Edit tour

Windows Analysis Report
The Podor Law Firm -23749-24 .pdf

Overview

General Information

Sample name:	The Podor Law Firm -23749-24 .pdf
Analysis ID:	1514015
MD5:	28124d5273aa58ad48d10e40b26aef4e
SHA1:	e8e09e4153b91dc41be0ad56049df5d077240781
SHA256:	42624288479d0ec84ea79ef8170a243153d57a1d979546b7ebbe807c4beeeb90
Infos:

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish44

AI detected landing page (webpage, office document or email)

Phishing site or detected (based on various text indicators)

Connects to many different domains

Connects to several IPs in different countries

Detected non-DNS traffic on DNS port

Executes massive DNS lookups (> 100)

HTML page contains hidden javascript code

HTML page contains string obfuscation

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 6832 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\The Podor Law Firm -23749-24 .pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6188 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6412 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1552,i,15958377352133413966,15368759146307475637,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7568 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://podorlaw.framer.website/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7748 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1852,i,15172311978042768892,5140578951366074874,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4680 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7484 --field-trial-handle=1852,i,15172311978042768892,5140578951366074874,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_499	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish44

Source: Yara match

File source: dropped/chromecache_499, type: DROPPED

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 14.19	OCR Text: X e) Yahoo I MBilr Weather, Search, My F-rmer Site C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer https://ck0 rats ikha n6.cam/ [QaZOv2 m Y,r6y L 1 p Hyt371 pg/ 11:38 ENG Type here to search SG IYD9/2024
Source: Chrome DOM: 14.8	OCR Text: X e) Yahoo I MBilr Weather, Search, My F-rmer Site C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer https://ck0 rats ikha n6.cam/ [QaZOv2 m Y,r6y L 1 p Hyt371 pg/ 11:38 ENG Type here to search SG IYD9/2024
Source: Chrome DOM: 14.13	OCR Text: X C, Yahoo I MBilr Weather, Search, My F-rmer Site C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer https://ck0 rats ikha n6.cam/ [QaZOv2 m Y,r6y L 1 p Hyt371 pg/ 11:38 ENG Type here to search SG IYD9/2024
Source: Chrome DOM: 14.54	OCR Text: My F-rmer Site X e Yahoo I M?ilr Weather, Search, C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer https://ck0 rats ikha n6.cam/ [QaZOv2 m Y,r6y L 1 p Hyt371 pg/ 11:38 ENG Type here to search SG IYD9/2024
Source: Chrome DOM: 14.20	OCR Text: My F-rmer Site X Yahoo I MBilr Weather, Search, C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer 11:38 ENG Type here to search SG IYD9/2024
Source: Chrome DOM: 14.51	OCR Text: My F-rmer Site X Yahoo I MBilr Weather, Search, C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer ENG 11:38 Type here to search SG IYD9/2024
Source: Chrome DOM: 14.95	OCR Text: My F-rmer Site X e Yahoo I MBilr Weather, Search, C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer 11:3g ENG Type here to search SG 19/09/2024
Source: Chrome DOM: 14.84	OCR Text: My F-rmer Site X Yahoo I MBilr Weather, Search, C podarlaw.fremer.webslte THE P01)0R lbw FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer ENG 11:3g Type here to search SG IYD9/2024
Source: Chrome DOM: 14.103	OCR Text: My F-rmer Site X Yahoo I MBilr Weather, Search, C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer ENG 11:3g Type here to search SG 19/09/2024
Source: Chrome DOM: 14.92	OCR Text: X G) Yahoo I MBilr Weather, Search, My F-rmer Site C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer https://ck0 rats ikha n6.cam/ [QaZOv2 m Y,r6y L 1 p Hyt371 pg/ 11:3g ENG Type here to search SG IYD9/2024
Source: Chrome DOM: 14.62	OCR Text: X C) Yahoo I MBilr Weather, Search, My F-rmer Site C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer https://ck0 rats ikha n6.cam/ [QaZOv2 m Y,r6y L 1 p Hyt371 pg/ 11:3g ENG Type here to search SG IYD9/2024
Source: Chrome DOM: 14.101	OCR Text: X G) Yahoo I MBilr Weather, Search, My F-rmer Site C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer https://ck0 rats ikha n6.cam/ [QaZOv2 m Y,r6y L 1 p Hyt371 pg/ 11:3g ENG Type here to search SG 19/09/2024
Source: Chrome DOM: 14.85	OCR Text: My F-rmer Site X YShool MBilr eather, Search, C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer ENG 11:3g Type here to search SG IYD9/2024
Source: Chrome DOM: 14.53	OCR Text: X @ Yahoo I MBilr Weather, Search, My F-rmer Site C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer https://ck0 rats ikha n6.cam/ [QaZOv2 m Y,r6y L 1 p Hyt371 pg/ 11:38 ENG Type here to search SG IYD9/2024
Source: Chrome DOM: 14.91	OCR Text: My F-rmer Site X Yahoo I MBilr Weather, Search, C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer ENG 11:3g Type here to search SG IYD9/2024
Source: Chrome DOM: 0.2	OCR Text: THE POI)OR LAW FIRM ATTORNEYS A-r LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer
Source: Chrome DOM: 14.60	OCR Text: My F-rmer Site X Yahoo I MBilr Weather, Search, C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer https://ck0 rats ikha n6.cam/ [QaZOv2 m Y,r6y L 1 p Hyt371 pg/ 11:38 ENG Type here to search SG IYD9/2024
Source: Chrome DOM: 14.96	OCR Text: My F-rmer Site X Yahoo I MBilr Weather, Search, C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer 11:3g ENG Type here to search SG 19/09/2024
Source: Chrome DOM: 14.25	OCR Text: My F-rmer Site X Yahoo I MBilr Weather, Search, C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer h L 1 p 71 pg/ 11:38 ENG Type here to search SG IYD9/2024
Source: Chrome DOM: 14.71	OCR Text: My F-rmer Site X Yahoo I MBilr Weather, Search, C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer https://ck0 rats ikha n6.cam/ [QaZOv2 m Y,r6y L 1 p Hyt371 pg/ 11:3g ENG Type here to search SG IYD9/2024
Source: Chrome DOM: 14.106	OCR Text: My F-rmer Site X Yahoo I MBilr Weather, Search, C podarlaw.fremer.webslte THE P01)0R LAW FIRM AT LAW New Document Received PDF You've received (2) new PDF documents for your review Please sign & return: REVIEW DOCUMENT HERE Made in Framer https://ck0 rats ikha n6.cam/ [QaZOv2 m Y,r6y L 1 p Hyt371 pg/ 11:3g ENG Type here to search SG 19/09/2024

