Edit tour

Windows Analysis Report
bc3c228ad2c13f96cb14375c3860e802.pdf

Overview

General Information

Sample name:	bc3c228ad2c13f96cb14375c3860e802.pdf
Analysis ID:	1541497
MD5:	5448dddeb4ccaa5cf39694f5c28a4b76
SHA1:	a64f68d8253c21beb398272f795aaa62db4de3f4
SHA256:	3d54f8929f551c67e0bec56d1a7c13be514b799da109ab85f3edb06681a32e2a
Infos:

Detection

Score:	23
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

AI detected landing page (webpage, office document or email)

Detected non-DNS traffic on DNS port

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Drops files with a non-matching file extension (content does not match file extension)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 6508 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\bc3c228ad2c13f96cb14375c3860e802.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1824 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 744 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1648 --field-trial-handle=1552,i,14824447783216249022,15538149311993325529,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/Etd2wgQOOMlAnCPcJokAti0Br6HyyfMaB6MiwzMZjEF3xw?e=8rf3aZ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2024,i,8418923506075728781,9654654873541631301,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /personal/malahmar_neweranet_com/_api/v2.1/graphql HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-aliveContent-Length: 507sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/json;odata=verboseContent-Type: application/json;odata=verboseX-ServiceWorker-Strategy: CacheFirstsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://neweranet0-my.sharepoint.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2EsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jMzFhNTg2MjIwYjllMDRhZmE3ZTcxNTZhNTE4NDI2MTA1NWJkMDYyNmRmNjczYjc1N2MyZTAxOTA1NGU1Y2RjYSwxMzM3NDI3NTA3MDAwMDAwMDAsMCwxMzM3NDM2MTE3MDU1MjE0NTQsMC4wLjAuMCwyNTgsZDNlZTNmZWQtYjU1ZS00OTMyLWEzNTQtZDkyNWRmNWM1MGRjLCwsYzAyNTVkYTEtYzA1Yi02MDAwLWIzNzQtY2MzMjY4NTI1MTE0LGMwMjU1ZGExLWMwNWItNjAwMC1iMzc0LWNjMzI2ODUyNTExNCx0eTIrQklGSTdrcXk5cytNR3FOZUdBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTI0MjYsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLE9zbEhaZEpmUHNyY0dqK1ZMQWtqRmxjdGZVdGNBZTRUTngxZGxXT2F2NEprRytVZno0MlpzVkFzcDhJL2Y3ZGo2SEw5MXA5bmRjSFhubjhZQ2FVQ0xRSkVudTZiWDlnZW4rbDJPSkFsUlJ5TmtVVmNWeXREUkVYaXYwemw1YnBlU0MvbXpTZUt2a3E0QklFdzQ2SjI2b0VwbTRoNVBZYUE1cFIyS1pXby8waUxQeFJGalFVQVpvOGNnT0RlL3ZzbEs4UEd2Q0wzTndnVGt3T1hoNWNtdmUxK0xncFI2bE1yWE5DVE1md1g4NDhCZW9sOTFmUnJyOFVCSldSbER6QUx3SXA3VmZiRVpieWt6aG9OeWdreDkzNFdzSDlkWi81RUdqSUVnTmppTUVBa3YrK05kNWdsVnNFS091YVRBb3NUdnZtMnNPZkRubjlneXp6QnNOUkdTdz09PC9TUD4=

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49885 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: neweranet0.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: eastus1-mediap.svc.ms
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: config.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: 7d922087c09d72a0e525b959f027fa71.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: tr-ooc-atm.office.com
Source: global traffic	DNS traffic detected: DNS query: 16b69e33.0cced60565238cd25cf4ed69.workers.dev
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: tr-ooc-acdc.office.com
Source: global traffic	DNS traffic detected: DNS query: upload.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: qiagens.com
Source: global traffic	DNS traffic detected: DNS query: homelumbernic.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 20:20:27 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: H4Ls72WkA8QCiyOJDjNuLBFVokRjPK0/MoU=$kntjk6Bxu/u8NRKlServer: cloudflareCF-RAY: 8d7caae52cec2e60-DFWalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 20:20:31 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: ATIIZ8RjX4BFyWmlTfSC0LyQljZ9vcLV+WA=$JO/IQzZJZHitFVvbServer: cloudflareCF-RAY: 8d7caafe5c486b7c-DFWalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 20:21:05 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: 3W5OpE2expnpzmY/Yasb9ja4oCuROC84Cks=$2HH+cjReUDg5CHWOcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8d7cabd74efe2c9f-DFWalt-svc: h3=":443"; ma=86400

