr	String found in binary or memory: https://connect.facebook.net/
Source: chromecache_1031.10.dr	String found in binary or memory: https://connect.facebook.net/log/fbevents_telemetry/
Source: chromecache_1001.10.dr	String found in binary or memory: https://dc-int.services.visualstudio.com
Source: chromecache_1001.10.dr	String found in binary or memory: https://dc.services.visualstudio.com
Source: chromecache_952.10.dr	String found in binary or memory: https://dev.azure.com/mscomdev/Moray/_workitems/edit/4494
Source: chromecache_952.10.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent/key/Key_Values
Source: chromecache_1083.10.dr	String found in binary or memory: https://dynmsg.modpim.com/
Source: chromecache_952.10.dr	String found in binary or memory: https://elad.medium.com/css-position-sticky-how-it-really-works-54cd01dc2d46
Source: chromecache_1185.10.dr, chromecache_937.10.dr	String found in binary or memory: https://g.live.com/8SESkyDrive/SkyDriveApps?biciid=lhnlink
Source: chromecache_1266.10.dr	String found in binary or memory: https://gethatch.com/?utm_source
Source: chromecache_1266.10.dr	String found in binary or memory: https://gethatch.com/resources/images/hatch-logo.svg
Source: chromecache_824.10.dr, chromecache_1262.10.dr	String found in binary or memory: https://github.com/axios/axios.git
Source: chromecache_824.10.dr, chromecache_1262.10.dr	String found in binary or memory: https://github.com/axios/axios/issues
Source: chromecache_1159.10.dr	String found in binary or memory: https://github.com/carhartl/jquery-cookie
Source: chromecache_952.10.dr	String found in binary or memory: https://github.com/es-shims/es5-shim/issues/150
Source: chromecache_952.10.dr	String found in binary or memory: https://github.com/kitcambridge/es5-shim/commit/4f738ac066346
Source: chromecache_917.10.dr, chromecache_655.10.dr	String found in binary or memory: https://github.com/microsoft/BotFramework-WebChat/blob/main/packages/api/src/defaultStyleOptions.ts
Source: chromecache_1226.10.dr	String found in binary or memory: https://github.com/microsoft/BotFramework-WebChat/issues/2119
Source: chromecache_1074.10.dr	String found in binary or memory: https://github.com/microsoft/clarity
Source: chromecache_952.10.dr	String found in binary or memory: https://github.com/mozilla/rhino/issues/346
Source: chromecache_1325.10.dr, chromecache_1038.10.dr	String found in binary or memory: https://github.com/scottjehl/picturefill/blob/master/Authors.txt;
Source: chromecache_952.10.dr	String found in binary or memory: https://github.com/tc39/proposal-array-filtering
Source: chromecache_1401.10.dr, chromecache_1148.10.dr	String found in binary or memory: https://github.com/twbs/bootstrap/issues/24093
Source: chromecache_1140.10.dr	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: chromecache_952.10.dr	String found in binary or memory: https://github.com/w3c/aria-practices/pull/1757
Source: chromecache_952.10.dr	String found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_952.10.dr	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.26.0/LICENSE
Source: chromecache_952.10.dr	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.27.2/LICENSE
Source: chromecache_952.10.dr	String found in binary or memory: https://github.com/zloirock/core-js/issues/1128
Source: chromecache_952.10.dr	String found in binary or memory: https://github.com/zloirock/core-js/issues/1130
Source: chromecache_952.10.dr	String found in binary or memory: https://github.com/zloirock/core-js/issues/475
Source: chromecache_952.10.dr	String found in binary or memory: https://github.com/zloirock/core-js/issues/677
Source: chromecache_952.10.dr	String found in binary or memory: https://github.com/zloirock/core-js/issues/86#issuecomment-115759028
Source: chromecache_1090.10.dr, chromecache_956.10.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/923371515/?guid=ON&script=0&url=
Source: chromecache_1136.10.dr	String found in binary or memory: https://highlightjs.org/
Source: chromecache_792.10.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: chromecache_1090.10.dr, chromecache_956.10.dr	String found in binary or memory: https://insight.adsrvr.org/track/pxl/?adv=swsyprl&ct=0:
Source: chromecache_952.10.dr	String found in binary or memory: https://javascript.info/size-and-scroll-window#width-height-of-the-document
Source: chromecache_952.10.dr	String found in binary or memory: https://keycode.info/table-of-all-keycodes
Source: chromecache_637.10.dr	String found in binary or memory: https://login.chinacloudapi.cn
Source: chromecache_914.10.dr	String found in binary or memory: https://login.live.com/Me.srf?wa
Source: chromecache_792.10.dr	String found in binary or memory: https://login.live.com/me.srf?wa=wsignin1.0
Source: chromecache_637.10.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_914.10.dr	String found in binary or memory: https://login.microsoftonline.com/forgetuser
Source: chromecache_914.10.dr	String found in binary or memory: https://login.microsoftonline.com/savedusers?appid
Source: chromecache_914.10.dr	String found in binary or memory: https://login.microsoftonline.com/uxlogout?appid
Source: chromecache_637.10.dr	String found in binary or memory: https://login.microsoftonline.de
Source: chromecache_637.10.dr	String found in binary or memory: https://login.microsoftonline.us
Source: chromecache_637.10.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_1083.10.dr	String found in binary or memory: https://messaging-int.msonerm.com/
Source: chromecache_824.10.dr, chromecache_1262.10.dr	String found in binary or memory: https://microsoftit.pkgs.visualstudio.com/OneITVSO/_packaging/CSM-SITES-AEMFoundations/npm/registry/
Source: chromecache_1325.10.dr, chromecache_1038.10.dr	String found in binary or memory: https://modernizr.com/download/?-eventlistener-picture-printshiv-setclasses
Source: chromecache_972.10.dr, chromecache_715.10.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: chromecache_1147.10.dr, chromecache_708.10.dr	String found in binary or memory: https://onedrive.live.com/?id=
Source: chromecache_1147.10.dr, chromecache_708.10.dr	String found in binary or memory: https://onedrive.live.com/edit.aspx?resid=
Source: chromecache_869.10.dr	String found in binary or memory: https://outlook.office.com/search
Source: chromecache_972.10.dr, chromecache_715.10.dr	String found in binary or memory: https://portal.office.com/
Source: chromecache_990.10.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_965.10.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_1396.10.dr, chromecache_990.10.dr	String found in binary or memory: https://res-1.cdn.office.net/files/fabric-cdn-prod_20230815.002/assets
Source: chromecache_915.10.dr, chromecache_612.10.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-07-19.005/
Source: chromecache_915.10.dr, chromecache_612.10.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-07-19.005/spwebworker.js
Source: chromecache_1090.10.dr, chromecache_956.10.dr	String found in binary or memory: https://s-vop.sundaysky.com/t/v1/img?a=microsoft&ap=1&pb=f&sp=
Source: chromecache_956.10.dr	String found in binary or memory: https://s-vop.sundaysky.com/t/v1/img?a=microsoft&cb=
Source: chromecache_792.10.dr	String found in binary or memory: https://schema.org
Source: chromecache_1325.10.dr, chromecache_1038.10.dr	String found in binary or memory: https://scottjehl.github.io/picturefill/
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-semili
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semibold
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold
Source: chromecache_1286.10.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semiligh
Source: chromecache_685.10.dr	String found in binary or memory: https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css?c=7
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot-aec
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-array.prototype-
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-array.prototype.every
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-array.prototype.filter
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-array.prototype.find
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-array.prototype.findIndex
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-array.prototype.foreach
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-array.prototype.includes
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-array.prototype.indexof
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-array.prototype.map
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-array.prototype.push
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-array.prototype.some
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-array.prototype.splice
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-arrayspeciescreate
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-getmethod
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-hasownproperty
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-isarray
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-iscallable
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-isconstructor
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-isregexp
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-lengthofarraylike
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-math.trunc
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-object.create
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-object.defineproperties
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-object.defineproperty
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-object.entries
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-object.getownpropertydescriptor
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-object.getownpropertynames
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-object.keys
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-object.prototype.propertyisenumerable
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-object.prototype.tostring
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-object.values
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-ordinarytoprimitive
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-parseint-string-radix
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-requireobjectcoercible
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-string.prototype.includes
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-string.prototype.trim
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-string.prototype.trimend
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-string.prototype.trimstart
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-tointegerorinfinity
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-tolength
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-toobject
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-toprimitive
Source: chromecache_952.10.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-topropertykey
Source: chromecache_919.10.dr	String found in binary or memory: https://www.clarity.ms/tag/uet/
Source: chromecache_792.10.dr	String found in binary or memory: https://www.instagram.com/surface
Source: chromecache_792.10.dr	String found in binary or memory: https://www.linkedin.com/showcase/microsoft-surface
Source: chromecache_965.10.dr	String found in binary or memory: https://www.onedrive-tst.com
Source: chromecache_792.10.dr	String found in binary or memory: https://www.skype.com/en/
Source: chromecache_698.10.dr	String found in binary or memory: https://www.suno.ai/privacy)
Source: chromecache_698.10.dr	String found in binary or memory: https://www.suno.ai/terms)
Source: chromecache_792.10.dr	String found in binary or memory: https://www.twitter.com/surface
Source: chromecache_792.10.dr	String found in binary or memory: https://www.xbox.com/
Source: chromecache_792.10.dr	String found in binary or memory: https://www.xbox.com/en-us/games/store/pc-game-pass/cfq7ttc0kgq8?icid=CNavAllPCGamePass
Source: chromecache_792.10.dr	String found in binary or memory: https://www.xbox.com/en-us/games/store/xbox-game-pass-ultimate/cfq7ttc0khs0?icid=CNavAllXboxGamePass