Source: https://ok0.atsaikhan6.com/IQaZOv2mXr6yjL1pHyt37Ipg/

HTTP Parser: Base64 decoded: {"version":3,"sources":["/cfsetup_build/src/orchestrator/turnstile/templates/turnstile.scss","%3Cinput%20css%20qtFLbZ%3E"],"names":[],"mappings":"AAmCA,gBACI,GACI,uBClCN,CACF,CDqCA,kBACI,GACI,mBCnCN,CACF,CDsCA,iBACI,MAEI,cCrCN,CDwCE,IACI,mBCtCN,CACF,CDyCA...

Source: https://servedby.flashtalking.com/imp/8/228036;8559797;201;js;TheTradeDeskUS;2024Q2SlingIntSATDPROSSambaTV300x250/?ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_agentEnv=0&ft_lat=29.770000457763672&ft_long=-95.30999755859375&ft_referrer=https%3A%2F%2Fca8fb8bb8961a5a06e7835dd836bd45f.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&gdpr=0&gdpr_consent=&us_privacy=1YNN&ft_mcid=zul6izp&ft_mliid=ci01aho&ft_partnerimpid=62ed4412-6473-4b04-9224-185c598c5049&cachebuster=281340.037218285	HTTP Parser: Found new string: script .var ftGUID_8559797="6106FCD42C5A4F";..var ftConfID_8559797="0";..var ftParams_8559797="ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_agentEnv=0&ft_lat=29.770000457763672&ft_long=-95.30999755859375&ft_referrer=https%3A%2F%2Fca8fb8bb8961a5a06e7835dd836bd45f.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&gdpr=0&gdpr_consent=&us_privacy=1YNN&ft_mcid=zul6izp&ft_mliid=ci01aho&ft_partnerimpid=62ed4412-6473-4b04-9224-185c598c5049&cachebuster=281340.037218285";..var ftKeyword_8559797="";..var ftCustom_8559797="";..var ftSection_8559797="";..var ftSegment_8559797="";..var ftSegmentList_8559797=[];..var ftRuleMatch_8559797="0";..var ftTimestamp_8559797="1726760310";..var ftGeoC2_8559797="us";..var ftGeoState_8559797="tx";..var ftGeoCity_8559797="houston";..var ftISP_8559797="level 3 parent llc";..var ftSpeed_8559797="broadband";..var ftConnType_8559797="wifi";..var ftDMA_8559797="618";..var ftLong_8559797="-95.31";..var ftLat_8559797="29.77";..var ftPostal_8559797="77020";..var ftTimeZone_...
Source: https://fra1-ib.adnxs.com/ab?an_audit=0&referrer=https%3A%2F%2Fwww.yahoo.com%2F&e=wqT_3QKHD_DXhwcAAAMA1gAFAQiki7G3BhDMhuK_4vz4jDMY8aT-96XiyrADKjYJN6oO85wz6j8R4Akopio55T8ZAAAAwPUoFUAh-GV60z6n5j8pgOz17o_36z8xAAAAYGZm7j8w9Ki4DziJfUDveUgCULiup4ECWObArAFgAGivptABeL7ZBYABAYoBA1VTRJIBA1VTRJgBrAKgAfoBqAEBsAEAuAECwAEFyAEC0AEJ2AEA4AEA8AEAigJqdWYoJ2EnLCA5MzEwMjQ3LCAwKTt1ZignaScsIDEwNTMzMTY1FRUsZycsIDI2NTMwNTA3FRUwcycsIDMwMTk1NTgxMxUWMHInLCA1Mzk2MTI5ODQFFvCLkgLxBSFScGt0UlFpR2lLOGRFTGl1cDRFQ0dBQWc1c0NzQVRBQU9BQkFBRWp2ZVZEMHFMZ1BXQUJnNFFSb0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUUd3QVFDNUFmQXpCbTJKOS1zX3dRSHdNd1p0aWZmclA4a0JBQUFBQUFBQThEX1pBUUEJDnRQQV80QUd0OG9JRjlRSHZxdlFfbUFJQW9BSUJ0UUkFJAB2DQjwaXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQm9nTU9DTERrN3p3UUFSZ0NMUUFBSUVDaUF3NElzT1R2UEJBTEdBSXRBQUFnUUxvRENVWlNRVEU2TlRjM09lQURza2ZwQXcFdyEJ8DxfOEFQZkU0QUUzZkdYRDRnRXNhYjdEcEFFQVpnRUFiSUVDZ2owN1l3U0VNdkczQTI2QkJrSWhRUVJtcG1aAQIMeVQ4Wg1OAQFAZzktMEN1Z1FhQ0pBS0VUTXoFAhA5TV9HUQEfCQEgSVBUdGpCTEJCCQ8FiAR5UR0hCE5FRREbHEhrRFlCQVB4FS...	HTTP Parser: Found new string: script document.write("<!-- Creative 539612984 served by Member 15599 via AppNexus. -->");try{document.write('<ins class=\'dcmads\' style=\'display:inline-block;width:300px;height:250px\' data-dcm-click-tracker=\'https://fra1-ib.adnxs.com/click2?e=wqT_3QKlAfBDpQAAAAMAxBkFAQiki7G3BhDMhuK_4vz4jDMY8aT-96XiyrADIPSouA8oiX0w73k4AkC4rqeBAkjmwKwBUABaA1VTRGIBBfBcaKwCcPoBeK-m0AGAAb7ZBYgBAZABApgBBaABAqkBpd--Dpwz6j-xAd9TOe0pOeU_uQEAAADA9SgVQMEB-GV60z6n5j_JAYDs9e6P9-s_2AEA4AEA8AGln8cI-AEA/s=4c2c540bbd3166f661057ac5e41ed956aa78d610/bcr=AAAAAAAA8D8=/cnd=%21LRPR8AiGiK8dELiup4ECGObArAEgACgAMQAAAAAAAAAAOglGUkExOjU3NzlAskdJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAA4D9hAAAAAAAA4D9pAAAAAAAAAABxAAAAAAAAHkB4AIkBAAAAAAAA8D8./cca=MTU1OTkjRlJBMTo1Nzc5/bn=93374/clickenc=\' data-dcm-placement=\'N4492.285985MEDIAIQ/B31082225.385033035\' data-dcm-rendering-mode=\'script\' data-dcm-https-only data-dcm-api-frameworks=\'[APIFRAMEWORKS]\' data-dcm-omid-partner=\'[OMIDPARTNER]\' data-dcm-ltd=\'false\' data-dcm-resettable-device-id=\'\' ...