Source: chromecache_714.14.dr, chromecache_1068.14.dr, chromecache_733.14.dr, chromecache_1052.14.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_1016.14.dr, chromecache_978.14.dr	String found in binary or memory: http://www.contoso.com
Source: chromecache_894.14.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_780.14.dr	String found in binary or memory: http://www.unicode.org/copyright.html
Source: chromecache_1013.14.dr, chromecache_958.14.dr	String found in binary or memory: https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/)
Source: chromecache_1023.14.dr, chromecache_776.14.dr, chromecache_741.14.dr	String found in binary or memory: https://1drv.com/
Source: chromecache_1023.14.dr, chromecache_776.14.dr, chromecache_741.14.dr	String found in binary or memory: https://centralus1-mediad.svc.ms
Source: chromecache_1020.14.dr, chromecache_1050.14.dr, chromecache_963.14.dr, chromecache_790.14.dr	String found in binary or memory: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
Source: ed7554e8-e1f9-40e5-a432-1e96251107c0.tmp.3.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: chromecache_864.14.dr, chromecache_776.14.dr, chromecache_741.14.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/web/policies
Source: chromecache_1069.14.dr, chromecache_752.14.dr	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: chromecache_1023.14.dr, chromecache_776.14.dr, chromecache_741.14.dr	String found in binary or memory: https://livefilestore.com/
Source: chromecache_909.14.dr, chromecache_761.14.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_1023.14.dr, chromecache_740.14.dr, chromecache_837.14.dr, chromecache_776.14.dr, chromecache_741.14.dr, chromecache_883.14.dr	String found in binary or memory: https://media.cloudapp.net
Source: chromecache_909.14.dr, chromecache_761.14.dr	String found in binary or memory: https://microsoft.spfx3rdparty.com
Source: chromecache_837.14.dr, chromecache_883.14.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: bc3c228ad2c13f96cb14375c3860e802.pdf	String found in binary or memory: https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/Etd2wgQOOMlAnCPcJokAti0Br
Source: chromecache_1023.14.dr, chromecache_740.14.dr, chromecache_837.14.dr, chromecache_776.14.dr, chromecache_741.14.dr, chromecache_883.14.dr	String found in binary or memory: https://northcentralus1-medias.svc.ms
Source: chromecache_1061.14.dr, chromecache_1023.14.dr, chromecache_957.14.dr	String found in binary or memory: https://onedrive.cloud.microsoft
Source: chromecache_1061.14.dr, chromecache_1023.14.dr, chromecache_957.14.dr	String found in binary or memory: https://onedrive.dev.cloud.microsoft
Source: chromecache_909.14.dr, chromecache_761.14.dr	String found in binary or memory: https://onedrive.live.com/sa
Source: chromecache_1023.14.dr, chromecache_776.14.dr, chromecache_741.14.dr	String found in binary or memory: https://portal.office.com/
Source: chromecache_1050.14.dr, chromecache_963.14.dr, chromecache_790.14.dr	String found in binary or memory: https://qiagens.com/?cczaakcn
Source: chromecache_741.14.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_776.14.dr, chromecache_741.14.dr	String found in binary or memory: https://res-1-sdf.cdn.office.net
Source: chromecache_776.14.dr, chromecache_741.14.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_732.14.dr	String found in binary or memory: https://res-1.cdn.office.net/files/fabric-cdn-prod_20230815.002/assets
Source: chromecache_912.14.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-11.005/
Source: chromecache_912.14.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-11.005/stsserviceworkerprefetch/stsservicew
Source: chromecache_712.14.dr, chromecache_697.14.dr, chromecache_912.14.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-11.008/
Source: chromecache_912.14.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-11.008/spserviceworker.js
Source: chromecache_712.14.dr, chromecache_697.14.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-11.008/spwebworker.js
Source: chromecache_912.14.dr	String found in binary or memory: https://shell.cdn.office.net/api/ShellBootstrapper/business/OneShell
Source: chromecache_776.14.dr, chromecache_741.14.dr	String found in binary or memory: https://shellppe.msocdn.com
Source: chromecache_776.14.dr, chromecache_741.14.dr	String found in binary or memory: https://shellprod.msocdn.com
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-semili
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semibold
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold
Source: chromecache_888.14.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semiligh
Source: chromecache_1023.14.dr, chromecache_776.14.dr, chromecache_741.14.dr	String found in binary or memory: https://substrate.office.com
Source: chromecache_1033.14.dr, chromecache_1057.14.dr	String found in binary or memory: https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48

Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443

Source: chromecache_1053.14.dr	OLE indicator, VBA macros: true
Source: chromecache_766.14.dr	OLE indicator, VBA macros: true