Source: chromecache_895.10.dr	OLE indicator, VBA macros: true
Source: chromecache_1384.10.dr	OLE indicator, VBA macros: true

Source: chromecache_895.10.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chromecache_1384.10.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal52.winPDF@59/1277@0/100

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-31 04-14-13-953.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Factura.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1508,i,10463332442722132192,14218185456690274382,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://1drv.ms/b/s!AhJ7ZeBT5ZMfgRYDYmTU0jSOiix8?e=QbMPnu"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=2004,i,4560367953723847233,243234883886843712,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6120 --field-trial-handle=2004,i,4560367953723847233,243234883886843712,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 --field-trial-handle=2004,i,4560367953723847233,243234883886843712,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1508,i,10463332442722132192,14218185456690274382,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=2004,i,4560367953723847233,243234883886843712,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6120 --field-trial-handle=2004,i,4560367953723847233,243234883886843712,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 --field-trial-handle=2004,i,4560367953723847233,243234883886843712,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Factura.pdf	Initial sample: PDF keyword /JS count = 0
Source: Factura.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: chromecache_1050.10.dr	Initial sample: PDF keyword /JS count = 0
Source: chromecache_1050.10.dr	Initial sample: PDF keyword /JavaScript count = 0
Source: chromecache_1163.10.dr	Initial sample: PDF keyword /JS count = 0
Source: chromecache_1163.10.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Factura.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Persistence and Installation Behavior

AI detected suspicious PDF

Source: PDF shot

LLM: Score: 9 Reasons: The screenshot contains a visually prominent 'Download' button, which is a common tactic used in phishing attacks to lure users into clicking. The text 'The file is not displayed correctly. Use local downloaded file.' creates a sense of urgency and necessity, pushing the user to click the button. Additionally, the use of the Adobe PDF logo can mislead users into thinking the file is legitimate, impersonating a well-known brand. The combination of urgency and the prominent button significantly increases the risk of phishing or malware download.

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 1050
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 1163	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 1050	Jump to dropped file

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: chromecache_1147.10.dr, chromecache_708.10.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_1147.10.dr, chromecache_708.10.dr	Binary or memory string: ",DisconnectVirtualMachine:"