Source: https://fra1-ib.adnxs.com/ab?an_audit=0&referrer=https%3A%2F%2Fwww.yahoo.com%2F&e=wqT_3QLFDvBMRQcAAAMA1gAFAQjsirG3BhCTm4SS7P3DzxIYo_3746mPv89RKjYJLCY2H9eG2D8RSUu8btds0z8ZAAAAgOtRHEAhSUu8btds0z8pLCYJJNgxAAAAYLge_T8w8qi4DziJfUC4Z0gCUKrb2okCWObArAFgAGivptABeNPXBYABAYoBA1VTRJIBAQbwT5gBrAKgAdgEqAEBsAEAuAECwAEFyAEC0AEJ2AEA4AEA8AEAigJrdWYoJ2EnLCAxMDk4NjYwOCwgMCk7dWYoJ2knLCAxMDY4NDQ4MiwgMCk7ARUwZycsIDI3MDI2MTI5LBEqLHMnLCAzMDQwNTg1ORkWMHInLCA1NTcyMzE1MzAFLPC8kgKtBSFfcGUxbFFqeHpNd2RFS3JiMm9rQ0dBQWc1c0NzQVRBQU9BQkFBRWk0WjFEeXFMZ1BXQUJnX19fX193OW9BSEFCZUFHQUFRR0lBUUdRQVFHWUFRR2dBUUdvQVFHd0FRQzVBVDJHT2ZWb0M5WV93UUhoTFBfSzA0YllQOGtCQUFBQUFBQUE4RF9aQVRTaXREZjR3dXdfNEFIQ2tJd0Y5UUZDVzdBLW1BSUFvQUlCdFFJQUFBQUF2UUlBATvwtndBSUJ5QUlCMEFJQjJBSUI0QUlBNkFJQS1BSUFnQU1CbUFNQm9nTU9DTHEyM3o4UUFSZ0NMUUFBZ0QtaUF3NEl1cmJmUHhBTEdBSXRBQUNBUDdvRENVWlNRVEU2TlRNeE4tQURza2VBQkthdnB3LUlCS3l2cHctUUJBQ1lCQUd5QkFvSXhyZXZEaERLeHR3TnNnUUtDTWVaNHc0UXlzYmNEYklFQ2dqRjZ1TU9FTXJHM0EzQkJBQQG7BQEIeVFRBQgFARhOZ0VBUEVFBQwFAURDSUJjVXBtQVhub2Y2UUFha0YFFwBBITAILX...	HTTP Parser: Found new string: script document.write("<!-- Creative 557231530 served by Member 13240 via AppNexus. -->");try{document.write('<ins class=\'dcmads\' style=\'display:inline-block;width:300px;height:600px\' data-dcm-placement=\'N1951041.1921199SEEDTAG/B32138466.404017134\' data-dcm-rendering-mode=\'iframe\' data-dcm-https-only data-dcm-api-frameworks=\'[APIFRAMEWORKS]\' data-dcm-omid-partner=\'[OMIDPARTNER]\' data-dcm-ltd=\'false\' data-dcm-resettable-device-id=\'\' data-dcm-app-id=\'\'> <script src=\'https://www.googletagservices.com/dcm/dcmads.js\'><\/script></ins>');document.write('<iframe src="https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=16009&pub_id=2429005" width="1" height="1" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0" style="position:absolute;overflow:hidden;clip:rect(0 0 0 0);height:1px;width:1px;margin:-1px;padding:0;border:0;"></iframe>');try {!function(){function e(e,t){return"function"==typeof __an_obj_extend_thunk?__an_obj_exten...
Source: https://ca8fb8bb8961a5a06e7835dd836bd45f.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html	HTTP Parser: Found new string: script (function() {var u = 'https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BjVgnPvgdY7pDzPha4Jm4PJNxpdDIgCu9kiuShx1G5eS80Cr9scNsrWWRAUkCvoDHCkGg3JRqrMb5zMdxcfXw1hyzN0j8gxwDrvmVtnZxA3FFgVa9af0elzzJblAkfwyAH7Bhd3xLKO7RI4NfZj81a77lw5GfTN4SstCNZxHuIn68M6GuU9xrcnhXUWZ8jaYKjigQpnoOoqx6cABEToDo1Sprq-y-4BZ6iPyGxi9nLG1WtW6w&dbm_d=AKAmf-AtFmotLInNBikERbGJ--av27mzDCHSm6xJqVLljOHfvQM8Rn_7EUOy0clumceppOdCPMmV6a4GPbPFpF9WjytyZBPdVrykhXuMhC_P_V6ZZbP4gO0FVZflTQEy6DgRlsLxF6eVXEM3I-IQ_WiSjISphxzz2Tygf0iGmPkX_0Yx2JeMJ5NYnh42PPjkKuBzdbhpkLhevr9MU-SHet1PPj8jLjSTr5KZ82eHCGQq1OsMsQzRKEX3X5223ZdUYFTgOq42dSJyVPe4nLL575GBvL9k97i-If9cgYKSnatnHTwhbOQyFx64EVaAfizZiA_SECRXmKbUmodUeDF2vlkN6owPX3fspHS23q-OB9yHNu4uL4VoAWJGRxGVKX0EruLR03a9KAmt5jtx8jGeA2zbDpctCEMy5QcjcMG9g1L3JKEhwefxKjdc9kFvRTMfqBxyAWgalBBn3kV5rGuA2LgnwqSaSgvVa7HlZRriQj0VCU3pvsDf5-7itJrINpbuCQFKMkyicC_JuiDw3qr9KAiMXRPrN-Ep91drZF6ixMqYsWhjD81Q51XOw7D25eKQODNaZgIi1QMnHqnoAsnbp9qdulCs0-Qawp7TEGjux2sUCTIpV-YrcCe7aGtRoocxgJPTW8fJ9X8LDrFUeGfFjt4QUi4ZZNMuGnzw0xcSyAUyIOn0No_Y11nRAzJ...

Source: https://ok0.atsaikhan6.com/IQaZOv2mXr6yjL1pHyt37Ipg/	HTTP Parser: No favicon
Source: https://ok0.atsaikhan6.com/IQaZOv2mXr6yjL1pHyt37Ipg/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon
Source: https://www.yahoo.com/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:55207 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.228.174.117:443 -> 192.168.2.16:64541 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.142.77

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: framerusercontent.com
Source: global traffic	DNS traffic detected: DNS query: events.framer.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ok0.atsaikhan6.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: xwl6n.gatertati.ru
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: www.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: s.yimg.com
Source: global traffic	DNS traffic detected: DNS query: geo.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: geo.query.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: search.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: consent.cmp.oath.com
Source: global traffic	DNS traffic detected: DNS query: guce.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: udc.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: edge-mcdn.secure.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: securepubads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: cdn.taboola.com
Source: global traffic	DNS traffic detected: DNS query: opus.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: noa.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: pbs.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: idx.liadm.com
Source: global traffic	DNS traffic detected: DNS query: ups.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: gps-aa.ybp.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: fastlane.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: prebid.media.net
Source: global traffic	DNS traffic detected: DNS query: hbopenbid.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: c2shb-oao.ssp.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: htlb.casalemedia.com
Source: global traffic	DNS traffic detected: DNS query: bidder.criteo.com
Source: global traffic	DNS traffic detected: DNS query: ads.yieldmo.com
Source: global traffic	DNS traffic detected: DNS query: tlx.3lift.com
Source: global traffic	DNS traffic detected: DNS query: display.bidder.taboola.com
Source: global traffic	DNS traffic detected: DNS query: rtb.openx.net
Source: global traffic	DNS traffic detected: DNS query: rp.liadm.com
Source: global traffic	DNS traffic detected: DNS query: trc.taboola.com
Source: global traffic	DNS traffic detected: DNS query: pa.ybp.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: ssum-sec.casalemedia.com
Source: global traffic	DNS traffic detected: DNS query: prebid.a-mo.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: wnsrvbjmeprtfrnfx.ay.delivery
Source: global traffic	DNS traffic detected: DNS query: assets.a-mo.net
Source: global traffic	DNS traffic detected: DNS query: pm-widget.taboola.com
Source: global traffic	DNS traffic detected: DNS query: gum.criteo.com
Source: global traffic	DNS traffic detected: DNS query: api.taboola.com
Source: global traffic	DNS traffic detected: DNS query: ssp-sync.criteo.com
Source: global traffic	DNS traffic detected: DNS query: tsdtocl.com
Source: global traffic	DNS traffic detected: DNS query: x.bidswitch.net
Source: global traffic	DNS traffic detected: DNS query: pixel.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: id.a-mx.com
Source: global traffic	DNS traffic detected: DNS query: cm.adform.net
Source: global traffic	DNS traffic detected: DNS query: image8.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: ssum.casalemedia.com
Source: global traffic	DNS traffic detected: DNS query: ap.lijit.com
Source: global traffic	DNS traffic detected: DNS query: contextual.media.net
Source: global traffic	DNS traffic detected: DNS query: js-sec.indexww.com
Source: global traffic	DNS traffic detected: DNS query: eb2.3lift.com
Source: global traffic	DNS traffic detected: DNS query: yahoo-bidout-d.openx.net
Source: global traffic	DNS traffic detected: DNS query: eus.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: ads.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: static.criteo.net
Source: global traffic	DNS traffic detected: DNS query: sync.a-mo.net
Source: global traffic	DNS traffic detected: DNS query: pips.taboola.com
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: match.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: pixel.tapad.com
Source: global traffic	DNS traffic detected: DNS query: cds.taboola.com
Source: global traffic	DNS traffic detected: DNS query: hbx.media.net
Source: global traffic	DNS traffic detected: DNS query: secure-assets.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: p.rfihub.com
Source: global traffic	DNS traffic detected: DNS query: sync-tm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: pr-bh.ybp.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: image6.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: tags.bluekai.com
Source: global traffic	DNS traffic detected: DNS query: yahoo-match.dotomi.com
Source: global traffic	DNS traffic detected: DNS query: images.taboola.com
Source: global traffic	DNS traffic detected: DNS query: cdn.ampproject.org
Source: global traffic	DNS traffic detected: DNS query: rtb.gumgum.com
Source: global traffic	DNS traffic detected: DNS query: s.amazon-adsystem.com
Source: global traffic	DNS traffic detected: DNS query: c21lg-d.media.net
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: sync.srv.stackadapt.com
Source: global traffic	DNS traffic detected: DNS query: sync.go.sonobi.com
Source: global traffic	DNS traffic detected: DNS query: medianet-match.dotomi.com
Source: global traffic	DNS traffic detected: DNS query: us-u.openx.net
Source: global traffic	DNS traffic detected: DNS query: sync.1rx.io
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: aa.agkn.com
Source: global traffic	DNS traffic detected: DNS query: uipglob.semasio.net
Source: global traffic	DNS traffic detected: DNS query: pm.w55c.net
Source: global traffic	DNS traffic detected: DNS query: token.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: aax-eu.amazon-adsystem.com
Source: global traffic	DNS traffic detected: DNS query: la-trc-events.taboola.com
Source: global traffic	DNS traffic detected: DNS query: cms.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: sync.crwdcntrl.net

Source: The Podor Law Firm -23749-24 .pdf	Initial sample: http://www.podorlaw.com/
Source: The Podor Law Firm -23749-24 .pdf	Initial sample: tel:\(941\
Source: The Podor Law Firm -23749-24 .pdf	Initial sample: https://podorlaw.framer.website/

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\The Podor Law Firm -23749-24 .pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1552,i,15958377352133413966,15368759146307475637,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1552,i,15958377352133413966,15368759146307475637,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://podorlaw.framer.website/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1852,i,15172311978042768892,5140578951366074874,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://podorlaw.framer.website/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1852,i,15172311978042768892,5140578951366074874,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7484 --field-trial-handle=1852,i,15172311978042768892,5140578951366074874,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7484 --field-trial-handle=1852,i,15172311978042768892,5140578951366074874,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: The Podor Law Firm -23749-24 .pdf	Initial sample: PDF keyword /JS count = 0
Source: The Podor Law Firm -23749-24 .pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
securepubads.g.doubleclick.net	216.58.206.66	true	false	unknown
um.simpli.fi	34.91.62.186	true	false	unknown
d3f1y6rso5ozvw.cloudfront.net	13.32.110.81	true	false	unknown
tls13.taboola.map.fastly.net	151.101.193.44	true	false	unknown
static.nl3.vip.prod.criteo.net	178.250.1.3	true	false	unknown
global.px.quantserve.com	91.228.74.244	true	false	unknown
ssum.casalemedia.com	172.64.151.101	true	false	unknown
prebid.media.net	34.120.63.153	true	false	unknown
metrics.getrockerbox.com	172.67.71.65	true	false	unknown
d-ams1.turn.com	46.228.164.13	true	false	unknown
live.rezync.com	13.32.27.83	true	false	unknown
rtb.openx.net	35.227.252.103	true	false	unknown
bttrack.com	192.132.33.67	true	false	unknown
cdn.w55c.net	3.73.6.255	true	false	unknown
crb.kargo.com	3.73.131.236	true	false	unknown
dualstack.tls13.taboola.map.fastly.net	151.101.129.44	true	false	unknown
mwzeom.zeotap.com	104.22.50.98	true	false	unknown
dsum.casalemedia.com	172.64.151.101	true	false	unknown
www.google.com	216.58.206.36	true	false	unknown
imagsync-lhrpairbc.pubmatic.com	185.64.191.214	true	false	unknown
sync.intentiq.com	3.165.206.7	true	false	unknown
am-api-app-1554730937.eu-west-1.elb.amazonaws.com	54.154.61.135	true	false	unknown
noa-atsv2.media.g03.yahoodns.net	188.125.72.139	true	false	unknown
d3fxn7cse5tdjr.cloudfront.net	52.222.169.125	true	false	unknown
yahoo.com	74.6.231.21	true	false	unknown
id.rlcdn.com	35.244.174.68	true	false	unknown
idaas6.cph.liveintent.com	52.72.24.52	true	false	unknown
match.adsrvr.org	52.223.40.198	true	false	unknown
dsp-cookie.adfarm1.adition.com	80.82.210.217	true	false	unknown
ow-lhrc.pubmnet.com	185.64.190.84	true	false	unknown
match.prod.bidr.io	52.215.85.40	true	false	unknown
pagead-googlehosted.l.google.com	216.58.206.33	true	false	unknown
chidc2.outbrain.org	50.31.142.63	true	false	unknown
creativecdn.com	185.184.8.90	true	false	unknown
privacycollector-production-457481513.us-east-1.elb.amazonaws.com	3.221.148.157	true	false	unknown
d1giprow6b9psh.cloudfront.net	13.32.27.88	true	false	unknown
uip.semasio.net	77.243.51.122	true	false	unknown
zeta-ssp-385516103.us-east-1.elb.amazonaws.com	34.226.169.4	true	false	unknown
ActivationEdge-activation-1631408035.eu-central-1.elb.amazonaws.com	54.93.106.178	true	false	unknown
m.deepintent.com	8.18.47.7	true	false	unknown
nld-prebid.a-mx.net	163.5.194.37	true	false	unknown
choices.truste.com	52.85.49.85	true	false	unknown
edge-prebid-cdn.g03.yahoodns.net	87.248.119.251	true	false	unknown
pug-lhr-bc.pubmnet.com	185.64.191.210	true	false	unknown
pixel-sync.sitescout.com	34.36.216.150	true	false	unknown
pixel.onaudience.com	54.38.113.2	true	false	unknown
sync-yieldmo-com-tf-1869548451.eu-west-1.elb.amazonaws.com	18.200.97.135	true	false	unknown
euw-ice.360yield.com	54.154.146.217	true	false	unknown
ssum-sec.casalemedia.com	104.18.36.155	true	false	unknown
ActivationEdge-activation-212358690.eu-west-1.elb.amazonaws.com	34.251.73.197	true	false	unknown
googleads.g.doubleclick.net	172.217.16.194	true	false	unknown
presentation-ams1.turn.com	46.228.164.11	true	false	unknown
d1dvhck2p605dz.cloudfront.net	18.244.18.122	true	false	unknown
rtb.adgrx.com	52.215.155.11	true	false	unknown
widget.us5.vip.prod.criteo.com	74.119.117.16	true	false	unknown
la-vip001.taboola.com	141.226.230.48	true	false	unknown
www.googletagservices.com	216.58.206.34	true	false	unknown
hbx.media.net	23.212.88.20	true	false	unknown
iad-2-sync.go.sonobi.com	69.166.1.35	true	false	unknown
am1-direct-bgp.contextweb.com	208.93.169.131	true	false	unknown
nlb-dflb-496f722d06cc67e2.elb.eu-north-1.amazonaws.com	13.50.192.155	true	false	unknown
ok0.atsaikhan6.com	172.67.128.126	true	false	unknown
pugm-amsfpairbc.pubmnet.com	198.47.127.19	true	false	unknown
pixel-eu.onaudience.com	54.38.113.2	true	false	unknown
cs550162656.adn.psicdn.net	152.195.53.200	true	false	unknown
contextual.media.net	88.221.124.22	true	false	unknown
core.iprom.net	195.5.165.20	true	false	unknown
tsdtocl.com	151.101.1.44	true	false	unknown
widget.nl3.vip.prod.criteo.com	178.250.1.9	true	false	unknown
id.a-mx.com	79.127.216.47	true	false	unknown
ad.mrtnsvr.com	34.102.163.6	true	false	unknown
sync.srv.stackadapt.com	54.204.123.228	true	false	unknown
thrtle.com	3.208.104.23	true	false	unknown
pixel.tapad.com	34.111.113.62	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
pippio.com	107.178.254.65	true	false	unknown
sync.ipredictive.com	54.146.101.218	true	false	unknown
wnsrvbjmeprtfrnfx.ay.delivery	172.67.149.20	true	false	unknown
prod-rotation-v2.guce.aws.oath.cloud	52.18.189.240	true	false	unknown
s.amazon-adsystem.com	52.46.130.91	true	false	unknown
ad.doubleclick.net	142.250.184.230	true	false	unknown
aax-eu.amazon-adsystem.com	67.220.228.201	true	false	unknown
tag-terraform-elb-1705565586.eu-central-1.elb.amazonaws.com	18.193.63.175	true	false	unknown
imgsync-amsfpairbc.pubmnet.com	198.47.127.18	true	false	unknown
xwl6n.gatertati.ru	188.114.96.3	true	false	unknown
ipac.ctnsnet.com	35.186.193.173	true	false	unknown
trace.mediago.io	35.208.249.213	true	false	unknown
geo-atsv2.media.g03.yahoodns.net	188.125.72.139	true	false	unknown
ssp-sync.nl3.vip.prod.criteo.com	178.250.1.7	true	false	unknown
outspot2-ams.adx.opera.com	82.145.213.8	true	false	unknown
match.adsby.bidtheatre.com	188.166.17.21	true	false	unknown
aws-bid-global.ybp.gysm.yahoodns.net	52.209.9.255	true	false	unknown
ib.anycast.adnxs.com	185.89.210.153	true	false	unknown
dsp.nrich.ai	51.255.68.171	true	false	unknown
edge.gycpi.b.yahoodns.net	87.248.119.251	true	false	unknown
matching.truffle.bid	162.55.120.196	true	false	unknown
uipus.semasio.net	50.57.31.206	true	false	unknown
framerusercontent.com	108.138.7.11	true	false	unknown
events.framer.com	13.249.9.35	true	false	unknown
bidder.nl3.vip.prod.criteo.com	178.250.1.8	true	false	unknown

Name	Malicious	Reputation
https://podorlaw.framer.website/	true	unknown
https://www.yahoo.com/	false	unknown
https://ok0.atsaikhan6.com/IQaZOv2mXr6yjL1pHyt37Ipg/	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.16.134	unknown	United States	15169	GOOGLEUS	false
37.252.171.149	unknown	European Union	29990	ASN-APPNEXUS	false
54.221.222.74	unknown	United States	14618	AMAZON-AESUS	false
142.250.185.102	unknown	United States	15169	GOOGLEUS	false
185.89.210.153	ib.anycast.adnxs.com	Germany	29990	ASN-APPNEXUS	false
142.250.185.226	unknown	United States	15169	GOOGLEUS	false
34.160.236.64	tagr-pixel-nginx-odr-euw4.mookie1.com	United States	2686	ATGS-MMD-ASUS	false
18.193.63.175	tag-terraform-elb-1705565586.eu-central-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
88.221.169.246	unknown	European Union	16625	AKAMAI-ASUS	false
63.215.202.172	unknown	United States	41041	VCLK-EU-SE	false
212.82.100.137	ds-global3.l7.search.ystg1.b.yahoo.com	United Kingdom	34010	YAHOO-IRDGB	false
185.89.210.20	unknown	Germany	29990	ASN-APPNEXUS	false
198.47.127.205	pug-ams-bc.pubmnet.com	United States	62713	AS-PUBMATICUS	false
199.232.210.172	unknown	United States	54113	FASTLYUS	false
204.79.197.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.193.44	tls13.taboola.map.fastly.net	United States	54113	FASTLYUS	false
35.214.199.88	dorpat.geo.iponweb.net	United States	19527	GOOGLE-2US	false
37.157.6.243	unknown	Denmark	198622	ADFORMDK	false
37.157.2.229	unknown	Denmark	198622	ADFORMDK	false
18.239.69.2	unknown	United States	16509	AMAZON-02US	false
151.101.130.49	unknown	United States	54113	FASTLYUS	false
172.217.18.6	unknown	United States	15169	GOOGLEUS	false
172.217.18.2	unknown	United States	15169	GOOGLEUS	false
151.101.1.44	tsdtocl.com	United States	54113	FASTLYUS	false
52.85.49.39	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
107.178.254.65	pippio.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.65.44	unknown	United States	54113	FASTLYUS	false
152.195.53.200	cs550162656.adn.psicdn.net	United States	15133	EDGECASTUS	false
172.67.149.20	wnsrvbjmeprtfrnfx.ay.delivery	United States	13335	CLOUDFLARENETUS	false
37.157.6.232	unknown	Denmark	198622	ADFORMDK	false
108.138.7.11	framerusercontent.com	United States	16509	AMAZON-02US	false
3.73.131.236	crb.kargo.com	United States	16509	AMAZON-02US	false
54.72.145.176	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
216.58.206.34	www.googletagservices.com	United States	15169	GOOGLEUS	false
34.251.73.197	ActivationEdge-activation-212358690.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
216.58.206.33	pagead-googlehosted.l.google.com	United States	15169	GOOGLEUS	false
23.21.239.242	unknown	United States	14618	AMAZON-AESUS	false
18.157.230.4	unknown	United States	16509	AMAZON-02US	false
208.93.169.131	am1-direct-bgp.contextweb.com	United States	26228	SERVEPATHUS	false
142.250.181.234	unknown	United States	15169	GOOGLEUS	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
87.248.119.251	edge-prebid-cdn.g03.yahoodns.net	United Kingdom	203220	YAHOO-DEBDE	false
87.248.119.252	unknown	United Kingdom	203220	YAHOO-DEBDE	false
3.224.137.232	idaas-ext.cph.liveintent.com	United States	14618	AMAZON-AESUS	false
52.215.155.11	rtb.adgrx.com	United States	16509	AMAZON-02US	false
178.250.1.8	bidder.nl3.vip.prod.criteo.com	France	44788	ASN-CRITEO-EUROPEFR	false
178.250.1.9	widget.nl3.vip.prod.criteo.com	France	44788	ASN-CRITEO-EUROPEFR	false
178.250.1.7	ssp-sync.nl3.vip.prod.criteo.com	France	44788	ASN-CRITEO-EUROPEFR	false
35.186.154.107	cm-supply-web.gammaplatform.com	United States	15169	GOOGLEUS	false