Source: chromecache_1053.14.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chromecache_766.14.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: bc3c228ad2c13f96cb14375c3860e802.pdf	Initial sample: https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/Etd2wgQOOMlAnCPcJokAti0Br6HyyfMaB6MiwzMZjEF3xw?e=8rf3aZ
Source: bc3c228ad2c13f96cb14375c3860e802.pdf	Initial sample: https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/etd2wgqoomlancpcjokati0br6hyyfmab6miwzmzjef3xw?e=8rf3az
Source: chromecache_958.14.dr	Initial sample: https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\bc3c228ad2c13f96cb14375c3860e802.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1648 --field-trial-handle=1552,i,14824447783216249022,15538149311993325529,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/Etd2wgQOOMlAnCPcJokAti0Br6HyyfMaB6MiwzMZjEF3xw?e=8rf3aZ
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2024,i,8418923506075728781,9654654873541631301,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/Etd2wgQOOMlAnCPcJokAti0Br6HyyfMaB6MiwzMZjEF3xw?e=8rf3aZ	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1648 --field-trial-handle=1552,i,14824447783216249022,15538149311993325529,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2024,i,8418923506075728781,9654654873541631301,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: bc3c228ad2c13f96cb14375c3860e802.pdf	Initial sample: PDF keyword /JS count = 0
Source: bc3c228ad2c13f96cb14375c3860e802.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: chromecache_1013.14.dr	Initial sample: PDF keyword /JS count = 0
Source: chromecache_1013.14.dr	Initial sample: PDF keyword /JavaScript count = 0
Source: chromecache_958.14.dr	Initial sample: PDF keyword /JS count = 0
Source: chromecache_958.14.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: PDF document	LLM: Page contains button: 'View or Download Document' Source: 'PDF document'
Source: PDF document	LLM: PDF document contains prominent button: 'view or download document'
Source: https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445&ga=1	LLM: Page contains button: 'View docs.pdf' Source: '1.2.pages.csv'
Source: https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_layouts/15/onedrive.aspx?ga=1&id=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445%2FView%20docs%2Epdf&parent=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445	LLM: Page contains button: 'View docs.pdf' Source: '2.3.pages.csv'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 1013
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 958	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 1013	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: chromecache_829.14.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_829.14.dr	Binary or memory string: ",DisconnectVirtualMachine:"

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Spearphishing Link	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
http://www.opensource.org/licenses/mit-license.php	0%	URL Reputation	safe
https://substrate.office.com	0%	URL Reputation	safe
http://www.unicode.org/copyright.html	0%	URL Reputation	safe
https://reactjs.org/link/react-polyfills	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
http://fb.me/use-check-prop-types	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
qiagens.com	89.185.80.154	true	false	unknown
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	unknown
mira-ooc.tm-4.office.com	40.99.150.82	true	false	unknown
challenges.cloudflare.com	104.18.95.41	true	false	unknown
www.google.com	172.217.18.4	true	false	unknown
FRA-efz.ms-acdc.office.com	52.98.252.66	true	false	unknown
homelumbernic.com	89.185.80.154	true	false	unknown
16b69e33.0cced60565238cd25cf4ed69.workers.dev	104.21.52.38	true	false	unknown
x1.i.lencr.org	unknown	unknown	false	unknown
neweranet0.sharepoint.com	unknown	unknown	false	unknown
r4.res.office365.com	unknown	unknown	false	unknown
7d922087c09d72a0e525b959f027fa71.fp.measure.office.com	unknown	unknown	false	unknown
m365cdn.nel.measure.office.net	unknown	unknown	false	unknown
tr-ooc-atm.office.com	unknown	unknown	false	unknown
spo.nel.measure.office.net	unknown	unknown	false	unknown
upload.fp.measure.office.com	unknown	unknown	false	unknown
config.fp.measure.office.com	unknown	unknown	false	unknown
tr-ooc-acdc.office.com	unknown	unknown	false	unknown
eastus1-mediap.svc.ms	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/8d7caad09dd84794/1729801225888/0901550898927346355fe5d75953a03f77ad87d1b032785307d7034a8398a9b7/3fJSEn3o2gWLDJ3	false	unknown
https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_api/SP.OAuth.Token/Acquire()	false	unknown
https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_layouts/15/onedrive.aspx?ga=1&id=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445%2FView%20docs%2Epdf&parent=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445	true	unknown
https://eastus1-mediap.svc.ms/transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fneweranet0-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!8LVLDi5f_ESbIAFRkBb_wuVRh8JOqJNMty5azIcUhKaoh_V28urHQpwy_nU-LkKj%2Fitems%2F01Z3M5PR5D36TZOXWFAVBIEQGHQ734MSXQ%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiIwZTRiYjVmMC01ZjJlLTQ0ZmMtOWIyMC0wMTUxOTAxNmZmYzIiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbmV3ZXJhbmV0MC1teS5zaGFyZXBvaW50LmNvbUBkM2VlM2ZlZC1iNTVlLTQ5MzItYTM1NC1kOTI1ZGY1YzUwZGMiLCJleHAiOiIxNzI5ODE0NDAwIn0.CiMKCXNoYXJpbmdpZBIWdHkyK0JJRkk3a3F5OXMrTUdxTmVHQQoICgNzdHASAXQKCgoEc25pZBICMzMSBgjk0zoQARoOMTczLjI1NC4yNTAuNzEiFG1pY3Jvc29mdC5zaGFyZXBvaW50KixBZUtpcUtkQzlVWTZsRUI4NGNqWk0wcENDSUxIYkQ1VWRzU0M2T0JQVlFNPTB4OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2F6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiMzMWE1ODYyMjBiOWUwNGFmYTdlNzE1NmE1MTg0MjYxMDU1YmQwNjI2ZGY2NzNiNzU3YzJlMDE5MDU0ZTVjZGNh.SI8cQ4SXFo4rwUupfSxWZVMv9gk7P3-noB-kUG8aoOk&cTag=%22c%3A%7B97A7DFA3-C55E-4205-8240-C787F7C64AF0%7D%2C1%22&encodeFailures=1&width=1024&height=1024&srcWidth=&srcHeight=	false	unknown
https://qiagens.com/?cczaakcn=8e046e7478bbf41c4cf7f968bdde58ccc0c8096e13ca756c0ff9f4e4f59a51b115684b7074dddc35db930f1d04fff40d449be6179b7d8fa41e235872a3a257c0	false	unknown
https://tr-ooc-acdc.office.com/apc/trans.gif?0c3d74797a89e425b23c11ed7a62611f	false	unknown
https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_api/v2.1/graphql	false	unknown
https://neweranet0-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&enableTheming=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&streamViewServerLoad=true&streamInlineScript=true&siteConfigRace=true	false	unknown
https://neweranet0-my.sharepoint.com/_layouts/15/SPComponentRegistry.ashx?projects=[%22STS%22]&languages=%5B%5D	false	unknown
https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_layouts/15/CSPReporting.aspx	false	unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false	unknown
https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_layouts/15/AccessDenied.aspx?correlation=d0255da1%2Db0b7%2D6000%2Dc603%2D53c63453d726	false	unknown
https://tr-ooc-atm.office.com/apc/trans.gif?ee3d09ce5c171ae002cab98841c92b86	false	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8d7caad09dd84794/1729801225888/xf_Rm4yg23a7UoE	false	unknown
https://tr-ooc-atm.office.com/apc/trans.gif?3df352edd7d3ab59a9ec9e022a676c2e	false	unknown
https://qiagens.com/?cczaakcn	false	unknown
https://homelumbernic.com/mail/	false	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1690534537:1729797106:Vr6q-IfjiwD6LK05wqCpAUcSrx-7RJxtkzzY_oxFyss/8d7caad09dd84794/EXKKNKWsr0IjKeBDAMkvL6v72k0sq1lrBIlW7T0kpZk-1729801223-1.1.1.1-F0kXuPT8b0ur6i8U1cP7ENtEd2xj77x4cJtTXmdkVaiTFxNjzFCYh.xa2WRiDIE9	false	unknown
https://homelumbernic.com/	false	unknown
https://neweranet0-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx	false	unknown
https://neweranet0-my.sharepoint.com/_layouts/15/images/odbfavicon.ico?rev=47	false	unknown
https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445&ga=1	true	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8d7caad09dd84794&lang=auto	false	unknown
https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/	false	unknown
https://challenges.cloudflare.com/turnstile/v0/b/e1a56f38220d/api.js	false	unknown
https://neweranet0-my.sharepoint.com/_layouts/15/SPComponentRegistry.ashx?projects=[%22spfx%22]&languages=%5B%5D	false	unknown
https://homelumbernic.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2hvbWVsdW1iZXJuaWMuY29tLyIsImRvbWFpbiI6ImhvbWVsdW1iZXJuaWMuY29tIiwia2V5IjoiMXNqR21RSU55b09xIiwicXJjIjpudWxsLCJpYXQiOjE3Mjk4MDEyNjYsImV4cCI6MTcyOTgwMTM4Nn0.o6YNK3nB1E9a9nybI_l6eF5h2Dq7umIM8cxLkpUztDs	false	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/e0eoo/0x4AAAAAAAyORc_In180R-LS/auto/fbE/normal/auto/	false	unknown
https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/Etd2wgQOOMlAnCPcJokAti0Br6HyyfMaB6MiwzMZjEF3xw?e=8rf3aZ	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2	chromecache_888.14.dr	false		unknown
https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48	chromecache_1033.14.dr, chromecache_1057.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w	chromecache_888.14.dr	false		unknown
http://www.opensource.org/licenses/mit-license.php	chromecache_894.14.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff	chromecache_888.14.dr	false		unknown
https://northcentralus1-medias.svc.ms	chromecache_1023.14.dr, chromecache_740.14.dr, chromecache_837.14.dr, chromecache_776.14.dr, chromecache_741.14.dr, chromecache_883.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2	chromecache_888.14.dr	false		unknown
https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/Etd2wgQOOMlAnCPcJokAti0Br	bc3c228ad2c13f96cb14375c3860e802.pdf	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff	chromecache_888.14.dr	false		unknown
https://my.microsoftpersonalcontent.com	chromecache_837.14.dr, chromecache_883.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2	chromecache_888.14.dr	false		unknown
https://1drv.com/	chromecache_1023.14.dr, chromecache_776.14.dr, chromecache_741.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff	chromecache_888.14.dr	false		unknown
https://substrate.office.com	chromecache_1023.14.dr, chromecache_776.14.dr, chromecache_741.14.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff	chromecache_888.14.dr	false		unknown
https://onedrive.dev.cloud.microsoft	chromecache_1061.14.dr, chromecache_1023.14.dr, chromecache_957.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo	chromecache_888.14.dr	false		unknown
https://shellppe.msocdn.com	chromecache_776.14.dr, chromecache_741.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof	chromecache_888.14.dr	false		unknown
http://www.unicode.org/copyright.html	chromecache_780.14.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w	chromecache_888.14.dr	false		unknown
https://microsoft.spfx3rdparty.com	chromecache_909.14.dr, chromecache_761.14.dr	false		unknown
https://reactjs.org/link/react-polyfills	chromecache_741.14.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com	chromecache_909.14.dr, chromecache_761.14.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/sa	chromecache_909.14.dr, chromecache_761.14.dr	false		unknown
https://onedrive.cloud.microsoft	chromecache_1061.14.dr, chromecache_1023.14.dr, chromecache_957.14.dr	false		unknown
https://shellprod.msocdn.com	chromecache_776.14.dr, chromecache_741.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2	chromecache_888.14.dr	false		unknown
https://centralus1-mediad.svc.ms	chromecache_1023.14.dr, chromecache_776.14.dr, chromecache_741.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2	chromecache_888.14.dr	false		unknown
https://chrome.cloudflare-dns.com	ed7554e8-e1f9-40e5-a432-1e96251107c0.tmp.3.dr	false	URL Reputation: safe	unknown
https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/)	chromecache_1013.14.dr, chromecache_958.14.dr	false		unknown
https://portal.office.com/	chromecache_1023.14.dr, chromecache_776.14.dr, chromecache_741.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff	chromecache_888.14.dr	false		unknown
https://clients.config.office.net/user/v1.0/web/policies	chromecache_864.14.dr, chromecache_776.14.dr, chromecache_741.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff	chromecache_888.14.dr	false		unknown
http://fb.me/use-check-prop-types	chromecache_714.14.dr, chromecache_1068.14.dr, chromecache_733.14.dr, chromecache_1052.14.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2	chromecache_888.14.dr	false		unknown
https://livefilestore.com/	chromecache_1023.14.dr, chromecache_776.14.dr, chromecache_741.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff	chromecache_888.14.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof	chromecache_888.14.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.98.252.66	FRA-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.67.194.203	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.52.38	16b69e33.0cced60565238cd25cf4ed69.workers.dev	United States	13335	CLOUDFLARENETUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.98.152.242	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
89.185.80.154	qiagens.com	Russian Federation	41757	OLIMP-SVYAZ-ASRU	false
40.99.150.82	mira-ooc.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541497
Start date and time:	2024-10-24 22:18:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bc3c228ad2c13f96cb14375c3860e802.pdf
Detection:	SUS
Classification:	sus23.winPDF@34/694@61/11
Cookbook Comments:	Found application associated with file extension: .pdf

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bc3c228ad2c13f96cb14375c3860e802.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF662ae8.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a59859c2-46b5-4638-a3f3-8cc497d17331.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ed7554e8-e1f9-40e5-a432-1e96251107c0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241024201908Z-156.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.812

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Windows Analysis Report
bc3c228ad2c13f96cb14375c3860e802.pdf

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.136.10	http://algestconsulting20-my.sharepoint.com/:f:/g/personal/jacques_cangah_algest-consulting_com/EkolIGllKGRKhe-gd4i73uMBzF46oqcv00d-WXGnz9D-Fw	Get hash	malicious	Unknown	Browse	algestconsulting20-my.sharepoint.com/:f:/g/personal/jacques_cangah_algest-consulting_com/EkolIGllKGRKhe-gd4i73uMBzF46oqcv00d-WXGnz9D-Fw
	http://bombeirosamora-my.sharepoint.com/:o:/g/personal/geral_comando_bombeirosamora_pt/EqT53jeWO6ZGkv1O_1FowosB2CSGfrKDmTZiEPPt31Ds7g	Get hash	malicious	HTMLPhisher	Browse	bombeirosamora-my.sharepoint.com/:o:/g/personal/geral_comando_bombeirosamora_pt/EqT53jeWO6ZGkv1O_1FowosB2CSGfrKDmTZiEPPt31Ds7g
	http://midlandlangarsevasociety-my.sharepoint.com/:w:/g/personal/sharon_bharaj_mlss_org_uk/EWiGFFYhPhtPjz5jsZdcRooBPGLh-q5SsgwgIhmP7JCmAg	Get hash	malicious	HTMLPhisher	Browse	midlandlangarsevasociety-my.sharepoint.com/:w:/g/personal/sharon_bharaj_mlss_org_uk/EWiGFFYhPhtPjz5jsZdcRooBPGLh-q5SsgwgIhmP7JCmAg
52.98.252.66	ATT71725.html	Get hash	malicious	HTMLPhisher	Browse
	Play_VM-Now(Aaron.fisher)CLQD2.html	Get hash	malicious	HTMLPhisher	Browse
	Payment26.html	Get hash	malicious	HTMLPhisher	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dual-spo-0005.spo-msedge.net	EXTERNALRoger Moczygemba shared DIRECT MED CLINIC - CONFIDENTIAL with you.msg	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://merzcon-my.sharepoint.com/:f:/g/personal/cnico_merzcon_onmicrosoft_com/EmjHG5K9dP9BtgBBeTTFhjABJRRLGM6IhVrJlwBTMWY8rg?e=pfkS1f	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://1drv.ms/o/c/fca0349b9dac3054/Egg4xW-gVZtFnFIBDYLqn3IBzvGvLdCTacUKBwENWO33dQ?e=nEqWJi	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://netorg11230081-my.sharepoint.com/:f:/g/personal/info_onafastpacecontracting_com/Eoa77Lo8BXlOut3qDNQUDAQBBgmgCvIALxhAXrlqjk9Asw?e=2UKAY6	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://churchillmcgee-my.sharepoint.com/:u:/p/tholtzclaw/EZYLQhunQLxJgDl2GitW_PEBRKvAR7X0yXjbidcIUQwyng?e=tBP41r	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://churchillmcgee-my.sharepoint.com/:u:/p/tholtzclaw/EZYLQhunQLxJgDl2GitW_PEBRKvAR7X0yXjbidcIUQwyng?e=tBP41r	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://1drv.ms/o/c/14c2aef4e2cd9199/EmKMpCkEfbpDs04MuZdva6IBilCqbzQYZtfiLbdaioNL0w?e=E2gYSO	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://tcmedcenter-my.sharepoint.com/:f:/g/personal/jessica_larson_tcmedcenter_org/Ek1X93Tsfp5KoiWqKbJ_ocQBqlE2wGVJqWkJh4H7mn0vuw?e=Yni2o7	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://weiderergmbh-my.sharepoint.de/:o:/g/personal/s_kreuzer_luxapark_de/En8ihQEtXF1HtuEzkWTEmvQBXZUe8GC_guY4c0qSMi2Czg?e=5%3aJCIXIb&at=9	Get hash	malicious	Unknown	Browse	13.107.136.10
	ComSource Inc.pdf	Get hash	malicious	Unknown	Browse	13.107.136.10
mira-ooc.tm-4.office.com	bc3c228ad2c13f96cb14375c3860e802.pdf	Get hash	malicious	Unknown	Browse	52.98.179.66
	https://emmaway-my.sharepoint.com/:f:/g/personal/jessica_emmaway_uk/Eodal0AmsKFKtMeEeNJG0V0B3d0_hcKMrsOYen-8p5FxhQ?e=bBSdNW	Get hash	malicious	Unknown	Browse	40.99.222.178
	https://rdhomes-my.sharepoint.com/:f:/g/personal/petrina_ryandesignerhomes_com_au/EtwntXraOOdMp3Nx1zZ6gF8Bf8aWSwNn9o_57nz1-Z9h0A?e=arAOsK	Get hash	malicious	Unknown	Browse	52.98.243.50
	https://url.uk.m.mimecastprotect.com/s/879wCp9pjInpwnDHPf7CG_Zsy?domain=aerographicsut-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	52.98.152.178
	https://kulodayplastomer-my.sharepoint.com/:f:/g/personal/exim_kpplindia_com/EpT6drgdzgdPk3kwQBUf2ZAB7JXXdY25CyMiKP-z5XBGWQ?e=8byFZY	Get hash	malicious	HTMLPhisher	Browse	52.98.241.178
	Aisha C. Yetman shared you a document..msg	Get hash	malicious	Unknown	Browse	52.98.152.162
	https://laurachenel-my.sharepoint.com/:f:/p/durae/EqNLWpSMEBRJoccjxMrYR9cBuepxDM4GGslgNeOpyvFENQ?e=1C1jRH	Get hash	malicious	Unknown	Browse	52.98.179.130
	https://laurachenel-my.sharepoint.com/:f:/p/durae/EqNLWpSMEBRJoccjxMrYR9cBuepxDM4GGslgNeOpyvFENQ?e=1C1jRH	Get hash	malicious	Unknown	Browse	52.98.179.34
	https://jwcattlerancch-my.sharepoint.com/:f:/g/personal/djohnston_cimarrontank_com/EoDAqq6yNx5AqyoqJLpNz-kBNs8XZ01jWsT6VlgzEAPfYg?e=2yscZg&xsdata=MDV8MDJ8ZG91Zy5kcmF5QGVuZXJwYWMuY29tfDRlNmYwZTY5YTc5ZTRiMjI2NWMyMDhkY2Q5ODA3MzJifDE2MDJhZTgyMDI2NjQwZDY5MTBiMTE2ODBmZTBmNmE1fDB8MHw2Mzg2MjQzOTQ0Mzc0NDMyNjB8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDQwMDAwfHx8&sdata=dHpBSDIvMm9nbWhwc0hUWHpPcFhjMlVnUUx4bEZMK09sN1dUUXdQdC80MD0%3d	Get hash	malicious	HTMLPhisher	Browse	52.98.175.2
	https://mafanikiosacco-my.sharepoint.com/:f:/p/info/EgPH1s54501Ki8NU-gutZLABOsAyZ-dhIPJaM6vWEXJqUQ?e=PJpX12	Get hash	malicious	HTMLPhisher	Browse	40.99.214.34

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	191.233.184.223
	Inv Confirmation.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.44
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	52.181.233.52
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	21.215.245.118
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	21.157.124.152
	https://t.ly/8Lgfk	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.45
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	22.254.231.213
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	21.43.25.174
	SecuriteInfo.com.Other.Malware-gen.26961.24680.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.67
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse	52.113.194.132
CLOUDFLARENETUS	https://cswlawgroup.artoffice.cloud/	Get hash	malicious	Unknown	Browse	172.64.146.38
	msvcp110.dll	Get hash	malicious	LummaC	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Loader.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://onlinepdf-qrsharedfile.com/index.html#XYW5uaWUua3lwcmlhbm91QGxjYXR0ZXJ0b24uY29t	Get hash	malicious	HTMLPhisher	Browse	104.16.123.96
	https://t.ly/8Lgfk	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.25.14
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://view.flodesk.com/emails/671a6d1f7ce9f793bb70518a	Get hash	malicious	Unknown	Browse	104.18.18.100
	http://boulos-sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	8.40.143.15
MICROSOFT-CORP-MSN-AS-BLOCKUS	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	191.233.184.223
	Inv Confirmation.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.44
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	52.181.233.52
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	21.215.245.118
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	21.157.124.152
	https://t.ly/8Lgfk	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.45
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	22.254.231.213
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	21.43.25.174
	SecuriteInfo.com.Other.Malware-gen.26961.24680.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.67
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse	52.113.194.132

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Inv Confirmation.htm	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27
	https://cswlawgroup.artoffice.cloud/	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27
	https://onlinepdf-qrsharedfile.com/index.html#XYW5uaWUua3lwcmlhbm91QGxjYXR0ZXJ0b24uY29t	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27
	https://t.ly/8Lgfk	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	52.149.20.212 184.28.90.27
	Doc-Secure6033.pdf	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27
	https://novisurvey.net/ns/n/z133i.aspx	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27
	https://u47751895.ct.sendgrid.net/ls/click?upn=u001.LUpianUM71xe7PV7wDA6i1kcuy38W249FfPzE-2Fn4iGArrL0MQBCUZHFEzmfBrwW7hf5h8aNQUml0OSIHqpXf0Hd-2FwQBg2gsGxKHK7PsY2xc-3DPya1_YT5LbHmSQ6soq50ixwpFbSYZshuq6-2FPFgRa8NDnR03IYhL-2F9Rsp4maHC7HKUeszLncLvtZaWCVsMwsguQ5-2FbgriKbvHymTrFFrqjql1V0tvMkZQvyA1xxy-2B6NtGFoUeUGIrvdabsXN8enx2k5c-2BvLXzm-2BRXmD29Cf33DbXC513Cwkuo46G2I7a1uwsANH8eVhz8r5XyLPneRi4ngixWtQkBEaLBBKkl5CzEPySNlMnqJuuWiTBlFswgUf9EX-2BEhUpqAvMFuAlKTpYcteS-2FjAegbPmUSDcSeBkfnhL6yUhTFHUFrxra-2BdIgnamsXKUUqu-2BC45G51EOfBd9qOCqWy3OeOC7KYj3-2FcaIfcOAM1Jkvyddtn3gwRC5w97RLza-2BBM2JcZLNzMYva4SJzBZv7RClCaMcjevyjP6ZFvlR0NECf5zAmWbPLmCUnefze8ZyTvnDqXVb3nrflSdnTlNxWfm617xjOrSoSu-2BVHZVqbE92ZodSyvWqgaCWZg0TMDZeq64M67nuH9ryo7I5u80SS081vnMThCYiPoN3JUoUliQPKbNY46GxAPyVhMs4qqZVi-2FFUtIGEycXziXytxfy6JCzAZ2sa7DZusc1RftLAVM4uJit-2FAhxM-2FK1sEHsKHKvs9o7uDMExZ5YqEBjrD2XHch-2BY6xwRGGg56MeC1Bpa72xAoR6DmInmiEX4j92yaROEh1-2FMsHdtSstN7zc8gxU7ETVWVMBRLf6m4dTRruSfSNaLUi9QLq9d7Qfe8VMdKN1j9FMGIYia88728BDNNxRTaT4nSNITRr9JPa4Z1K1vdUocdyCKNcYSZsN8yguI0-2FqNXUfWFuoxnz5MDqwufLzxub8Fw-3D-3D	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27
	http://lowes.mooo.com/index.php?search=4&d16852&morde=354-1256&lm=400100KWWT29761&sd=15&page=9u6rpKHD2TMFWFa#izRRKlsmoFgLg4jmhaU9	Get hash	malicious	Phisher	Browse	52.149.20.212 184.28.90.27
	https://chapelet-mariae.com.pl/qgxPm/	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27
	EBalcao_ysx.vbs	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.224143613417402
Encrypted:	false
SSDEEP:	6:+HQ+q2PRN2nKuAl9OmbnIFUt8t1gZmw+t1QVkwORN2nKuAl9OmbjLJ:wVvaHAahFUt8vg/+vI5JHAaSJ
MD5:	20292C032DCF15951FDC2E845497CBC6
SHA1:	8C2093F8592156FAEE88675CE16AD501CF1BBD63
SHA-256:	E26C4ACE7B2A950839D0AA4B278472BAC672BA60D0DEF002781D7B533DAD73F9
SHA-512:	444556BE9B0A721BA6C863BB46E4DE8E9799728872FE26516F9786BC4175F838522B8AC0D58FEAFA5A10E9EC73C05F59F828E3CDCD9985D98A8347F03C6746EA
Malicious:	false
Preview:	2024/10/24-16:19:05.144 1bf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/24-16:19:05.146 1bf8 Recovering log #3.2024/10/24-16:19:05.146 1bf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 19:19:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.978514332112559
Encrypted:	false
SSDEEP:	48:8md1TdhjuHBidAKZdA1FehwiZUklqeh1y+3:8oz4ey
MD5:	284376D809D4F3B9BE436DE360901700
SHA1:	6D29643D2908B009372048BB159B6F6FA9ADBCA1
SHA-256:	88C005C08B852F6E18B7F1DEA1D78A84678CB1A58A70D69C04B6DA81BE6172A0
SHA-512:	562FC86367C2700DCFA0C26A9E96F8F070929A55580AEB204CC34CE1C259EA8D3BC0D0EDCFF57F8345EF28D9CFAA6BFDC21B81356E7C0BF43EF3D12896AA05B1
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......R&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXYW.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXYo.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXYo.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXYo............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXYp............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	PDF document, version 1.7, 1 pages
Entropy (8bit):	7.979891406734971
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	bc3c228ad2c13f96cb14375c3860e802.pdf
File size:	133'758 bytes
MD5:	5448dddeb4ccaa5cf39694f5c28a4b76
SHA1:	a64f68d8253c21beb398272f795aaa62db4de3f4
SHA256:	3d54f8929f551c67e0bec56d1a7c13be514b799da109ab85f3edb06681a32e2a
SHA512:	e5e4b1b0c07c8a3c2e0a6755a2fe0e8dc17a774bf0bc4d49d10dfa8802df115975527002d40fcb6e3c34b050e347161f150a49d79524f85c065e55f98397abab
SSDEEP:	3072:w1kesM92EapSJeCGvZ3Ed/k69/Lc2bNKW9L7zb/ctV:w1YAap9v0LcZW9LfLSV
TLSH:	43D301BA961163DCE40903D19E8B3C921F5DB33D71D8A0AF145F89472988B32D9EF58D
File Content Preview:	%PDF-1.7.%.....1 0 obj.<<./Type /Catalog./Pages 3 0 R./Lang (en-US).>>.endobj.2 0 obj.<<./Title <FEFF0055006E007400690074006C00650064>./Creator <FEFF004D006900630072006F0073006F006600740020004F0066006600690063006500200057006F00720064>./Producer (3.0.20 \(

General
Header:	%PDF-1.7
Total Entropy:	7.979891
Total Bytes:	133758
Stream Entropy:	7.985691
Stream Bytes:	128989
Entropy outside Streams:	5.085563
Bytes outside Streams:	4769
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	29
endobj	29
stream	9
endstream	9
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

ID	DHASH	MD5	Preview
16	0000000000000000	b92e1fe9dfed9838edfcf33034022d45
18	c8e4b03232b3c4c4	cb05f5f9cceafb2a46de9e308f748981