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Source	Detection	Scanner	Label	Link
https://tc39.es/ecma262/#sec-object.getownpropertydescriptor	0%	URL Reputation	safe
https://tc39.es/ecma262/#sec-tointegerorinfinity	0%	URL Reputation	safe
https://tc39.es/ecma262/#sec-getmethod	0%	URL Reputation	safe
https://www.skype.com/en/	0%	URL Reputation	safe
https://schema.org	0%	URL Reputation	safe
https://connect.facebook.net/	0%	URL Reputation	safe
https://tc39.es/ecma262/#sec-tolength	0%	URL Reputation	safe
https://tc39.es/ecma262/#sec-array.prototype-	0%	URL Reputation	safe
https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot	0%	URL Reputation	safe
https://www.clarity.ms/tag/uet/	0%	URL Reputation	safe
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js	0%	URL Reputation	safe
https://login.windows-ppe.net	0%	URL Reputation	safe
https://reactjs.org/link/react-polyfills	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
https://tc39.es/ecma262/#sec-object.keys	0%	URL Reputation	safe
https://tc39.es/ecma262/#sec-toprimitive	0%	URL Reputation	safe
https://github.com/mozilla/rhino/issues/346	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/uxlogout?appid	0%	Avira URL Cloud	safe
https://tc39.es/ecma262/#sec-arrayspeciescreate	0%	Avira URL Cloud	safe
https://tc39.es/ecma262/#sec-object.prototype.tostring	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff	0%	Avira URL Cloud	safe
https://www.suno.ai/privacy)	0%	Avira URL Cloud	safe
https://github.com/zloirock/core-js	0%	Avira URL Cloud	safe
https://tc39.es/ecma262/#sec-arrayspeciescreate	1%	Virustotal		Browse
https://tc39.es/ecma262/#sec-array.prototype.push	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff	0%	Virustotal		Browse
https://login.microsoftonline.com/uxlogout?appid	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w	0%	Avira URL Cloud	safe
https://tc39.es/ecma262/#sec-object.prototype.tostring	1%	Virustotal		Browse
about:blank	0%	Avira URL Cloud	safe
https://github.com/mozilla/rhino/issues/346	0%	Virustotal		Browse
https://bugs.chromium.org/p/v8/issues/detail?id=12681	0%	Avira URL Cloud	safe
https://github.com/zloirock/core-js	0%	Virustotal		Browse
https://github.com/tc39/proposal-array-filtering	0%	Avira URL Cloud	safe
https://login.microsoftonline.us	0%	Avira URL Cloud	safe
https://github.com/scottjehl/picturefill/blob/master/Authors.txt;	0%	Avira URL Cloud	safe
https://tc39.es/ecma262/#sec-array.prototype.push	1%	Virustotal		Browse
https://onedrive.live.com/edit.aspx?resid=	0%	Avira URL Cloud	safe
https://github.com/tc39/proposal-array-filtering	0%	Virustotal		Browse
https://login.microsoftonline.us	0%	Virustotal		Browse
https://github.com/scottjehl/picturefill/blob/master/Authors.txt;	0%	Virustotal		Browse
https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RC41f734c2179b4d00846945b0cfa3afc	0%	Avira URL Cloud	safe
https://onedrive.live.com/?id=	0%	Avira URL Cloud	safe
https://onedrive.live.com/edit.aspx?resid=	1%	Virustotal		Browse
https://aka.ms/KeySupport	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w	0%	Virustotal		Browse
https://bugs.chromium.org/p/v8/issues/detail?id=12681	0%	Virustotal		Browse
https://cdnssl.clicktale.net/www32/ptc/05d32363-d534-4d93-9b65-cde674775e71.js	0%	Avira URL Cloud	safe
https://onedrive.live.com/?id=	1%	Virustotal		Browse
https://aka.ms/KeySupport	0%	Virustotal		Browse
https://api.company-target.com/api/v2/ip.json?key=70aff8023e038d56ea636f68e5c5922b	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2	0%	Avira URL Cloud	safe
https://github.com/es-shims/es5-shim/issues/150	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo	0%	Virustotal		Browse
https://api.company-target.com/api/v2/ip.json?key=70aff8023e038d56ea636f68e5c5922b	0%	Virustotal		Browse
https://github.com/w3c/aria-practices/pull/1757	0%	Avira URL Cloud	safe
https://axios-http.com	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2	0%	Virustotal		Browse
https://github.com/microsoft/clarity	0%	Avira URL Cloud	safe
https://2e6ce2ab2870e62cb4620de77fa717.1b.environment.api.powerplatform.com/powervirtualagents/botsb	0%	Avira URL Cloud	safe
https://github.com/es-shims/es5-shim/issues/150	0%	Virustotal		Browse
https://cdnssl.clicktale.net/www32/ptc/05d32363-d534-4d93-9b65-cde674775e71.js	0%	Virustotal		Browse
https://assets.adobedtm.com/5ef092d1efb5/e6b4ca74378c/1d3e0e32d7b0/RC8c957989c33d47e7a8ba18f7ec8dd93	0%	Avira URL Cloud	safe
https://login.microsoftonline.de	100%	Avira URL Cloud	phishing
https://axios-http.com	0%	Virustotal		Browse
https://github.com/w3c/aria-practices/pull/1757	0%	Virustotal		Browse
https://s-vop.sundaysky.com/t/v1/img?a=microsoft&ap=1&pb=f&sp=	0%	Avira URL Cloud	safe
https://login.microsoftonline.de	1%	Virustotal		Browse
https://api.onedrive.com/inappmessaging/v1/messages	0%	Avira URL Cloud	safe
https://keycode.info/table-of-all-keycodes	0%	Avira URL Cloud	safe
https://github.com/microsoft/clarity	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff	0%	Avira URL Cloud	safe
https://s-vop.sundaysky.com/t/v1/img?a=microsoft&ap=1&pb=f&sp=	0%	Virustotal		Browse
https://my.microsoftpersonalcontent.com	0%	Avira URL Cloud	safe
https://api.onedrive.com/inappmessaging/v1/messages	0%	Virustotal		Browse
https://keycode.info/table-of-all-keycodes	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff	0%	Virustotal		Browse
https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RC76581c113f0946488673bcaeca24b72	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent/key/Key_Values	0%	Avira URL Cloud	safe
https://assets.adobedtm.com/5ef092d1efb5/e6b4ca74378c/1d3e0e32d7b0/RC93f13680e05d408ab467967b05045a7	0%	Avira URL Cloud	safe
https://www.linkedin.com/showcase/microsoft-surface	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent/key/Key_Values	0%	Virustotal		Browse
https://my.microsoftpersonalcontent.com	1%	Virustotal		Browse
https://tc39.es/ecma262/#sec-parseint-string-radix	0%	Avira URL Cloud	safe
https://tc39.es/ecma262/#sec-string.prototype.includes	0%	Avira URL Cloud	safe
https://www.linkedin.com/showcase/microsoft-surface	0%	Virustotal		Browse
https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RCbb43ab0df0dc49d88347b60b3b8cda8	0%	Avira URL Cloud	safe
https://github.com/zloirock/core-js/issues/1130	0%	Avira URL Cloud	safe
https://tc39.es/ecma262/#sec-parseint-string-radix	1%	Virustotal		Browse
https://tc39.es/ecma262/#sec-array.prototype.map	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/923371515/?guid=ON&script=0&url=	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2	0%	Avira URL Cloud	safe
https://s-vop.sundaysky.com/t/v1/img?a=microsoft&cb=	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff	0%	Virustotal		Browse
https://breeze.aimon.applicationinsights.io	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
https://onedrive.live.com/_forms/default.aspx?ReturnUrl=%2F%3Fid%3D1F93E553E0657B12%21150%26resid%3D1F93E553E0657B12%21150%26ithint%3Dfile%252cpdf%26authkey%3D%21AANiZNTSNI6KLHw%26cid%3D1f93e553e0657b12	false		unknown
about:blank	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/?authkey=%21AANiZNTSNI6KLHw&id=1F93E553E0657B12%21150&cid=1F93E553E0657B12&parId=root&parQt=sharedby&o=OneUp	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mozilla/rhino/issues/346	chromecache_952.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/uxlogout?appid	chromecache_914.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-object.prototype.tostring	chromecache_952.10.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-arrayspeciescreate	chromecache_952.10.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff	chromecache_1286.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.suno.ai/privacy)	chromecache_698.10.dr	false	Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-object.getownpropertydescriptor	chromecache_952.10.dr	false	URL Reputation: safe	unknown