88.221.124.22	contextual.media.net	European Union	16625	AKAMAI-ASUS	false
18.244.18.122	d1dvhck2p605dz.cloudfront.net	United States	16509	AMAZON-02US	false
178.250.1.3	static.nl3.vip.prod.criteo.net	France	44788	ASN-CRITEO-EUROPEFR	false
130.211.44.5	rtbc-ew1.doubleverify.com	United States	15169	GOOGLEUS	false
35.71.142.77	unknown	United States	237	MERIT-AS-14US	false
13.227.219.100	unknown	United States	16509	AMAZON-02US	false
3.160.150.33	unknown	United States	16509	AMAZON-02US	false
34.102.163.6	ad.mrtnsvr.com	United States	15169	GOOGLEUS	false
211.120.53.206	unknown	Japan	4694	IDCFIDCFrontierIncJP	false
104.22.50.98	mwzeom.zeotap.com	United States	13335	CLOUDFLARENETUS	false
52.48.57.149	tag.device9.com	United States	16509	AMAZON-02US	false
51.75.86.98	onetag-sys.com	France	16276	OVHFR	false
172.217.16.130	unknown	United States	15169	GOOGLEUS	false
46.228.174.117	sync.1rx.io	United Kingdom	56396	TURNGB	false
172.217.16.131	unknown	United States	15169	GOOGLEUS	false
52.19.210.19	unknown	United States	16509	AMAZON-02US	false
13.249.9.35	events.framer.com	United States	16509	AMAZON-02US	false
104.26.8.177	unknown	United States	13335	CLOUDFLARENETUS	false
91.228.74.244	global.px.quantserve.com	United Kingdom	27281	QUANTCASTUS	false
13.32.27.11	unknown	United States	7018	ATT-INTERNET4US	false
23.211.9.109	unknown	United States	16625	AKAMAI-ASUS	false
104.18.37.193	unknown	United States	13335	CLOUDFLARENETUS	false
52.72.24.52	idaas6.cph.liveintent.com	United States	14618	AMAZON-AESUS	false
172.67.71.65	metrics.getrockerbox.com	United States	13335	CLOUDFLARENETUS	false
8.18.47.7	m.deepintent.com	United States	32662	GMCRUS	false
3.165.206.7	sync.intentiq.com	United States	16509	AMAZON-02US	false
2.23.197.190	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
52.215.85.40	match.prod.bidr.io	United States	16509	AMAZON-02US	false
2.19.104.189	unknown	European Union	16625	AKAMAI-ASUS	false
52.222.169.125	d3fxn7cse5tdjr.cloudfront.net	United States	16509	AMAZON-02US	false
198.47.127.20	spug-amsfpairbc.pubmnet.com	United States	62713	AS-PUBMATICUS	false
68.67.153.61	unknown	United States	29990	ASN-APPNEXUS	false
142.250.184.228	unknown	United States	15169	GOOGLEUS	false
18.165.122.33	unknown	United States	3	MIT-GATEWAYSUS	false
54.246.206.28	unknown	United States	16509	AMAZON-02US	false
3.124.64.248	eu-tlx.3lift.com	United States	16509	AMAZON-02US	false
142.250.184.230	ad.doubleclick.net	United States	15169	GOOGLEUS	false
172.67.128.126	ok0.atsaikhan6.com	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
54.38.113.2	pixel.onaudience.com	France	16276	OVHFR	false
104.18.36.155	ssum-sec.casalemedia.com	United States	13335	CLOUDFLARENETUS	false
104.18.38.76	js-sec.indexww.com	United States	13335	CLOUDFLARENETUS	false
13.107.42.14	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.48.24.212	unknown	United States	16509	AMAZON-02US	false
2.23.197.184	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
198.47.127.19	pugm-amsfpairbc.pubmnet.com	United States	62713	AS-PUBMATICUS	false
3.165.206.15	unknown	United States	16509	AMAZON-02US	false
198.47.127.18	imgsync-amsfpairbc.pubmnet.com	United States	62713	AS-PUBMATICUS	false
63.215.202.140	unknown	United States	41041	VCLK-EU-SE	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1514015
Start date and time:	2024-09-19 17:36:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	The Podor Law Firm -23749-24 .pdf
Detection:	MAL
Classification:	mal56.phis.winPDF@85/327@863/736
Cookbook Comments:	Found application associated with file extension: .pdf

Input	Output
URL: PDF document Model: jbxai	{ "brand":["The Podor Law Firm"], "contains_trigger_text":true, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":true, "has_visible_qrcode":false}

URL: https://podorlaw.framer.website/ Model: jbxai	{ "brand":["THE POI)OR LAW FIRM AT LAW"], "contains_trigger_text":true, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":true, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://podorlaw.framer.website/ Model: jbxai	{ "brand":["THE POODOR LAW FIRM"], "contains_trigger_text":true, "prominent_button_name":"REVIEW DOCUMENT HERE", "text_input_field_labels":["unknown"], "pdf_icon_visible":true, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ok0.atsaikhan6.com/IQaZOv2mXr6yjL1pHyt37Ipg/ Model: jbxai	{ "brand":["CLOUDFLARE"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ok0.atsaikhan6.com/IQaZOv2mXr6yjL1pHyt37Ipg/ Model: jbxai	{ "brand":["CLOUDFLARE"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.yahoo.com/ Model: jbxai	{ "brand":["yahoo"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.yahoo.com/ Model: jbxai	{ "brand":["Yahoo"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.yahoo.com/ Model: jbxai	{ "brand":["Yahoo"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.yahoo.com/ Model: jbxai	{ "brand":["Yahoo"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.yahoo.com/ Model: jbxai	{ "brand":["yahoo"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	4C313FE514B5F4E7E89329630909F8DC
SHA1:	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
SHA-256:	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
SHA-512:	1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Sep 19 14:37:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.996036292508543
Encrypted:	false
SSDEEP:
MD5:	963DB69D594C32CE65A027883EB42C83
SHA1:	49F16FEAF40D07EE5371E3B512DA2A0FA62F694B
SHA-256:	470CB3AEAE40D4D3F1502AB7074D0ECD8CE04E1C671B6F883754D0DB28CBB1B1
SHA-512:	E94F4BE7D9D06F90C2314F2C5F667DF31DDF037F77ED34808CFF7A815922735C21EED851EF936B225C392FBC6015700E8DA1591B63E54A1C9BD7B2B746DD2B93
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......P....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I3Y.\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V3Y.\|....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V3Y.\|....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V3Y.\|..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V3Y.\|...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............<QJ.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	PDF document, version 1.7, 1 pages
Entropy (8bit):	7.964123875826356
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	The Podor Law Firm -23749-24 .pdf
File size:	204'861 bytes
MD5:	28124d5273aa58ad48d10e40b26aef4e
SHA1:	e8e09e4153b91dc41be0ad56049df5d077240781
SHA256:	42624288479d0ec84ea79ef8170a243153d57a1d979546b7ebbe807c4beeeb90
SHA512:	ac7b560a76f5547c7367f7698331c9f8173ca2a972c9f4b2ce97945aaeddf3941ed2c65e86dd83dd51708266d6711725ec5aba45d5504b625a56f9689bfaeb5e
SSDEEP:	3072:8Ll9cdu4tw2wLVSwFofz8cIdNhTDd3fSE47EElNsNcJCyE8/3F9q0a5wi0sbgQaX:8Ll2pgVtoFIdnDAyNeEwi0a54sbWJkHI
TLSH:	6A14010ADA48ADDCE19587861E673CB5A35EF33671C80415BE7E84C38340F3ED8AB55A
File Content Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 30 0 R/MarkInfo<</Marked true>>/Metadata 88 0 R/ViewerPreferences 89 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 1/Kids[ 3 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/R

General
Header:	%PDF-1.7
Total Entropy:	7.964124
Total Bytes:	204861
Stream Entropy:	7.987124
Stream Bytes:	194902
Entropy outside Streams:	5.084469
Bytes outside Streams:	9959
Number of EOF found:	2
Bytes after EOF:

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report The Podor Law Firm -23749-24 .pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF542820.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e4e13089-dcb7-4c01-b473-98e8b03247d1.tmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240919153722Z-161.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6916

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-19 11-37-20-801.log

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Windows Analysis Report
The Podor Law Firm -23749-24 .pdf

Name	Count
obj	47
endobj	47
stream	13
endstream	13
xref	2
trailer	2
startxref	2
/Page	1
/Encrypt	0
/ObjStm	1
/URI	6
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

ID	DHASH	MD5
26	3030b235aca8c9e8	5587dbd5ec6deccbe88e58c1ada598b0
27	e0c4a69ca53c65e1	6dfe59697f489b77395e50ef2a354874
28	f0c0b2a2a2b280f1	3578dbb3f7ebccf7e5d03744ccde7062

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre