Edit tour

Windows Analysis Report
WOT0089836_Electrical_Single_Line_diagram%2C_lighting__RR_docx_3461849704.pdf

Overview

General Information

Sample name:	WOT0089836_Electrical_Single_Line_diagram%2C_lighting__RR_docx_3461849704.pdf
Analysis ID:	1514330
MD5:	8f06ead80737911d98638dedbd869e4a
SHA1:	2619ccd7e9f115b643bb635fb004a665aa2d2bfb
SHA256:	0e22cf742a29393600106642009d4c7881ab79d36eee8345062fb2aa3ffadeff
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Contains long sleeps (>= 3 min)

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Drops files with a non-matching file extension (content does not match file extension)

Found iframes

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 4948 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\WOT0089836_Electrical_Single_Line_diagram%2C_lighting__RR_docx_3461849704.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AdobeCollabSync.exe (PID: 7120 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c MD5: 8A41FC5F946230805512B943C45AC9D8)

AdobeCollabSync.exe (PID: 7232 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=7120 MD5: 8A41FC5F946230805512B943C45AC9D8)

FullTrustNotifier.exe (PID: 7428 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe" GetChannelUri MD5: 92366A2F482926C3D0DD02D6F952F742)

AdobeCollabSync.exe (PID: 7340 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c MD5: 8A41FC5F946230805512B943C45AC9D8)

AdobeCollabSync.exe (PID: 7380 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=7340 MD5: 8A41FC5F946230805512B943C45AC9D8)

AcroCEF.exe (PID: 7492 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7684 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1552,i,2919846917026481936,14946802051647010614,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 1612 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "http://mailto:JPanakkathodan@eagle.org" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2828 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1704,i,8628428184620853746,18433794646278118704,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4732 --field-trial-handle=1704,i,8628428184620853746,18433794646278118704,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7316 --field-trial-handle=1704,i,8628428184620853746,18433794646278118704,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://login.microsoftonline.de

Avira URL Cloud: Label: phishing

Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-4HPVSQD42N&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=564289405
Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-N2SC3SX46M&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=1829942690
Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-4HPVSQD42N&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=564289405
Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-N2SC3SX46M&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=1829942690
Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-4HPVSQD42N&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=564289405
Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-N2SC3SX46M&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=1829942690
Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-4HPVSQD42N&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=564289405
Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-N2SC3SX46M&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=1829942690
Source: https://ww2.eagle.org/en.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/rules-and-resources/regulatory-updates.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/rules-and-resources/regulatory-updates.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/rules-and-resources/regulatory-updates.html	HTTP Parser: Iframe src: https://login.eagle.org/absauthprod.onmicrosoft.com/b2c_1a_abs_signin_mfa/oauth2/v2.0/authorize?client_id=467d8383-74ee-4698-a09c-9fb2b501bdfa&scope=openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fww2.eagle.org%2Fen.html&client-request-id=c1826a72-7a63-4058-b262-100862355d40&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.35.0&client_info=1&code_challenge=IRZSo_LjYcazQXmbGyD3aELE1NsvXz2Ls2yYDwDfVB8&code_challenge_method=S256&prompt=none&nonce=1684467b-3681-4593-a4d4-6b454579b09a&state=eyJpZCI6ImI0NTA1YTk0LTE0ZGUtNGY1NS1hNzg1LTE2NDI2ZDE2ZDdhNyIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19
Source: https://ww2.eagle.org/en/rules-and-resources/regulatory-updates.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/rules-and-resources/regulatory-updates.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://view.ceros.com/abs/coming-soon-header-3
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://pub-rm20.apps.eagle.org
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://view.ceros.com/abs/coming-soon-header-3
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://pub-rm20.apps.eagle.org
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://view.ceros.com/abs/coming-soon-header-3
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://pub-rm20.apps.eagle.org
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://view.ceros.com/abs/coming-soon-header-3
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://pub-rm20.apps.eagle.org
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://view.ceros.com/abs/coming-soon-header-3
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://pub-rm20.apps.eagle.org
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/rules-and-resources.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/rules-and-resources.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/rules-and-resources.html	HTTP Parser: Iframe src: https://login.eagle.org/absauthprod.onmicrosoft.com/b2c_1a_abs_signin_mfa/oauth2/v2.0/authorize?client_id=467d8383-74ee-4698-a09c-9fb2b501bdfa&scope=openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fww2.eagle.org%2Fen.html&client-request-id=427f23d5-e6f0-4fb2-8127-718d0bf71f30&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.35.0&client_info=1&code_challenge=ooa361AH8dSEIX1kbM6eh0pb-P0HiNYI3nbBmwRJ8ow&code_challenge_method=S256&prompt=none&nonce=a51f7ff6-bc8a-4b10-85ed-e55b72f56329&state=eyJpZCI6IjE0ZDQ0ZGIxLTdlOTMtNDgwYS1iOGUzLWIwYTdiM2M2N2QyMyIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19
Source: https://ww2.eagle.org/en/rules-and-resources.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/rules-and-resources.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/rules-and-resources/databases.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/rules-and-resources/databases.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/rules-and-resources/databases.html	HTTP Parser: Iframe src: https://login.eagle.org/absauthprod.onmicrosoft.com/b2c_1a_abs_signin_mfa/oauth2/v2.0/authorize?client_id=467d8383-74ee-4698-a09c-9fb2b501bdfa&scope=openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fww2.eagle.org%2Fen.html&client-request-id=c199cd92-2d19-467e-8faa-8b3232a3e438&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.35.0&client_info=1&code_challenge=T4irX7HFCxuDAEHrueG2d32IpZgOnrb7KWH1nb3i-qI&code_challenge_method=S256&prompt=none&nonce=088aebd1-be1e-4935-b401-0a808b8606c5&state=eyJpZCI6IjIwMjgzYTBmLTdmYjItNDViYy05YzA2LTcxNThmMGY5NzU3MiIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19
Source: https://ww2.eagle.org/en/rules-and-resources/databases.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/rules-and-resources/databases.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/Products-and-Services/abs-company-or-ship-audit.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/Products-and-Services/abs-company-or-ship-audit.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/Products-and-Services/abs-company-or-ship-audit.html	HTTP Parser: Iframe src: https://login.eagle.org/absauthprod.onmicrosoft.com/b2c_1a_abs_signin_mfa/oauth2/v2.0/authorize?client_id=467d8383-74ee-4698-a09c-9fb2b501bdfa&scope=openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fww2.eagle.org%2Fen.html&client-request-id=fec1b49f-4308-45b4-a6d9-b996e5a8319b&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.35.0&client_info=1&code_challenge=dIvWWJVfghig60r_ZxhwujZY9kATHp7Qd1a6BYHehO4&code_challenge_method=S256&prompt=none&nonce=2fe7b691-ed1d-4654-ae03-bba099a7d6fe&state=eyJpZCI6IjQ3OGE0MTgxLWRhYjctNGNhZC1hZjc2LTNkOGVhNmU1ZDgxNSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19
Source: https://ww2.eagle.org/en/Products-and-Services/abs-company-or-ship-audit.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/Products-and-Services/abs-company-or-ship-audit.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-4HPVSQD42N&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=1110868216
Source: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-N2SC3SX46M&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=51561915
Source: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html	HTTP Parser: Iframe src: https://login.eagle.org/absauthprod.onmicrosoft.com/b2c_1a_abs_signin_mfa/oauth2/v2.0/authorize?client_id=467d8383-74ee-4698-a09c-9fb2b501bdfa&scope=openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fww2.eagle.org%2Fen.html&client-request-id=00572633-5cd8-4320-8b7d-bf0d4d1851e0&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.35.0&client_info=1&code_challenge=mO3W3oG7fY9tWUy7pQS4J-wEG1oLorfV8HiuqgkZ7WM&code_challenge_method=S256&prompt=none&nonce=14f3e306-8520-4adf-9b15-1e5b8fa3d266&state=eyJpZCI6ImE1YjIxOGNjLWZkZDgtNDg3Yi1iM2M1LTNlNDgyYTQ4YTVlZCIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19
Source: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-4HPVSQD42N&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=1110868216
Source: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-N2SC3SX46M&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=51561915
Source: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: Iframe src: https://login.eagle.org/absauthprod.onmicrosoft.com/b2c_1a_abs_signin_mfa/oauth2/v2.0/authorize?client_id=467d8383-74ee-4698-a09c-9fb2b501bdfa&scope=openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fww2.eagle.org%2Fen.html&client-request-id=7ebbf436-8c89-4fdc-9be0-8055c90cfc25&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.35.0&client_info=1&code_challenge=ZPqwGEBSLRG_s6m-VwwDuXF2nl7uKxUc7PVC-DBCQJ8&code_challenge_method=S256&prompt=none&nonce=8edb1830-12be-45f0-87c0-b2de33b18088&state=eyJpZCI6ImNhMjJiZjRhLWM4MmYtNDUyYy1hMGIwLWZkYWRhY2Y3ODZmOCIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/my-eagle-user-id-request.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/my-eagle-user-id-request.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/my-eagle-user-id-request.html	HTTP Parser: Iframe src: https://login.eagle.org/absauthprod.onmicrosoft.com/b2c_1a_abs_signin_mfa/oauth2/v2.0/authorize?client_id=467d8383-74ee-4698-a09c-9fb2b501bdfa&scope=openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fww2.eagle.org%2Fen.html&client-request-id=ef75e680-3661-4a29-b76d-bf84ed1e75fe&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.35.0&client_info=1&code_challenge=GStzvwoNjvgtjAbQWj1boZ0OmCNmN97qrZDHEQmRwNs&code_challenge_method=S256&prompt=none&nonce=d271b1e8-547f-4940-be80-7ce2ff2d2d34&state=eyJpZCI6IjhjYTAwNDFjLTA0MWQtNGNmMS1iZDE2LWU4YTA2ZDQ3MzkxMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19
Source: https://ww2.eagle.org/en/my-eagle-user-id-request.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/my-eagle-user-id-request.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: Iframe src: //www.youtube.com/embed/HF3IU0B3_fM
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: Iframe src: //www.youtube.com/embed/HF3IU0B3_fM
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: Iframe src: //www.youtube.com/embed/HF3IU0B3_fM
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: Iframe src: https://login.eagle.org/absauthprod.onmicrosoft.com/b2c_1a_abs_signin_mfa/oauth2/v2.0/authorize?client_id=467d8383-74ee-4698-a09c-9fb2b501bdfa&scope=openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fww2.eagle.org%2Fen.html&client-request-id=146ff2dd-e9a4-4363-a2c7-a7cc57e6cc21&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.35.0&client_info=1&code_challenge=ilyT9v8UHxyRpO2F7K0sxbcN0iWjj94yOrBnLkva6rQ&code_challenge_method=S256&prompt=none&nonce=7a3c3a86-c4c4-433c-807a-a4e9b2c675e0&state=eyJpZCI6IjI4ZjAyMjRiLTRjNmMtNGU4Ni1hZWFlLTZkMGE1MTExMDNkOCIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-4HPVSQD42N&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=382988683
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-N2SC3SX46M&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=973231215
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-4HPVSQD42N&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=382988683
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-N2SC3SX46M&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=973231215
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://login.eagle.org/absauthprod.onmicrosoft.com/b2c_1a_abs_signin_mfa/oauth2/v2.0/authorize?client_id=467d8383-74ee-4698-a09c-9fb2b501bdfa&scope=openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fww2.eagle.org%2Fen.html&client-request-id=6b04ef96-013a-4800-babf-48258591ff62&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.35.0&client_info=1&code_challenge=qTz5F0XboxoPV_AvWj3Sjcs-m9rnLB8p9JZAs3e7z5c&code_challenge_method=S256&prompt=none&nonce=7c6187b9-ac37-4e9e-9ee2-0fd537445535&state=eyJpZCI6IjBiZDQ1ZThlLTY2MGYtNGMwMC1hZWQwLTdhZTU4YTc5MWU1OSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-4HPVSQD42N&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=382988683
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-N2SC3SX46M&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=973231215
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-PB3WF3W
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-4HPVSQD42N&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=382988683
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-N2SC3SX46M&gacid=1377919292.1726807871&gtm=45je49j0v875365953z89115544616za200zb9115544616&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=973231215

Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html

HTTP Parser: Base64 decoded: {"version":3,"sources":["listdropdown.css"],"names":[],"mappings":"AAAA;;;EAGE;;AAEF;;;;EAIE","file":"listdropdown.css","sourcesContent":["/*\n * Copyright (c) 2003-2021, CKSource - Frederico Knabben. All rights reserved.\n * For licensing, see LICENSE.md...

Source: https://ww2.eagle.org/en.html	HTTP Parser: Title: American Bureau of Shipping (ABS) Eagle.org does not match URL
Source: https://ww2.eagle.org/en/rules-and-resources/regulatory-updates.html	HTTP Parser: Title: Regulatory Updates does not match URL
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: Title: Rules and Guides-V2 does not match URL
Source: https://ww2.eagle.org/en/rules-and-resources.html	HTTP Parser: Title: Rules and Resources does not match URL
Source: https://ww2.eagle.org/en/rules-and-resources/databases.html	HTTP Parser: Title: Databases does not match URL
Source: https://ww2.eagle.org/en/Products-and-Services/abs-company-or-ship-audit.html	HTTP Parser: Title: Company and Ship Audits does not match URL
Source: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html	HTTP Parser: Title: Engineering Reviews does not match URL
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: Title: Classification Services does not match URL
Source: https://ww2.eagle.org/en/my-eagle-user-id-request.html	HTTP Parser: Title: ABS MyFreedom Portal Registration does not match URL
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: Title: Academic Engagement does not match URL
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: Title: Approval and Certification does not match URL

Source: https://ww2.eagle.org/en.html	HTTP Parser: <input type="password" .../> found
Source: https://ww2.eagle.org/en/rules-and-resources/regulatory-updates.html	HTTP Parser: <input type="password" .../> found
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: <input type="password" .../> found
Source: https://ww2.eagle.org/en/rules-and-resources.html	HTTP Parser: <input type="password" .../> found
Source: https://ww2.eagle.org/en/rules-and-resources/databases.html	HTTP Parser: <input type="password" .../> found
Source: https://ww2.eagle.org/en/Products-and-Services/abs-company-or-ship-audit.html	HTTP Parser: <input type="password" .../> found
Source: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html	HTTP Parser: <input type="password" .../> found
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: <input type="password" .../> found
Source: https://ww2.eagle.org/en/my-eagle-user-id-request.html	HTTP Parser: <input type="password" .../> found
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: <input type="password" .../> found
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: <input type="password" .../> found

Source: https://ww2.eagle.org/en.html	HTTP Parser: No favicon
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: No favicon
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: No favicon

Source: https://ww2.eagle.org/en.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/rules-and-resources/regulatory-updates.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/rules-and-resources/regulatory-updates.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/rules-and-resources.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/rules-and-resources.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/rules-and-resources/databases.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/rules-and-resources/databases.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/Products-and-Services/abs-company-or-ship-audit.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/Products-and-Services/abs-company-or-ship-audit.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/my-eagle-user-id-request.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/my-eagle-user-id-request.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: No <meta name="author".. found
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: No <meta name="author".. found

Source: https://ww2.eagle.org/en.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/rules-and-resources/regulatory-updates.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/rules-and-resources/regulatory-updates.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/rules-and-resources.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/rules-and-resources.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/rules-and-resources/databases.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/rules-and-resources/databases.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/Products-and-Services/abs-company-or-ship-audit.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/Products-and-Services/abs-company-or-ship-audit.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/Products-and-Services/classification-services.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/my-eagle-user-id-request.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/my-eagle-user-id-request.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: No <meta name="copyright".. found
Source: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	HTTP Parser: No <meta name="copyright".. found

Source: Joe Sandbox View	IP Address: 13.107.246.42 13.107.246.42
Source: Joe Sandbox View	IP Address: 2.18.64.26 2.18.64.26
Source: Joe Sandbox View	IP Address: 184.28.88.176 184.28.88.176
Source: Joe Sandbox View	IP Address: 35.174.127.31 35.174.127.31

Source: chromecache_878.15.dr, chromecache_786.15.dr	String found in binary or memory: <a href="https://www.linkedin.com/company/american-bureau-of-shipping" target="_blank"> equals www.linkedin.com (Linkedin)
Source: chromecache_878.15.dr, chromecache_786.15.dr	String found in binary or memory: <a href="https://www.youtube.com/channel/UC0edKI1JGgLswjQNtK56hdg" target="_blank"> equals www.youtube.com (Youtube)
Source: chromecache_878.15.dr, chromecache_786.15.dr	String found in binary or memory: <a data-wpel-link="external" href="https://www.linkedin.com/company/american-bureau-of-shipping" onclick="data_layer(get_Name_Page(),getCurrentURL(),document.referrer,'linkedin link','footer','Linkclick',getUrl(this),get_Page_Channel())" target="_blank"> equals www.linkedin.com (Linkedin)
Source: chromecache_878.15.dr, chromecache_786.15.dr	String found in binary or memory: <a data-wpel-link="external" href="https://www.youtube.com/channel/UC0edKI1JGgLswjQNtK56hdg" onclick="data_layer(get_Name_Page(),getCurrentURL(),document.referrer,'youtube link','footer','Linkclick',getUrl(this),get_Page_Channel())" target="_blank"> equals www.youtube.com (Youtube)

Source: SecuritySettings.xml.0.dr	OLE indicator, VBA macros: true
Source: SecuritySettings.xml0.0.dr	OLE indicator, VBA macros: true
Source: SecuritySettings.xml1.0.dr	OLE indicator, VBA macros: true
Source: SecuritySettings.xml2.0.dr	OLE indicator, VBA macros: true

Source: SecuritySettings.xml.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: SecuritySettings.xml0.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: SecuritySettings.xml1.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: SecuritySettings.xml2.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: AdobeCollabSync.exe, 00000002.00000002.4027566312.00000204CCA0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS resource_revisions ( revision_id TEXT PRIMARY KEY NOT NULL, rel_to_content_item TEXT NOT NULL, resource_type TEXT NOT NULL, media_type TEXT NOT NULL, locator TEXT NOT NULL, committed INTEGER NOT NULL, hashType TEXT DEFAULT NULL, hash TEXT DEFAULT NULL, storageSize INTEGER DEFAULT 0, width INTEGER DEFAULT 0, height INTEGER DEFAULT 0);
Source: AdobeCollabSync.exe, 00000002.00000003.1862344767.00000204CCA2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: select count(gid) from global_state where gid=1 and schema_version >= 2014t;https://com4
Source: AdobeCollabSync.exe, 00000002.00000003.3013433818.00000204CCDD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: select name, value from response_headers where rid=?lastsynchronized;
Source: AdobeCollabSync.exe, 00000002.00000003.2969316789.00000204CCA91000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000003.2881041734.00000204CCA91000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000003.2872652117.00000204CCA91000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000003.2888522660.00000204CCA91000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000003.1922737704.00000204CCA91000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000003.2896635568.00000204CCA91000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000003.1862892000.00000204CCA91000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000003.1908446042.00000204CCA91000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000002.4027930372.00000204CCA91000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000003.2747943175.00000204CCA91000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT pending_request_id, request_type, content_item_id, context, pending_request_created, request_status, message, status_code, device_mapping_id FROM pending_requests;

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\WOT0089836_Electrical_Single_Line_diagram%2C_lighting__RR_docx_3461849704.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=7120
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=7340
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1552,i,2919846917026481936,14946802051647010614,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe" GetChannelUri
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "http://mailto:JPanakkathodan@eagle.org"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1704,i,8628428184620853746,18433794646278118704,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4732 --field-trial-handle=1704,i,8628428184620853746,18433794646278118704,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7316 --field-trial-handle=1704,i,8628428184620853746,18433794646278118704,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=7120	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe" GetChannelUri	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=7340	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1552,i,2919846917026481936,14946802051647010614,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1704,i,8628428184620853746,18433794646278118704,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: vccorlib140.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: msvcp140.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: msvcp140.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: appcontracts.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: wintypes.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: cdprt.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: cdp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: umpdc.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: propsys.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: dsreg.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: wldp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Section loaded: onecoreuapcommonproxystub.dll

Source: WOT0089836_Electrical_Single_Line_diagram%2C_lighting__RR_docx_3461849704.pdf	Initial sample: PDF keyword /JS count = 0
Source: WOT0089836_Electrical_Single_Line_diagram%2C_lighting__RR_docx_3461849704.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: download-20.2.dr	Initial sample: PDF keyword /JS count = 0
Source: download-20.2.dr	Initial sample: PDF keyword /JavaScript count = 0
Source: download-18.2.dr	Initial sample: PDF keyword /JS count = 0
Source: download-18.2.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\inprogress\download-20	Jump to dropped file
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\inprogress\download-21	Jump to dropped file
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\inprogress\download-18	Jump to dropped file
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\inprogress\download-19	Jump to dropped file

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Thread delayed: delay time: 86400000			Jump to behavior

Source: AdobeCollabSync.exe, 00000004.00000002.1855830404.00000182B2A98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllWW]
Source: AdobeCollabSync.exe, 00000001.00000002.4024580669.00000168C8AFC000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000001.00000002.4024580669.00000168C8BD5000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000001.00000002.4026189607.00000168CA910000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000003.2536513771.00000204CCCBD000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000003.2969316789.00000204CCA91000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000003.2881041734.00000204CCA91000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000003.2872652117.00000204CCA91000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000003.2117676053.00000204CCCBD000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000003.2146295097.00000204CCCBB000.00000004.00000020.00020000.00000000.sdmp, AdobeCollabSync.exe, 00000002.00000003.2888522660.00000204CCA91000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AdobeCollabSync.exe, 00000003.00000002.1856668772.0000027C30048000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Spearphishing Link	Windows Management Instrumentation	1 Scripting	1 Process Injection	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	1 Drive-by Compromise	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://ww2.eagle.org/en/rules-and-resources/rules-and-guides.html?q=High-Speed%20Craft	0%	Avira URL Cloud	safe
https://ww2.eagle.org/en/rules-and-resources/rules-and-guides.html?q=naval%20vessels	0%	Avira URL Cloud	safe
https://repo.vida.id06	0%	Avira URL Cloud	safe
http://crl.notarius.com/notarius_root_ca/crl/crl_roota2.crl	0%	Avira URL Cloud	safe
http://www.abs-group.com/	0%	Avira URL Cloud	safe
http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_5_0.pdf0s	0%	Avira URL Cloud	safe
http://ldap.cie.interno.gov.it/cierootca.crl0	0%	Avira URL Cloud	safe
http://ca.pki.ance.dz/repository/cert/root_ca.p7b0	0%	Avira URL Cloud	safe
http://ocsp.firmacerta.it/ocsp/certstatus0	0%	Avira URL Cloud	safe
http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_5_0.pdf0s	0%	Virustotal		Browse
http://ldap.cie.interno.gov.it/cierootca.crl0	0%	Virustotal		Browse
http://www.dg-sign.com/CRL3/RootCa3.crl0	0%	Avira URL Cloud	safe
http://www.abs-group.com/	0%	Virustotal		Browse
http://www.mediacert.com/rootCA2021/rootCA2021.crt0:	0%	Avira URL Cloud	safe
http://crl.notarius.com/notarius_root_ca/crl/crl_roota2.crl	0%	Virustotal		Browse
http://ocsp.firmacerta.it/ocsp/certstatus0	0%	Virustotal		Browse
http://ca.pki.ance.dz/repository/cert/root_ca.p7b0	0%	Virustotal		Browse
https://ww2.eagle.org/en/rules-and-resources/e-certificate-online-database.html	0%	Avira URL Cloud	safe
http://repository.swisssign.com/0	0%	Avira URL Cloud	safe
http://www.dg-sign.com/CRL3/RootCa3.crl0	0%	Virustotal		Browse
https://www.eagle.org/security/GatewayLogin?returnURL=/portal	0%	Avira URL Cloud	safe
https://github.com/jquery/jquery-color	0%	Avira URL Cloud	safe
https://www.shutterstock.com/license?utm_source=iptc&utm_medium=googleimages&utm_campaign=we	0%	Avira URL Cloud	safe
http://www.mediacert.com/rootCA2021/rootCA2021.crt0:	0%	Virustotal		Browse
http://www.mediacert.com/rootCA2021/rootCA2021.crl0N	0%	Avira URL Cloud	safe
https://login.microsoftonline.us	0%	Avira URL Cloud	safe
http://crl.infocert.it/crls/servizi2/ARL.crl	0%	Avira URL Cloud	safe
http://repository.swisssign.com/0	0%	Virustotal		Browse
https://ww2.eagle.org/en/news/newsroom.html	0%	Avira URL Cloud	safe
https://ww2.eagle.org/en/rules-and-resources/e-certificate-online-database.html	0%	Virustotal		Browse
https://github.com/jquery/jquery-color	0%	Virustotal		Browse
http://www.mediacert.com/rootCA2021/rootCA2021.crl0N	0%	Virustotal		Browse
http://crl.infocert.it/crls/servizi2/ARL.crl	0%	Virustotal		Browse
http://ca.pki.ance.dz/repository/crl/root_ca.crl0	0%	Avira URL Cloud	safe
https://login.microsoftonline.us	0%	Virustotal		Browse
https://absinfo.eagle.org/acton/media/16130/subscription-footer	0%	Avira URL Cloud	safe
https://www.shutterstock.com/license?utm_source=iptc&utm_medium=googleimages&utm_campaign=we	0%	Virustotal		Browse
http://get-crl.certificat.com/public/opentrustrootcag2.crl0L	0%	Avira URL Cloud	safe
https://www.vialink.fr/tsp/crt/vialink-eu-root-ca.cr	0%	Avira URL Cloud	safe
http://crl.wt.trustasia.com/Trus	0%	Avira URL Cloud	safe
http://ca.pki.ance.dz/repository/crl/root_ca.crl0	0%	Virustotal		Browse
http://crl.sisp.cv/sisprootca.crl0	0%	Avira URL Cloud	safe
https://absinfo.eagle.org/acton/media/16130/subscription-footer	0%	Virustotal		Browse
http://trust.dictao.com/cp/0	0%	Avira URL Cloud	safe
http://www.day.com/jcr/cq/1.0	0%	Avira URL Cloud	safe
https://wns.windows.com/	0%	Avira URL Cloud	safe
https://ww2.eagle.org/en/Products-and-Services/global-offshore-wind.html"	0%	Avira URL Cloud	safe
http://crl.wt.trustasia.com/Trus	0%	Virustotal		Browse
http://get-crl.certificat.com/public/opentrustrootcag2.crl0L	0%	Virustotal		Browse
http://www.certeurope.fr/refe	0%	Avira URL Cloud	safe
http://www.day.com/jcr/cq/1.0	0%	Virustotal		Browse
http://crl.sisp.cv/sisprootca.crl0	0%	Virustotal		Browse
http://trust.dictao.com/cp/0	0%	Virustotal		Browse
http://www.certum.pl/CPS0	0%	Avira URL Cloud	safe
http://schema.org/SiteNavigationElement	0%	Avira URL Cloud	safe
https://www.vialink.fr/tsp/crt/vialink-eu-root-ca.cr	0%	Virustotal		Browse
https://login.microsoftonline.de	100%	Avira URL Cloud	phishing
http://www.certum.pl/CPS0	0%	Virustotal		Browse
http://policy.camerfirma.com0	0%	Avira URL Cloud	safe
http://scrootca3.ocsp.secomtrust.net0	0%	Avira URL Cloud	safe
http://www.certeurope.fr/refe	0%	Virustotal		Browse
http://crl.infocert.it/ca3/qc/ARL.crl	0%	Avira URL Cloud	safe
http://schema.org/SiteNavigationElement	0%	Virustotal		Browse
https://customer.cludo.com/css/templates/v2.1/essentials/cludo-search.min.css	0%	Avira URL Cloud	safe
https://wns.windows.com/	0%	Virustotal		Browse
https://login.microsoftonline.de	0%	Virustotal		Browse
http://ocsp.ica.cz/rca22_rsa0	0%	Avira URL Cloud	safe
https://customer.cludo.com/css/templates/v2.1/essentials/cludo-search.min.css	0%	Virustotal		Browse
http://get-crl.certificat.com/public/opentrustrootcag1.crl0L	0%	Avira URL Cloud	safe
http://crl.ca4.infocert.it/ades/ARL.crl0	0%	Avira URL Cloud	safe
http://crl.infocert.it/ca3/qc/ARL.crl	0%	Virustotal		Browse
http://crl1.eCert.gov.hk/crl/RootCA2ARL.crl0	0%	Avira URL Cloud	safe
https://crl2.gse.com.co/CA_ROOT.crl0	0%	Avira URL Cloud	safe
http://ocsp.ica.cz/rca22_rsa0	0%	Virustotal		Browse
https://ww2.eagle.org/en/rules-and-resources/rules-and-guides.html?q=offshore"	0%	Avira URL Cloud	safe
http://crl.ca4.infocert.it/ades/ARL.crl0	0%	Virustotal		Browse
http://www1.eCert.gov.hk/root/root_ca_2.crt0%	0%	Avira URL Cloud	safe
http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0E	0%	Avira URL Cloud	safe
http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G	0%	Avira URL Cloud	safe
https://news.cision.com/american-bureau-of-shipping/?q=wind&k=offshore%20wind"	0%	Avira URL Cloud	safe
http://ldap.cie.interno.gov.it/ciesubca1.crl0	0%	Avira URL Cloud	safe
http://rules.eagle.org/pubversion/	0%	Avira URL Cloud	safe
https://ww2.eagle.org/en/rules-and-resources/rules-and-guides.html?q=other	0%	Avira URL Cloud	safe
http://ocsp.ncdc.gov.sa08	0%	Avira URL Cloud	safe
https://www.linkedin.com/company/american-bureau-of-shipping	0%	Avira URL Cloud	safe
https://www.eagle.org/ABSEaglePrograms/es/es-search.jsp"	0%	Avira URL Cloud	safe
http://ocsp.globalsign.co	0%	Avira URL Cloud	safe
http://crl.infocert.it/crls/firma2/ARL.crl	0%	Avira URL Cloud	safe
http://schema.org/ImageObject	0%	Avira URL Cloud	safe
https://news.cision.com/american-bureau-of-shipping/?k=sustainability"	0%	Avira URL Cloud	safe
https://www.cybertrust.ne.jp/i	0%	Avira URL Cloud	safe
http://pki.almer	0%	Avira URL Cloud	safe
http://e-trustcom.intesa.it0?	0%	Avira URL Cloud	safe
https://ww2.eagle.org/en/Products-and-Services/offshore-energy/offshore-energy-production.html"	0%	Avira URL Cloud	safe
https://ww2.eagle.org/en/Products-and-Services/offshore-energy/offshore-wind-vessels.html"	0%	Avira URL Cloud	safe
https://www.eagle.org/ABSEaglePrograms/ta/ta-search.jsp"	0%	Avira URL Cloud	safe
http://qcrldp2.ica.cz/rca22_rsa.crl0	0%	Avira URL Cloud	safe
https://www.abs-group.com/	0%	Avira URL Cloud	safe
http://rules.eagle.org/ns/hyperlinking/	0%	Avira URL Cloud	safe
https://ocsp2.gse.com.co06	0%	Avira URL Cloud	safe

Name	Malicious	Reputation
https://ww2.eagle.org/en/my-eagle-user-id-request.html	false	unknown
https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html	false	unknown
https://ww2.eagle.org/en/Products-and-Services/classification-services.html	false	unknown
https://ww2.eagle.org/en/rules-and-resources.html	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.abs-group.com/	chromecache_878.15.dr, chromecache_786.15.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.notarius.com/notarius_root_ca/crl/crl_roota2.crl	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://repo.vida.id06	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://ww2.eagle.org/en/rules-and-resources/rules-and-guides.html?q=naval%20vessels	chromecache_878.15.dr, chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
https://ww2.eagle.org/en/rules-and-resources/rules-and-guides.html?q=High-Speed%20Craft	chromecache_878.15.dr, chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_5_0.pdf0s	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ldap.cie.interno.gov.it/cierootca.crl0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ca.pki.ance.dz/repository/cert/root_ca.p7b0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.firmacerta.it/ocsp/certstatus0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.dg-sign.com/CRL3/RootCa3.crl0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.mediacert.com/rootCA2021/rootCA2021.crt0:	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://repository.swisssign.com/0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ww2.eagle.org/en/rules-and-resources/e-certificate-online-database.html	chromecache_878.15.dr, chromecache_786.15.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.eagle.org/security/GatewayLogin?returnURL=/portal	chromecache_878.15.dr, chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jquery/jquery-color	chromecache_1214.15.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.shutterstock.com/license?utm_source=iptc&utm_medium=googleimages&utm_campaign=we	chromecache_1288.15.dr, chromecache_1358.15.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.mediacert.com/rootCA2021/rootCA2021.crl0N	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://login.microsoftonline.us	chromecache_889.15.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.infocert.it/crls/servizi2/ARL.crl	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ww2.eagle.org/en/news/newsroom.html	chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
http://ca.pki.ance.dz/repository/crl/root_ca.crl0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://absinfo.eagle.org/acton/media/16130/subscription-footer	chromecache_878.15.dr, chromecache_786.15.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://get-crl.certificat.com/public/opentrustrootcag2.crl0L	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.vialink.fr/tsp/crt/vialink-eu-root-ca.cr	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.wt.trustasia.com/Trus	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.sisp.cv/sisprootca.crl0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://trust.dictao.com/cp/0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.day.com/jcr/cq/1.0	chromecache_1365.15.dr, chromecache_1331.15.dr, chromecache_910.15.dr, chromecache_776.15.dr, chromecache_651.15.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://wns.windows.com/	FullTrustNotifier.exe, 00000008.00000002.1890088962.000000000093E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ww2.eagle.org/en/Products-and-Services/global-offshore-wind.html"	chromecache_878.15.dr, chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
http://www.certeurope.fr/refe	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.certum.pl/CPS0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schema.org/SiteNavigationElement	chromecache_786.15.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://login.microsoftonline.de	chromecache_889.15.dr	false	0%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://policy.camerfirma.com0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://scrootca3.ocsp.secomtrust.net0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://crl.infocert.it/ca3/qc/ARL.crl	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://customer.cludo.com/css/templates/v2.1/essentials/cludo-search.min.css	chromecache_878.15.dr, chromecache_786.15.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.ica.cz/rca22_rsa0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.ca4.infocert.it/ades/ARL.crl0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://get-crl.certificat.com/public/opentrustrootcag1.crl0L	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://crl1.eCert.gov.hk/crl/RootCA2ARL.crl0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://crl2.gse.com.co/CA_ROOT.crl0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://ww2.eagle.org/en/rules-and-resources/rules-and-guides.html?q=offshore"	chromecache_878.15.dr, chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
http://www1.eCert.gov.hk/root/root_ca_2.crt0%	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0E	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://news.cision.com/american-bureau-of-shipping/?q=wind&k=offshore%20wind"	chromecache_878.15.dr, chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://ldap.cie.interno.gov.it/ciesubca1.crl0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://rules.eagle.org/pubversion/	chromecache_911.15.dr	false	Avira URL Cloud: safe	unknown
https://ww2.eagle.org/en/rules-and-resources/rules-and-guides.html?q=other	chromecache_878.15.dr, chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.ncdc.gov.sa08	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://www.linkedin.com/company/american-bureau-of-shipping	chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
https://www.eagle.org/ABSEaglePrograms/es/es-search.jsp"	chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.globalsign.co	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://crl.infocert.it/crls/firma2/ARL.crl	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://schema.org/ImageObject	chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
https://news.cision.com/american-bureau-of-shipping/?k=sustainability"	chromecache_878.15.dr, chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
https://www.cybertrust.ne.jp/i	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://pki.almer	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://e-trustcom.intesa.it0?	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://ww2.eagle.org/en/Products-and-Services/offshore-energy/offshore-energy-production.html"	chromecache_878.15.dr, chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
https://ww2.eagle.org/en/Products-and-Services/offshore-energy/offshore-wind-vessels.html"	chromecache_878.15.dr, chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
https://www.eagle.org/ABSEaglePrograms/ta/ta-search.jsp"	chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
http://qcrldp2.ica.cz/rca22_rsa.crl0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://www.abs-group.com/	chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
http://rules.eagle.org/ns/hyperlinking/	chromecache_911.15.dr	false	Avira URL Cloud: safe	unknown
https://ocsp2.gse.com.co06	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	FullTrustNotifier.exe, 00000008.00000002.1890088962.000000000093E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r.ica.cz/rca22_rsa.cer0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://ocsp2.gse.com.co04	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://www.preuve-electronique.org/PC_NOTAIRESDEFRANCE_1.2.250.1.78.2.1.1.1.pdf0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://ww2.eagle.org/en/news/newsroom.html"	chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
http://www.cartaidentita.interno.gov.it/policy/subca_auth_cps.pdf0=	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://www.izenpe.com/cps07	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://customer.cludo.com/scripts/bundles/search-script.min.js	chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
https://ww2.eagle.org/en/Products-and-Services/global-offshore-wind.html	chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
https://www.eagle.org/portal	chromecache_878.15.dr, chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
https://trustlist.adobe.	AdobeCollabSync.exe, 00000002.00000003.1908446042.00000204CCA2E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bnpp.digitaltrust.morpho.com/cp/0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://schema.org/BreadcrumbList	chromecache_878.15.dr, chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
http://crl2.postsignum.cz/crl/psrootqca4.crl01	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://web.ncdc.gov.sa/crl/nrcaparta1.crl	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://acraiz.icpbrasil.gov.br/DP	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://news.cision.com/american-bureau-of-shipping/?k=spotlight	chromecache_878.15.dr, chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
http://root-rsa.digitalsign.pt/DIGITALSIGNGLOBALROOTRSACA.p7b0A	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://www1.hongkongpost.gov.hk/root/root_ca_2.crt08	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://trustlist.ad	AdobeCollabSync.exe, 00000002.00000003.2536513771.00000204CCCBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl1.hongkongpost.gov.hk/crl/RootCA2ARL.crl0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://wtca-cafiles.itrus.com.cn/crl/vTrusRootCA.crl0I	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://www.firmaprofesional.com/cps0	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://login.chinacloudapi.cn	chromecache_889.15.dr	false	Avira URL Cloud: safe	unknown
http://www.izenpe.com	A95u8yg8_gsq3x0_1u4.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://absinfo.eagle.org/acton/media/16130/an-approach-to-green-shipping-corridor-modeling-and-opti	chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown
https://login.windows-ppe.net	chromecache_889.15.dr	false	Avira URL Cloud: safe	unknown
https://www.eagle.org/ABSEaglePrograms/es/es-search.jsp	chromecache_786.15.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.42	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.18.64.26	unknown	European Union	6057	AdministracionNacionaldeTelecomunicacionesUY	false
23.57.19.119	unknown	United States	16625	AKAMAI-ASUS	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false
142.250.185.100	unknown	United States	15169	GOOGLEUS	false
51.44.35.189	unknown	United States	2686	ATGS-MMD-ASUS	false
35.174.127.31	unknown	United States	14618	AMAZON-AESUS	false
172.64.155.227	unknown	United States	13335	CLOUDFLARENETUS	false
207.189.124.20	unknown	United States	393648	ACTON-SOFTWAREUS	false
151.101.130.137	unknown	United States	54113	FASTLYUS	false
34.237.73.95	unknown	United States	14618	AMAZON-AESUS	false
104.22.28.96	unknown	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	unknown	United States	15169	GOOGLEUS	false
142.250.186.74	unknown	United States	15169	GOOGLEUS	false
142.250.186.33	unknown	United States	15169	GOOGLEUS	false
172.217.16.142	unknown	United States	15169	GOOGLEUS	false
23.22.254.206	unknown	United States	14618	AMAZON-AESUS	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
142.250.186.34	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.18.186.31	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.234	unknown	United States	15169	GOOGLEUS	false
172.217.18.3	unknown	United States	15169	GOOGLEUS	false
142.250.185.110	unknown	United States	15169	GOOGLEUS	false
204.225.178.21	unknown	United States	14707	ABSHOU-ASNUS	false
104.19.148.8	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
18.173.205.6	unknown	United States	3	MIT-GATEWAYSUS	false
2.23.197.184	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
34.198.161.47	unknown	United States	14618	AMAZON-AESUS	false
13.107.253.72	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
63.35.112.85	unknown	United States	16509	AMAZON-02US	false
142.250.185.194	unknown	United States	15169	GOOGLEUS	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
151.101.3.10	unknown	United States	54113	FASTLYUS	false
142.250.185.206	unknown	United States	15169	GOOGLEUS	false
15.236.74.180	unknown	United States	16509	AMAZON-02US	false
172.217.18.14	unknown	United States	15169	GOOGLEUS	false
104.18.33.190	unknown	United States	13335	CLOUDFLARENETUS	false
216.58.206.78	unknown	United States	15169	GOOGLEUS	false
216.58.206.34	unknown	United States	15169	GOOGLEUS	false
142.250.181.230	unknown	United States	15169	GOOGLEUS	false
172.217.23.104	unknown	United States	15169	GOOGLEUS	false
184.30.131.181	unknown	United States	16625	AKAMAI-ASUS	false
13.107.246.60	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
64.233.184.155	unknown	United States	15169	GOOGLEUS	false
142.250.181.232	unknown	United States	15169	GOOGLEUS	false
13.35.58.128	unknown	United States	16509	AMAZON-02US	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
172.217.23.99	unknown	United States	15169	GOOGLEUS	false
172.217.18.118	unknown	United States	15169	GOOGLEUS	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false
172.217.18.10	unknown	United States	15169	GOOGLEUS	false
2.23.198.32	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.110.84	unknown	United States	15169	GOOGLEUS	false
104.17.24.14	unknown	United States	13335	CLOUDFLARENETUS	false
18.66.122.72	unknown	United States	3	MIT-GATEWAYSUS	false
23.206.22.196	unknown	United States	16625	AKAMAI-ASUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.16.206	unknown	United States	15169	GOOGLEUS	false
142.250.185.138	unknown	United States	15169	GOOGLEUS	false
3.33.152.127	unknown	United States	8987	AMAZONEXPANSIONGB	false
142.250.185.136	unknown	United States	15169	GOOGLEUS	false
104.19.147.8	unknown	United States	13335	CLOUDFLARENETUS	false
13.224.189.74	unknown	United States	16509	AMAZON-02US	false
104.18.40.252	unknown	United States	13335	CLOUDFLARENETUS	false
18.173.205.79	unknown	United States	3	MIT-GATEWAYSUS	false
18.173.205.119	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.181.228	unknown	United States	15169	GOOGLEUS	false
192.229.221.95	unknown	United States	15133	EDGECASTUS	false
104.77.220.172	unknown	United States	16625	AKAMAI-ASUS	false
18.245.46.55	unknown	United States	16509	AMAZON-02US	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1514330
Start date and time:	2024-09-20 06:49:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WOT0089836_Electrical_Single_Line_diagram%2C_lighting__RR_docx_3461849704.pdf
Detection:	MAL
Classification:	mal48.winPDF@66/1345@0/77
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Browse: https://ww2.eagle.org/en/rules-and-resources/regulatory-updates.html Browse: https://ww2.eagle.org/en/rules-and-resources/rules-and-guides-v2.html Browse: https://ww2.eagle.org/en/rules-and-resources.html Browse: https://ww2.eagle.org/en/rules-and-resources/databases.html Browse: https://ww2.eagle.org/en/Products-and-Services/abs-company-or-ship-audit.html Browse: https://ww2.eagle.org/en/rules-and-resources/abs-engineering-reviews.html Close Viewer Browse: https://ww2.eagle.org/en/Products-and-Services/classification-services.html Browse: https://ww2.eagle.org/en/my-eagle-user-id-request.html Browse: https://ww2.eagle.org/en/innovation-and-technology/academic-engagement.html Browse: https://ww2.eagle.org/en/Products-and-Services/vendor-certification.html

Time	Type	Description
00:50:42	API Interceptor	90070x Sleep call for process: AdobeCollabSync.exe modified
00:50:56	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WOT0089836_Electrical_Single_Line_diagram%2C_lighting__RR_docx_3461849704.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7fd63a59-a931-4d7e-8596-6710eefa0c88.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\notificationsDB

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\notificationsDB-journal

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync\80307f885d209ff3421f3adf000d6b1e.db

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync\80307f885d209ff3421f3adf000d6b1e.db-journal

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync\80307f885d209ff3421f3adf000d6b1e.db-shm

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync\80307f885d209ff3421f3adf000d6b1e.db-wal

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\Eureka\AcroCoreSync\CreativeCloud\CoreSync\EntitySync-2024-09-20.log

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\RFL\LocalMapping\RFLDB230

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\RFL\LocalMapping\RFLDB230-journal

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240920045056Z-535.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\inprogress\download-18

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\inprogress\download-19

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\inprogress\download-20

Windows Analysis Report
WOT0089836_Electrical_Single_Line_diagram%2C_lighting__RR_docx_3461849704.pdf

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.42	https://protect-us.mimecast.com/s/FVibCzpzxLsxEMXAhgAOBC	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
	http://border-fd.smartertechnologies.com/	Get hash	malicious	Unknown	Browse	border-fd.smartertechnologies.com/
	https://protect-us.mimecast.com/s/4MrPCrkvgotDWxrNCzxa8p	Get hash	malicious	Unknown	Browse	www.mimecast.com/
2.18.64.26	https://pub.marq.com/9d8816-7c5c-4412-bdd0-b960bf225/#_0	Get hash	malicious	Unknown	Browse
	https://myworkspace10fa5.myclickfunnels.com/onlinereview--00e63?preview=true	Get hash	malicious	Unknown	Browse
	Keyser & Mackay.pdf	Get hash	malicious	Unknown	Browse
	Review_Aonoro.pdf	Get hash	malicious	Unknown	Browse
	FW BSN Group Construction LTD..eml	Get hash	malicious	HTMLPhisher	Browse
	https://myworkspace6f77d.myclickfunnels.com/review--50e66	Get hash	malicious	Unknown	Browse
	https://url5041.app.lucid.co/uni/ls/click?upn=u001.9CEiYqsCeDB7JcEaXQIz-2F9XjjPqk-2Fb4pFcLw69B6WqTy-2BbVFLiir3sSJZjbRo6mBAwRtKNr9Kf4WztrdCBts7iyzvcJ-2FIUH0XDrcbuiiKrlzy8ZwzSxYR1urVGEa2H8lG0Sg7ExDExUtTEJeACnxEcvsJ4CnFcY2OyyabtZjsqjBmQJR0iCaQNYCn9tJqfPt0sqRsrpUZbmtTsF5u4sk76aC5ja3Exi0TVSSBuxtzkkrePRrkTP-2FRoxSefUr1y9ilFhR_7YHA5TjKTAFn3LEZM-2F5lkHKyiA7Z3uxS7g7w0lpFY3VgLh-2FDGXI29ABs2GTmbGZIZHIxymEIAIiyGRh1AnBalmp58yag9E-2FrtA2h0nETB9HIcrFd1W-2BMglDx2EcdWaE0YUaZKghF9gUd9evpWd9o10VlCUS2n6DDMef1lVzEPNeAVIceaFC5X-2FwVIdJYlE5ubbjTe48aOxl7EYAkQAbI29zMPLBfzmo3-2F0oDrCz1NV8Z-2BgLjNSkhEL0v7ztjcjSQNYmg2ZtX7GcpdQCCaWNVfhkazGgvvJB3QcWd-2Fo6uMwkENEvM1i8Q5dxjk3O7SagsKeqlZGHyVQYiVQV70Bj-2BqwPqn7sRJMYA1CWG3MbbSEiFggnHBU9leFka7-2BLjrmTxclzDNBbGoPiatzLWpKmVvw-2Bx5nC-2FbsV4WwngsYxWK1QG1aOsoJu-2FNsl5G06ywgOfHOifxw2PEX15DLqK9LKLpY23-2B0gBFiHHbP5xi3TlZqqdPIKY76qvnZKXKkRHP7lkjW54-2BjkWiD-2BFCJF-2BYwCLISwPacjQQKLVdWymA0jKWf0m780jvwQKochVtFIfu-2BJ9NnI-2BB2EwWIxQXcbAMYwMXcMBTQTHy61gyJ3FTzWhBE5wfCKo-2F8oXN5UhSp4kSbC0WEoFb3T831Z02n3p5vAL-2Ftzsl33DNu9nwqX-2FymwJG6bbNN49b2LwjYn6qVJYWS5SHBoNvXFMznGKBB-2Fn-2B5ec0wzJuS2t1Z7ZojX-2BZTbH-2F00rb4HPN-2BmX2VUh9CatGg9L1JM7vsjjRJrthuxEvN6-2BOqDHpRQ-2FjJ2ng1sbFzjs5LWXRhQ7AwghmMB4i-2FOI7rRt	Get hash	malicious	Unknown	Browse
	https://www.beautiful.ai/player/-Nz0hSZLtlrdLENKNNwL/Untitled	Get hash	malicious	HTMLPhisher	Browse
	https://app.writesonic.com/share/undefined/d39fda15-8db2-4c14-a53a-3ed94b26ade1	Get hash	malicious	HTMLPhisher	Browse
184.28.88.176	EXTERNALInvoice 3388 from Mazzitti Sullivan EAP.msg	Get hash	malicious	Unknown	Browse
	Signed_Revised_Contract_See also 19_Lgunning_Carisls_Required_Signature.pdf	Get hash	malicious	Unknown	Browse
	AKLZ00025635.pdf	Get hash	malicious	Unknown	Browse
	https://zone02.b-cdn.net/tra18	Get hash	malicious	Unknown	Browse
	Giger & Partner Fall Nr. 893983 Gerichtsbescheid Vergleich Nr. 241624 GM.pdf	Get hash	malicious	Unknown	Browse
	i45qm2Cawa	Get hash	malicious	Unknown	Browse
	f380122b-c637-edef-70b2-6adee77f4bad.eml	Get hash	malicious	Unknown	Browse
	v2.0.pdf	Get hash	malicious	Unknown	Browse
	v2.1.pdf	Get hash	malicious	Unknown	Browse
	Order list.pdf	Get hash	malicious	Unknown	Browse
35.174.127.31	https://www.opinionstage.com/page/9bcc3898-85f3-45d7-8bf3-83291ce66ba3	Get hash	malicious	Unknown	Browse
	http://cjoinboxsignin.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse
	https://clickme.thryv.com/ls/click?upn=u001.qbfGuC-2BYjR7x2HD-2FSqsgG3wNT7iuCXOa8RsaW1sEZQ2Ai07k2sqLH8KlQaI9UJoveQXD2-2FZjz0PrqySGkZt29Yir1nLg4GD8U51m1QocK7o5YwVSY83PaBCPqiR8CYFKHsTQ_eHO4CCz1a1pkvjYpIWB4y7JicQi4pRhdkGSRW0JefwO3RgLXgR7CMsN4dpAeGpKoFjtBODGSiou2fASe9aGzhMaZWRW7YTOjWnCQTX7nM5g3lO-2BB3qUvsuyrcn-2FiE1CgRdy-2FuXOdfuFHI0kVFSM4cU2Vpan1AdMUx3LkE7bkGSUXcKl5NIJOjg4iamMyVM2Vhx7YXexWCOb9JbcOfyO2Sw-3D-3D	Get hash	malicious	Unknown	Browse
	https://meitecmeskx-iss-1.gitbook.io/us	Get hash	malicious	HTMLPhisher	Browse
	https://web--start-ledgerlve.gitbook.io/	Get hash	malicious	Unknown	Browse
	http://pro-ciine-base.gitbook.io/	Get hash	malicious	Unknown	Browse
	http://metasamsk-uswallt.gitbook.io/	Get hash	malicious	Unknown	Browse
	http://cbaseeprodlogin.gitbook.io/	Get hash	malicious	Unknown	Browse
	http://myuapholdlogin.gitbook.io/	Get hash	malicious	Unknown	Browse
	https://mmetamssk-login.gitbook.io/	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	https://yaqoot-alsama.com/o/?(:3Y9s2NV8xX32vaWINlJnJhmQUm5KTk5lQTOdIkPVVTRVIxNzASMjAyNFUZNTASMTcQ==	Get hash	malicious	Unknown	Browse	2.19.225.16
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	23.192.247.89
	SecuriteInfo.com.Linux.Siggen.9999.8163.26295.elf	Get hash	malicious	Mirai	Browse	23.37.155.44
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	23.192.247.89
	https://trezr-us.github.io/	Get hash	malicious	Unknown	Browse	2.19.126.136
	http://livezida.com	Get hash	malicious	Unknown	Browse	23.48.14.127
	payment.eml	Get hash	malicious	HTMLPhisher	Browse	2.16.185.204
	https://github-scanner.com	Get hash	malicious	Unknown	Browse	23.192.247.89
	MCRT Florida Construction, LLC Project Proposal.eml	Get hash	malicious	Unknown	Browse	2.16.185.204
AKAMAI-ASUS	https://yaqoot-alsama.com/o/?(:3Y9s2NV8xX32vaWINlJnJhmQUm5KTk5lQTOdIkPVVTRVIxNzASMjAyNFUZNTASMTcQ==	Get hash	malicious	Unknown	Browse	2.19.225.16
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	23.192.247.89
	SecuriteInfo.com.Linux.Siggen.9999.8163.26295.elf	Get hash	malicious	Mirai	Browse	23.37.155.44
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	23.192.247.89
	https://trezr-us.github.io/	Get hash	malicious	Unknown	Browse	2.19.126.136
	http://livezida.com	Get hash	malicious	Unknown	Browse	23.48.14.127
	payment.eml	Get hash	malicious	HTMLPhisher	Browse	2.16.185.204
	https://github-scanner.com	Get hash	malicious	Unknown	Browse	23.192.247.89
	MCRT Florida Construction, LLC Project Proposal.eml	Get hash	malicious	Unknown	Browse	2.16.185.204
AdministracionNacionaldeTelecomunicacionesUY	Williams Raveis Share 09.25.html	Get hash	malicious	HTMLPhisher	Browse	2.18.64.15
	https://uliana00.wixsite.com/my-site-5	Get hash	malicious	HTMLPhisher	Browse	2.18.64.7
	https://www.beautiful.ai/player/-O7-cGs_osrOld7vo1WV	Get hash	malicious	HtmlDropper	Browse	2.18.64.15
	https://legaled.academy/sigh/General%202024/index.html#nope@eatmyass.com	Get hash	malicious	HTMLPhisher	Browse	2.18.64.23
	https://wetransfer.com/downloads/fba8446149d20edcdcf37d63699c300320240916111055/9e1e4e941b3d5baf51e58ce4afc08bf520240916111122/d348f9?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid	Get hash	malicious	Unknown	Browse	2.18.64.21
	2770023353 PayoffRequest.html	Get hash	malicious	HTMLPhisher	Browse	2.18.64.70
	https://storage.googleapis.com/tf3no4swz21zlasg/75752b9.html#FDm8vwZK.aspx?fRl9xNccwwPcczDyScdcNRddcH77xncsXcbbb4X	Get hash	malicious	Unknown	Browse	2.18.64.18
	SecuriteInfo.com.Linux.Siggen.9999.15962.9862.elf	Get hash	malicious	Mirai	Browse	179.31.67.152
	https://pub.marq.com/9d8816-7c5c-4412-bdd0-b960bf225/#_0	Get hash	malicious	Unknown	Browse	2.18.64.15
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	2.18.64.31
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://t.co/yuxfZm8KPg?amp=1	Get hash	malicious	Unknown	Browse	150.171.28.10
	SecuriteInfo.com.Linux.Mirai.8587.19636.7995.elf	Get hash	malicious	Mirai	Browse	13.64.92.15
	SecuriteInfo.com.Linux.Siggen.9999.8861.1379.elf	Get hash	malicious	Mirai	Browse	20.33.223.118
	SecuriteInfo.com.Linux.Siggen.9999.6095.9527.elf	Get hash	malicious	Mirai	Browse	104.208.173.160
	SecuriteInfo.com.Linux.Siggen.9999.8163.26295.elf	Get hash	malicious	Mirai	Browse	52.125.243.159
	http://vip3659r.com/	Get hash	malicious	Unknown	Browse	52.184.8.29
	http://telstra-100234.weeblysite.com/	Get hash	malicious	Unknown	Browse	20.96.87.156
	http://login-screen-106087.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	http://login-screen-104887.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	http://www.bet6105365.com/	Get hash	malicious	HTMLPhisher	Browse	20.2.30.156

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.12908697829669
Encrypted:	false
SSDEEP:	6:PB7xWq2Pwkn2nKuAl9OmbnIFUt82B7uPZmw+2B79kwOwkn2nKuAl9OmbjLJ:PB70vYfHAahFUt82B7uP/+2B795JfHAR
MD5:	A08F68CEE27650250ECD77B2407D3588
SHA1:	CAF8830FA4C7CA88E33CCFE3CF4724BCD31ADE49
SHA-256:	B0415D30B8F60AD69195EEC5ACED484ACB0DEB4E8A1F5B4A575E9C9E9837C2E6
SHA-512:	CD534E1EF2EDD0120F828B2B056F3A809C7269B70A339492B9EE48AAFA2C9EA91964B3D91B8CACCC88926DEAC2DB8204CBF04AAD532E860E12138D9BEBAEA074
Malicious:	false
Preview:	2024/09/20-00:50:45.023 1d60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/09/20-00:50:45.024 1d60 Recovering log #3.2024/09/20-00:50:45.025 1d60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x300, components 3
Category:	dropped
Size (bytes):	90545
Entropy (8bit):	7.9721398035122055
Encrypted:	false
SSDEEP:	1536:rF5e60eEbx2Z+F/X38hozPaZlfC17zQNwlQaL+wZhDQ+wlEEjtg3hVER8/PK1HQI:hIPeEN/MgirfC17MPaL+wZhP/6VO/awI
MD5:	FA68A818B4A5318C368F5CF945B06A52
SHA1:	9E09EBB9860A52EC487C38DE0E2626EED9351607
SHA-256:	9DE4C1FD37B38C385B7250B352976DD2B5474EF5741ABDFBE7866D6A4C36E713
SHA-512:	35F13D2E74944DEADB9790F4D3D6E9508364A0D3F8FCB2D469473CA24E362C1484876BE389203DE2AFB2112A11E3042AAD92875337B61535E2C900BD8A2A31DD
Malicious:	false
Preview:	......JFIF.............C....................................................................C.......................................................................,...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...........OJPs_g...........4.\|Gz..J....h9..\|.\S..l~5.....&...yu..T.t...s...=..(.s.Y284...W,..z3~u"...I..Y...J.:ur;.......Ps..Mx..~....R'L.....L..q...5.{`.l...e.y..:......n...o.aB.S......e.;?...Hm@..q._......(.#.<o..Z...........UiSh...xx.s.)......R.T.?k.q..pW...<...A.}.7.P......s.Q... .d..-..F...=.s.ljM.B.5.F0k..S...}..sM..t#S#.!.Xt..k.]7.........

File type:	PDF document, version 1.5, 3 pages
Entropy (8bit):	7.699786422931723
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	WOT0089836_Electrical_Single_Line_diagram%2C_lighting__RR_docx_3461849704.pdf
File size:	299'524 bytes
MD5:	8f06ead80737911d98638dedbd869e4a
SHA1:	2619ccd7e9f115b643bb635fb004a665aa2d2bfb
SHA256:	0e22cf742a29393600106642009d4c7881ab79d36eee8345062fb2aa3ffadeff
SHA512:	df43f845f22328166c87ee2430fd8cc892a59428ccc54422bff6333fb8d8c14fc4e9741f24bc433a8ac00663b15d39fe2f8c3af79e2a179762edc9c5da6036cb
SSDEEP:	6144:snQ1j9dL54ytwymIQOeC5lMlsAx4XDyHrDWG0iRLeCl1IGD7LBs:wgJh54ytwyW4lMlvD8iXlCGvLBs
TLSH:	945402F1ED22AC89E417C1A6AA34796486A6B61213C45CA1763C1FD33FC1D4E3F116DB
File Content Preview:	%PDF-1.5.%.....1 0 obj.<<./Type /Catalog./Version /1.4./Pages 2 0 R.>>.endobj.3 0 obj.<<./Creator <FEFF004D006900630072006F0073006F0066007400AE00200057006F0072006400200032003000310036>./ModDate (D:20240916150335Z)./CreationDate (D:20240912214254+00'00')./

General
Header:	%PDF-1.5
Total Entropy:	7.699786
Total Bytes:	299524
Stream Entropy:	7.921220
Stream Bytes:	249648
Entropy outside Streams:	4.208374
Bytes outside Streams:	49876
Number of EOF found:	4
Bytes after EOF:

Name	Count
obj	102
endobj	102
stream	28
endstream	28
xref	4
trailer	4
startxref	4
/Page	4
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	2
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Target ID:	0
Start time:	00:50:38
Start date:	20/09/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\WOT0089836_Electrical_Single_Line_diagram%2C_lighting__RR_docx_3461849704.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	00:50:41
Start date:	20/09/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c
Imagebase:	0x7ff7df980000
File size:	11'469'784 bytes
MD5 hash:	8A41FC5F946230805512B943C45AC9D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	3
Start time:	00:50:43
Start date:	20/09/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c
Imagebase:	0x7ff7df980000
File size:	11'469'784 bytes
MD5 hash:	8A41FC5F946230805512B943C45AC9D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true