https://github.com/zloirock/core-js	chromecache_952.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-array.prototype.push	chromecache_952.10.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w	chromecache_1286.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bugs.chromium.org/p/v8/issues/detail?id=12681	chromecache_952.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/tc39/proposal-array-filtering	chromecache_952.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://login.microsoftonline.us	chromecache_637.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/scottjehl/picturefill/blob/master/Authors.txt;	chromecache_1325.10.dr, chromecache_1038.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://onedrive.live.com/edit.aspx?resid=	chromecache_1147.10.dr, chromecache_708.10.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RC41f734c2179b4d00846945b0cfa3afc	chromecache_760.10.dr	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/?id=	chromecache_1147.10.dr, chromecache_708.10.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/KeySupport	chromecache_792.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-tointegerorinfinity	chromecache_952.10.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo	chromecache_1286.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdnssl.clicktale.net/www32/ptc/05d32363-d534-4d93-9b65-cde674775e71.js	chromecache_792.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2	chromecache_1286.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.company-target.com/api/v2/ip.json?key=70aff8023e038d56ea636f68e5c5922b	chromecache_736.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/es-shims/es5-shim/issues/150	chromecache_952.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/w3c/aria-practices/pull/1757	chromecache_952.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://axios-http.com	chromecache_824.10.dr, chromecache_1262.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/microsoft/clarity	chromecache_1074.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://2e6ce2ab2870e62cb4620de77fa717.1b.environment.api.powerplatform.com/powervirtualagents/botsb	chromecache_792.10.dr	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.de	chromecache_637.10.dr	false	1%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://assets.adobedtm.com/5ef092d1efb5/e6b4ca74378c/1d3e0e32d7b0/RC8c957989c33d47e7a8ba18f7ec8dd93	chromecache_1255.10.dr	false	Avira URL Cloud: safe	unknown
https://s-vop.sundaysky.com/t/v1/img?a=microsoft&ap=1&pb=f&sp=	chromecache_1090.10.dr, chromecache_956.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.onedrive.com/inappmessaging/v1/messages	chromecache_972.10.dr, chromecache_715.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://keycode.info/table-of-all-keycodes	chromecache_952.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff	chromecache_1286.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://my.microsoftpersonalcontent.com	chromecache_972.10.dr, chromecache_715.10.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-getmethod	chromecache_952.10.dr	false	URL Reputation: safe	unknown
https://www.skype.com/en/	chromecache_792.10.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.	chromecache_1286.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RC76581c113f0946488673bcaeca24b72	chromecache_1002.10.dr	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent/key/Key_Values	chromecache_952.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://assets.adobedtm.com/5ef092d1efb5/e6b4ca74378c/1d3e0e32d7b0/RC93f13680e05d408ab467967b05045a7	chromecache_838.10.dr, chromecache_840.10.dr	false	Avira URL Cloud: safe	unknown
https://schema.org	chromecache_792.10.dr	false	URL Reputation: safe	unknown
https://www.linkedin.com/showcase/microsoft-surface	chromecache_792.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff	chromecache_1286.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://connect.facebook.net/	chromecache_1031.10.dr	false	URL Reputation: safe	unknown
https://tc39.es/ecma262/#sec-parseint-string-radix	chromecache_952.10.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-string.prototype.includes	chromecache_952.10.dr	false	Avira URL Cloud: safe	unknown
https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RCbb43ab0df0dc49d88347b60b3b8cda8	chromecache_690.10.dr	false	Avira URL Cloud: safe	unknown
https://github.com/zloirock/core-js/issues/1130	chromecache_952.10.dr	false	Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-array.prototype.map	chromecache_952.10.dr	false	Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-tolength	chromecache_952.10.dr	false	URL Reputation: safe	unknown
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/923371515/?guid=ON&script=0&url=	chromecache_1090.10.dr, chromecache_956.10.dr	false	Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-array.prototype-	chromecache_952.10.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff	chromecache_1286.10.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2	chromecache_1286.10.dr	false	Avira URL Cloud: safe	unknown
https://s-vop.sundaysky.com/t/v1/img?a=microsoft&cb=	chromecache_956.10.dr	false	Avira URL Cloud: safe	unknown
https://breeze.aimon.applicationinsights.io	chromecache_1001.10.dr	false	Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot	chromecache_952.10.dr	false	URL Reputation: safe	unknown
https://tc39.es/ecma262/#sec-array.prototype.foreach	chromecache_952.10.dr	false	Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-string.prototype.trimstart	chromecache_952.10.dr	false	Avira URL Cloud: safe	unknown
https://github.com/zloirock/core-js/issues/677	chromecache_952.10.dr	false	Avira URL Cloud: safe	unknown
https://www.xbox.com/en-us/games/store/xbox-game-pass-ultimate/cfq7ttc0khs0?icid=CNavAllXboxGamePass	chromecache_792.10.dr	false	Avira URL Cloud: safe	unknown
https://outlook.office.com/search	chromecache_869.10.dr	false	Avira URL Cloud: safe	unknown
https://bugzil.la/548397	chromecache_952.10.dr	false	Avira URL Cloud: safe	unknown
https://github.com/zloirock/core-js/issues/1128	chromecache_952.10.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2	chromecache_1286.10.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh	chromecache_1286.10.dr	false	Avira URL Cloud: safe	unknown
https://www.clarity.ms/tag/uet/	chromecache_919.10.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff	chromecache_1286.10.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo	chromecache_1286.10.dr	false	Avira URL Cloud: safe	unknown
https://login.chinacloudapi.cn	chromecache_637.10.dr	false	Avira URL Cloud: safe	unknown
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js	chromecache_685.10.dr	false	URL Reputation: safe	unknown
https://login.windows-ppe.net	chromecache_637.10.dr	false	URL Reputation: safe	unknown
https://microsoftit.pkgs.visualstudio.com/OneITVSO/_packaging/CSM-SITES-AEMFoundations/npm/registry/	chromecache_824.10.dr, chromecache_1262.10.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w	chromecache_1286.10.dr	false	Avira URL Cloud: safe	unknown
https://dc-int.services.visualstudio.com	chromecache_1001.10.dr	false	Avira URL Cloud: safe	unknown
https://reactjs.org/link/react-polyfills	chromecache_990.10.dr	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=277178	chromecache_952.10.dr	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=308064	chromecache_952.10.dr	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com	chromecache_637.10.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2	chromecache_1286.10.dr	false	Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-object.entries	chromecache_952.10.dr	false	Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-array.prototype.find	chromecache_952.10.dr	false	Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-object.keys	chromecache_952.10.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo	chromecache_1286.10.dr	false	Avira URL Cloud: safe	unknown
https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RC4eca6d570e2d4f919d49e225bf4ba06	chromecache_789.10.dr	false	Avira URL Cloud: safe	unknown
https://assets.adobedtm.com/5ef092d1efb5/e6b4ca74378c/1d3e0e32d7b0/RC60d8da8de9104095af71971521df199	chromecache_1049.10.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2	chromecache_1286.10.dr	false	Avira URL Cloud: safe	unknown
https://github.com/kitcambridge/es5-shim/commit/4f738ac066346	chromecache_952.10.dr	false	Avira URL Cloud: safe	unknown
https://ats.everesttech.net/ats/ats?cmd=RT&AdvertiserID=4249&platform=TUMRI&ActionID=20114&ActionNam	chromecache_1090.10.dr, chromecache_956.10.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2	chromecache_1286.10.dr	false	Avira URL Cloud: safe	unknown
https://assets.adobedtm.com/5ef092d1efb5/4c272e8cc694/59ac3ac67251/RC78870d1e7c7c41c8aff3132202d3668	chromecache_673.10.dr	false	Avira URL Cloud: safe	unknown
https://github.com/microsoft/BotFramework-WebChat/issues/2119	chromecache_1226.10.dr	false	Avira URL Cloud: safe	unknown
https://github.com/twbs/bootstrap/issues/24093	chromecache_1401.10.dr, chromecache_1148.10.dr	false	Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-array.prototype.every	chromecache_952.10.dr	false	Avira URL Cloud: safe	unknown
https://portal.office.com/	chromecache_972.10.dr, chromecache_715.10.dr	false	Avira URL Cloud: safe	unknown
https://tc39.es/ecma262/#sec-toprimitive	chromecache_952.10.dr	false	URL Reputation: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.42	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.66.102.98	unknown	United States	3	MIT-GATEWAYSUS	false
2.18.64.223	unknown	European Union	6057	AdministracionNacionaldeTelecomunicacionesUY	false
2.18.64.222	unknown	European Union	6057	AdministracionNacionaldeTelecomunicacionesUY	false
13.107.246.45	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.44	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.9.76	unknown	United States	13335	CLOUDFLARENETUS	false
2.19.126.201	unknown	European Union	16625	AKAMAI-ASUS	false
66.235.152.225	unknown	United States	15224	OMNITUREUS	false
20.114.189.70	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
88.221.110.176	unknown	European Union	20940	AKAMAI-ASN1EU	false
66.235.152.221	unknown	United States	15224	OMNITUREUS	false
198.47.127.205	unknown	United States	62713	AS-PUBMATICUS	false
88.221.110.177	unknown	European Union	20940	AKAMAI-ASN1EU	false
199.232.210.172	unknown	United States	54113	FASTLYUS	false
37.252.171.52	unknown	European Union	29990	ASN-APPNEXUS	false
2.16.202.123	unknown	European Union	16625	AKAMAI-ASUS	false
204.79.197.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
23.197.128.137	unknown	United States	20940	AKAMAI-ASN1EU	false
52.71.1.43	unknown	United States	14618	AMAZON-AESUS	false
13.89.179.13	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
157.240.0.35	unknown	United States	32934	FACEBOOKUS	false
151.101.130.49	unknown	United States	54113	FASTLYUS	false
63.140.62.17	unknown	United States	15224	OMNITUREUS	false
151.101.1.44	unknown	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.65.44	unknown	United States	54113	FASTLYUS	false
142.250.185.194	unknown	United States	15169	GOOGLEUS	false
152.199.21.175	unknown	United States	15133	EDGECASTUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
2.23.209.152	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
2.23.209.151	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
35.244.174.68	unknown	United States	15169	GOOGLEUS	false
2.23.209.155	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
63.33.40.35	unknown	United States	16509	AMAZON-02US	false
2.16.238.152	unknown	European Union	20940	AKAMAI-ASN1EU	false
54.77.145.80	unknown	United States	16509	AMAZON-02US	false
52.182.143.213	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.2.49	unknown	United States	54113	FASTLYUS	false
52.19.233.148	unknown	United States	16509	AMAZON-02US	false
2.19.126.146	unknown	European Union	16625	AKAMAI-ASUS	false
40.126.31.67	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.253.42	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.79.167.8	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.99	unknown	United States	15169	GOOGLEUS	false
95.101.54.211	unknown	European Union	34164	AKAMAI-LONGB	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.138	unknown	United States	15169	GOOGLEUS	false
18.66.102.85	unknown	United States	3	MIT-GATEWAYSUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.16.241.15	unknown	European Union	20940	AKAMAI-ASN1EU	false
104.244.42.195	unknown	United States	13414	TWITTERUS	false
13.105.28.48	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.47.168.24	unknown	United States	16625	AKAMAI-ASUS	false
88.221.169.152	unknown	European Union	16625	AKAMAI-ASUS	false
20.190.159.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
54.247.81.172	unknown	United States	16509	AMAZON-02US	false
37.252.171.21	unknown	European Union	29990	ASN-APPNEXUS	false
91.228.74.244	unknown	United Kingdom	27281	QUANTCASTUS	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false
104.18.25.173	unknown	United States	13335	CLOUDFLARENETUS	false
2.18.64.21	unknown	European Union	6057	AdministracionNacionaldeTelecomunicacionesUY	false
52.167.30.171	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
44.196.225.242	unknown	United States	14618	AMAZON-AESUS	false
99.81.162.238	unknown	United States	16509	AMAZON-02US	false
23.192.245.206	unknown	United States	16625	AKAMAI-ASUS	false
2.23.209.182	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
151.101.66.49	unknown	United States	54113	FASTLYUS	false
88.221.110.136	unknown	European Union	20940	AKAMAI-ASN1EU	false
13.107.139.11	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
13.107.5.80	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
69.173.144.165	unknown	United States	26667	RUBICONPROJECTUS	false
142.250.185.68	unknown	United States	15169	GOOGLEUS	false
52.182.143.209	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
99.81.187.29	unknown	United States	16509	AMAZON-02US	false
13.107.21.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
3.75.62.37	unknown	United States	16509	AMAZON-02US	false
74.125.71.84	unknown	United States	15169	GOOGLEUS	false
104.244.42.131	unknown	United States	13414	TWITTERUS	false
104.18.36.155	unknown	United States	13335	CLOUDFLARENETUS	false
13.107.42.14	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.42.12	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.213.48.74	unknown	United States	16509	AMAZON-02US	false
52.51.69.10	unknown	United States	16509	AMAZON-02US	false
146.75.120.157	unknown	Sweden	30051	SCCGOVUS	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
157.240.253.35	unknown	United States	32934	FACEBOOKUS	false
52.223.40.198	unknown	United States	8987	AMAZONEXPANSIONGB	false
18.130.87.99	unknown	United States	16509	AMAZON-02US	false
152.199.19.161	unknown	United States	15133	EDGECASTUS	false
152.199.19.160	unknown	United States	15133	EDGECASTUS	false
23.38.98.102	unknown	United States	16625	AKAMAI-ASUS	false
40.126.32.140	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
3.71.149.231	unknown	United States	16509	AMAZON-02US	false
184.28.89.29	unknown	United States	16625	AKAMAI-ASUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1485219
Start date and time:	2024-07-31 10:13:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Factura.pdf
Detection:	MAL
Classification:	mal52.winPDF@59/1277@0/100
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Browse: https://onedrive.live.com/ Browse: https://onedrive.live.com/_forms/default.aspx?ReturnUrl=%2F%3Fid%3D1F93E553E0657B12%21150%26resid%3D1F93E553E0657B12%21150%26ithint%3Dfile%252cpdf%26authkey%3D%21AANiZNTSNI6KLHw%26cid%3D1f93e553e0657b12 Browse: https://www.microsoft.com/ Browse: https://www.microsoft.com/microsoft-365 Browse: https://www.microsoft.com/en-us/microsoft-teams/group-chat-software Browse: https://copilot.microsoft.com/ Close Viewer Browse: https://www.microsoft.com/en-us/windows/ Browse: https://www.microsoft.com/en-us/surface

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.42	https://protect-us.mimecast.com/s/FVibCzpzxLsxEMXAhgAOBC	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
	http://border-fd.smartertechnologies.com/	Get hash	malicious	Unknown	Browse	border-fd.smartertechnologies.com/
	https://protect-us.mimecast.com/s/4MrPCrkvgotDWxrNCzxa8p	Get hash	malicious	Unknown	Browse	www.mimecast.com/
18.66.102.98	https://www.svb.com/learning-central/go/contact	Get hash	malicious	Unknown	Browse
	https://url5041.app.lucid.co/uni/ls/click?upn=u001.9CEiYqsCeDB7JcEaXQIz-2F9XjjPqk-2Fb4pFcLw69B6WqTy-2BbVFLiir3sSJZjbRo6mBAwRtKNr9Kf4WztrdCBts7iyzvcJ-2FIUH0XDrcbuiiKrlzy8ZwzSxYR1urVGEa2H8lG0Sg7ExDExUtTEJeACnxEcvsJ4CnFcY2OyyabtZjsqjBmQJR0iCaQNYCn9tJqfPt0sqRsrpUZbmtTsF5u4sk76aC5ja3Exi0TVSSBuxtzkkrePRrkTP-2FRoxSefUr1y9ifBkb_dUh7YYn0CWe7g0uIZp9zt65Hthp00ETbvJwQ2-2FPnaFo-2F6mxOihmrHPDDfCfshjvQGVU9-2Bd2-2B3vsLq0LwwbeORlRqCPnIR26Xq1m6ZVCtavwwAaoSjStADst1UVTP0l4d-2FzBe05CWQHZRJZnuruhZc2ae0Zf85sATPdd2ckxoL02afjX6IZ-2FOnZhoY7M8W-2FjfCWzd1oIyP3ANpDIJAgvTalmosz4y3Bzw-2FhLw29NweA30QmgJS04wuz2oXimlo6op-2FqJedWdU8-2FFbrJTBeUgeanW2Czs-2FFx2TH3awx6W-2F55Yb82yx-2F62ecOROxbh-2BxRxP0NuIJ3E3kOjP9A-2FBHPPistrMOyMfHL3jiBAgKbwxDOZEkcZdWn-2FbhWLonViLvhgsmNJILGX2sEzIPx5T9dHffneCLLKkuS58PqzDIY8zgACYh67a-2BB2UiAkAJ2RKKsfjEyBczdi7jS1NPJGO8JELOnONA-2BUkh-2FPUe3G9cdiSbxRW0MxW4MALRMk7Wout0aHFsrJ7Eh7hadnZE4mjg6TM4MQdJoJM9kphXs-2FrJ8by1dOwVfzD1MjU7M-2FUsC6hEi8gkYGjfbMvNzOqhWtGlGQX1TqXB4dLSi-2FpFlKLKKTOyb-2BEg-2Fk4dUHiOlXDdWkbx1GLw9K6ZKJtQNSWhWZuSXKhKo1a2RW3Ug4SPFD-2F-2Fq24DMjrCmm0g8oFpoDapmDPd4UzAivOlfdqqtkNSCkPToMecTrMkYlTeNujTr-2Bbw99hSJKirL4rAfH9oaNg32Alc4lwJoCppVycgre3BcqTLb2WoN7sUpmWarOPciYLuedGYc0-3D	Get hash	malicious	Unknown	Browse
	file-sample_100kB.doc	Get hash	malicious	Unknown	Browse
	https://in.xero.com/wwkwvl0g2njip86pvix1xtkdqpe7u3z1vzdpadcn	Get hash	malicious	Unknown	Browse
	https://in.xero.com/otg9csffpxao6afkqb3xwrugoatdbpeduijycctc	Get hash	malicious	Unknown	Browse
	https://developers.foxit.com/	Get hash	malicious	Unknown	Browse
	https://us02web.zoom.us/webinar/register/6317193087387/WN_wbycs5lISL2eo8rEP6qUDg#/registration	Get hash	malicious	Unknown	Browse
	https://us02web.zoom.us/webinar/register/WN_7CDol1QPS2eD_bT1ntjWmg	Get hash	malicious	Unknown	Browse
	https://in.xero.com/LPhAf4Uu8GqGOPHDnymb0iopYL0hBHD11XrSzhaz	Get hash	malicious	Unknown	Browse
	https://url.au.m.mimecastprotect.com/s/uuv2CgZowrsOpyOOc26VTV?domain=in.xero.com	Get hash	malicious	Unknown	Browse
2.18.64.223	https://www.mundodomarketing.com.br/	Get hash	malicious	HTMLPhisher	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

IP
192.168.2.22
192.168.2.4
192.168.2.6

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Message_2316203.eml	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://dfghbv.fujtisu.com/3EPrz1?8b6488=MJWeddings@jumeirah.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	Message copied from system quarantine.msg	Get hash	malicious	WinSearchAbuse	Browse	51.116.253.169
	Quarantined Messages.zip	Get hash	malicious	Phisher	Browse	52.109.32.97
	https://www.mundodomarketing.com.br/	Get hash	malicious	HTMLPhisher	Browse	13.107.42.14
	https://service-tech-help.com/9db9278d-4337-439f-8ae6-838be9dfd134/a/02255092-dd32-434f-9bb4-0186630acbdf/ccp?lid=9b375531-e9fa-4cd7-a199-ddd848ddadc8&lang=en-gb	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://justc1ck.cdsconstructionservices.workers.dev/common/resume?ctx=rqqiaraahdk9i9t2hazwy77zvda217sudluhq2krw--2dihitk625z_kf8mktbi92zl804tt2za1dst0aocgq8zcodzs0qlk6tllobdifugf0azl6bcyfhpt5pdly_plgz_p6vgtqlbwcvzziahgju-ogkntfg2hjgezkmvagfonxqbfhza8rygay5uru6dn_wsxv8og_udlj8l28owp8wo599i0wteq1d1uv4lnm992k3ycvqezox403xk_imhtbhlcphqjvb1ffdcmwacplqzjomtilezqwevxague_a4e3rtkegr7d	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://service-tech-help.com/dae8aa52-1e39-4ced-9de4-51547f4702ef/a/a567848e-c423-4c44-9872-661e79094b17/ccp?lang=en-gb&lid=face46d6-8518-40a9-8cca-ab719285df28	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://fafidevappstartnoeinz.dhalia.workers.dev/?bbre=nxfbeolezmivhsrlyqtyjrtuwbopd/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://worker-restless-dawn-a10d.caryl7.workers.dev/common/resume?ctx=rqqiaraahzk_j9t0amxj5c73q4vgbywoaekgkfcfk69_fe2c1ogsolet_0gu38rxluji2lgdr2mncew7s0hmqatsxcbwixpchjgqe2k8qqnt-qvoakjqudyczbxl03t60lve5_ialznlqgwef-gyopuq5shhstyuzgglkmx1ckibssfjzarmrqj5af2uhxyxikeg9-rks9q3hvprve7td26juzeoo81zpzkmatl0hm-yy1yyvpdlcuyt5wn9a0e8j4ib_l69jaf92_wgmgilbw43ywiqpjmok2t-c6gheab6vvjlmti8b	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
AdministracionNacionaldeTelecomunicacionesUY	https://tti-sftpl--c.visualforce.com/resource/1574239418000/TTILOGO	Get hash	malicious	Unknown	Browse	2.18.64.11
	https://www.mundodomarketing.com.br/	Get hash	malicious	HTMLPhisher	Browse	2.18.64.223
	mirai.arm7.elf	Get hash	malicious	Mirai	Browse	167.109.72.63
	EA17eA1pkG.exe	Get hash	malicious	SmokeLoader	Browse	179.27.75.59
	rLog7rmU2e.elf	Get hash	malicious	Mirai	Browse	190.135.218.162
	fu[1].exe	Get hash	malicious	Bdaejec	Browse	2.18.64.220
	http://worker-royal-cake-d668.20030725gg.workers.dev/	Get hash	malicious	Unknown	Browse	2.18.64.10
	http://stone003.stone168.cloudns.org/	Get hash	malicious	Unknown	Browse	2.18.64.10
	http://worker-winter-voice-2d98.mlzfuyun.workers.dev/	Get hash	malicious	Unknown	Browse	2.18.64.10
	http://wordpress.starsxxm9746.workers.dev/	Get hash	malicious	Unknown	Browse	2.18.64.10
MIT-GATEWAYSUS	https://www.mundodomarketing.com.br/	Get hash	malicious	HTMLPhisher	Browse	18.173.213.117
	https://stonnington-vic-foodsampling.app.oneblink.io.	Get hash	malicious	Unknown	Browse	18.66.112.13
	https://stonnington-vic-foodsampling.app.oneblink.io/	Get hash	malicious	Unknown	Browse	18.66.112.13
	https://us-west-2.protection.sophos.com/?d=purposeadvisor.com&u=aHR0cHM6Ly9vZmMuYWMucHVycG9zZWFkdmlzb3IuY29tL2Fkdmlzb3JfcG9ydGFsL2NsaWVudHMvNDAwOTc0&i=NjBiYTdmNjgxNDkwYmIwZjRmOWUwNGI0&t=MDZQNXpyd0Q1SytybjUvWUlrMTQzSmg5eGphYkYyamxuSkxLSytMcUdwST0=&h=1ffbd61cf8d24048ab3fc8ad7e6cc09c&s=AVNPUEhUT0NFTkNSWVBUSVa642Sa30j9O4WM93voaDiZGQxyrW9gQ-DDcZ_Npfi-Dw	Get hash	malicious	Unknown	Browse	18.66.147.96
	https://generously-supporter-capably.w3spaces.com/	Get hash	malicious	Unknown	Browse	18.173.213.117
	https://fbq.pages.dev/%5C%5C%5C%22https:%5C/%5C/t.myvisualiq.net%5C/impression_pixel?r=739915162&et=i&ago=212&ao=546&aca=26620495&si=4449639&ci=-7&pi=316681543&ad=-7&advt=4470647&chnl=-7&vndr=115&sz=6696&u=%5Bcustom_data%5D&pt=i%5C%5C%5C%22	Get hash	malicious	HTMLPhisher	Browse	18.66.196.26
	https://worker-muddy-mud-21e4.jm-database.workers.dev/account/create?.intl=us&.lang=en-us&sr	Get hash	malicious	HTMLPhisher	Browse	18.66.196.124
	https://njd.pages.dev/account/js-reporting/?crumb=uz4.07kerli&message=javascript_not_enabled&ref=/account/challenge/password	Get hash	malicious	HTMLPhisher	Browse	18.165.183.29
	https://dfv.pages.dev/account/js-reporting?crumb=uz4.07kerli&message=javascript_not_enabled&ref=/account/challenge/password	Get hash	malicious	HTMLPhisher	Browse	18.66.112.108
	http://ourtime.people-meedia.workers.dev/v3/aboutonlinedating	Get hash	malicious	HTMLPhisher	Browse	18.173.205.54
AdministracionNacionaldeTelecomunicacionesUY	https://tti-sftpl--c.visualforce.com/resource/1574239418000/TTILOGO	Get hash	malicious	Unknown	Browse	2.18.64.11
	https://www.mundodomarketing.com.br/	Get hash	malicious	HTMLPhisher	Browse	2.18.64.223
	mirai.arm7.elf	Get hash	malicious	Mirai	Browse	167.109.72.63
	EA17eA1pkG.exe	Get hash	malicious	SmokeLoader	Browse	179.27.75.59
	rLog7rmU2e.elf	Get hash	malicious	Mirai	Browse	190.135.218.162
	fu[1].exe	Get hash	malicious	Bdaejec	Browse	2.18.64.220
	http://worker-royal-cake-d668.20030725gg.workers.dev/	Get hash	malicious	Unknown	Browse	2.18.64.10
	http://stone003.stone168.cloudns.org/	Get hash	malicious	Unknown	Browse	2.18.64.10
	http://worker-winter-voice-2d98.mlzfuyun.workers.dev/	Get hash	malicious	Unknown	Browse	2.18.64.10
	http://wordpress.starsxxm9746.workers.dev/	Get hash	malicious	Unknown	Browse	2.18.64.10
MICROSOFT-CORP-MSN-AS-BLOCKUS	Message_2316203.eml	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://dfghbv.fujtisu.com/3EPrz1?8b6488=MJWeddings@jumeirah.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	Message copied from system quarantine.msg	Get hash	malicious	WinSearchAbuse	Browse	51.116.253.169
	Quarantined Messages.zip	Get hash	malicious	Phisher	Browse	52.109.32.97
	https://www.mundodomarketing.com.br/	Get hash	malicious	HTMLPhisher	Browse	13.107.42.14
	https://service-tech-help.com/9db9278d-4337-439f-8ae6-838be9dfd134/a/02255092-dd32-434f-9bb4-0186630acbdf/ccp?lid=9b375531-e9fa-4cd7-a199-ddd848ddadc8&lang=en-gb	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://justc1ck.cdsconstructionservices.workers.dev/common/resume?ctx=rqqiaraahdk9i9t2hazwy77zvda217sudluhq2krw--2dihitk625z_kf8mktbi92zl804tt2za1dst0aocgq8zcodzs0qlk6tllobdifugf0azl6bcyfhpt5pdly_plgz_p6vgtqlbwcvzziahgju-ogkntfg2hjgezkmvagfonxqbfhza8rygay5uru6dn_wsxv8og_udlj8l28owp8wo599i0wteq1d1uv4lnm992k3ycvqezox403xk_imhtbhlcphqjvb1ffdcmwacplqzjomtilezqwevxague_a4e3rtkegr7d	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://service-tech-help.com/dae8aa52-1e39-4ced-9de4-51547f4702ef/a/a567848e-c423-4c44-9872-661e79094b17/ccp?lang=en-gb&lid=face46d6-8518-40a9-8cca-ab719285df28	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://fafidevappstartnoeinz.dhalia.workers.dev/?bbre=nxfbeolezmivhsrlyqtyjrtuwbopd/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://worker-restless-dawn-a10d.caryl7.workers.dev/common/resume?ctx=rqqiaraahzk_j9t0amxj5c73q4vgbywoaekgkfcfk69_fe2c1ogsolet_0gu38rxluji2lgdr2mncew7s0hmqatsxcbwixpchjgqe2k8qqnt-qvoakjqudyczbxl03t60lve5_ialznlqgwef-gyopuq5shhstyuzgglkmx1ckibssfjzarmrqj5af2uhxyxikeg9-rks9q3hvprve7td26juzeoo81zpzkmatl0hm-yy1yyvpdlcuyt5wn9a0e8j4ib_l69jaf92_wgmgilbw43ywiqpjmok2t-c6gheab6vvjlmti8b	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.214327835425762
Encrypted:	false
SSDEEP:	6:Bzw+q2Pwkn2nKuAl9OmbnIFUt84zakZmw+4zaEVkwOwkn2nKuAl9OmbjLJ:J1vYfHAahFUt80V/+0H5JfHAaSJ
MD5:	D8DEAF37D1A1DC380BBEED11CC25FA6A
SHA1:	02DDC60C1CBE83EED2D10956B2AFC59A6EA8D44E
SHA-256:	1E480932FE1020257147F6C4D2645766330C8FC9ED82FB787275AC7BE5A7D9DB
SHA-512:	0313703985CAEF36D148A70C51BCE982507F9AFCCBF92B6647B77A0CE49E4122AAD0C10F176740C404812E24FBDFCA77900EC5D410EF15D7720A0CE10579F831
Malicious:	false
Reputation:	low
Preview:	2024/07/31-04:14:12.078 1d58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/07/31-04:14:12.082 1d58 Recovering log #3.2024/07/31-04:14:12.082 1d58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	406
Entropy (8bit):	4.645093417199183
Encrypted:	false
SSDEEP:	12:M9BAG1/qAT9BAs1/qKdDYT9BAR6T9BAOk/CMRZcJfRDZ:M9p/qS91/qfT9J9yRC5N
MD5:	F9F2395C582FA601707B7A5DFAE9F05F
SHA1:	27B15AECD0BFDD3B25556AC00755856D4D331E0D
SHA-256:	D7D6D06624D4BDF6935B848DF342CE322D02B58D12BF12149DF92D557E5E9BC4
SHA-512:	F3378927D96B0B172981A821A8C2A16D0F397ED92E835B7C46316FC48350402D972A5411F0FA4C260F205AA1F7917F83F8247BF8A62C7F22E0076B168275B1E9
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/clientlibs/clientlib-uhf.min.ACSHASHf9f2395c582fa601707b7a5dfae9f05f.css
Preview:	.c-uhfh .c-action-trigger.glyph-shopping-cart span:not(.shopping-cart-amount),.c-uhfh .c-action-trigger.glyph-shopping-bag span:not(.shopping-cart-amount){line-height:48px !important}..c-uhfh .c-action-trigger.glyph-shopping-cart:after,.c-uhfh .c-action-trigger.glyph-shopping-bag:after{line-height:43px}..c-uhfh.c-sgl-stck .c-search button{line-height:18px}..msame_Header_name{line-height:44px !important}

File type:	PDF document, version 1.5
Entropy (8bit):	7.968081981931021
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Factura.pdf
File size:	107'604 bytes
MD5:	88942c76544cdcfa2136c4ff876363d4
SHA1:	cbc00851174729d94188e79879ce1bfeba5cc3cc
SHA256:	60659cc770389bda5a31fd917555d0c494cec53e4a5cbfb10230cb117939eaa0
SHA512:	200c3a63c4e2c24883ee79053916f4b5073773d3cf9753a7d0838775ba558ed7e025d4851d7e810d718facd975cb9d440cde27f5edab291c803b3bc758a76702
SSDEEP:	3072:nVpX0peXViBqfKS1bGijn0jmhfRNyY+KjW:VpX0kl9SIln0jm5RUky
TLSH:	94B3025C42764D2AE8834A39FABB77E1C10FC41C6976C084BF38609F665B1609668E7F
File Content Preview:	%PDF-1.5.%.....2 0 obj.<<./Type /Catalog./Pages 4 0 R./AcroForm 5 0 R./Version /1#2E5.>>.endobj.11 0 obj.<<./Filter /FlateDecode./Length 64.>>.stream..x.3T.T(T056.357T0.Bsc#=.KK.]c=#.S.c.]33=..K3..\.}...C..\|.@..[..-..endstream.endobj.20 0 obj.<<./Type /XO

General
Header:	%PDF-1.5
Total Entropy:	7.968082
Total Bytes:	107604
Stream Entropy:	7.968384
Stream Bytes:	106713
Entropy outside Streams:	5.271289
Bytes outside Streams:	891
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	7
endobj	7
stream	5
endstream	5
xref	0
trailer	0
startxref	1
/Page	0
/Encrypt	0
/ObjStm	1
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	1
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

ID	DHASH	MD5	Preview
20	888b8fcd70ec4800	59ea74b8b9e11168bef9cbce1e0e8903
21	0000000000000000	f947e33003d19d38cb43a0c45a2c208a

Target ID:	0
Start time:	04:14:10
Start date:	31/07/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Factura.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	04:14:11
Start date:	31/07/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	04:14:12
Start date:	31/07/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1508,i,10463332442722132192,14218185456690274382,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Factura.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\203653e1-73d5-4505-8540-9000d2a8167a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240731081415Z-158.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7380

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Windows Analysis Report
Factura.pdf

Target ID:	9
Start time:	04:14:35
Start date:	31/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://1drv.ms/b/s!AhJ7ZeBT5ZMfgRYDYmTU0jSOiix8?e=QbMPnu"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	04:14:36
Start date:	31/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=2004,i,4560367953723847233,243234883886843712,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	04:15:57
Start date:	31/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6120 --field-trial-handle=2004,i,4560367953723847233,243234883886843712,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre