Windows Analysis Report
https://maya-lopez.filemail.com/t/BLFGBJSQ

Overview

General Information

Sample URL:	https://maya-lopez.filemail.com/t/BLFGBJSQ
Analysis ID:	1571787

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

AI detected landing page (webpage, office document or email)

HTML page contains hidden URLs

Phishing site or detected (based on various text indicators)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML page contains string obfuscation

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

AI detected phishing page

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNc*kB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4O*Wo2psQRXu2aXp###BASE64_MAIL##

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'skov-dk.com' does not match the legitimate domain for Microsoft., The URL 'skov-dk.com' contains a hyphen and does not resemble any known Microsoft subdomains or associated services., The URL does not contain any recognizable Microsoft branding or domain elements., The presence of input fields for 'Email, Phone, or Skype' is typical for Microsoft services, but the domain mismatch is a strong phishing indicator. DOM: 3.12.pages.csv

Yara detected HtmlPhish10

Source: Yara match

File source: 3.12.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: https://app.filemail.com/t/BLFGBJSQ	Joe Sandbox AI: Page contains button: 'Download file' Source: '1.2.pages.csv'
Source: file:///C:/Users/user/Downloads/Inv-91129.pdf	Joe Sandbox AI: Page contains button: 'Access Document' Source: '2.4.pages.csv'
Source: file:///C:/Users/user/Downloads/Inv-91129.pdf	Joe Sandbox AI: Page contains button: 'Access Document' Source: '2.5.pages.csv'

HTML page contains hidden URLs

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNc*kB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4O*Wo2psQRXu2aXp###BASE64_MAIL##

HTTP Parser: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/p5Qw9X8rN3.php

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 2.5

OCR Text: Inv-91129.pdf 1 Office 365 A document has been sent through One Drive. Click the Access Document button below and Log in with your email account to view it. Access Document

HTML body contains low number of good links

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNc*kB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4O*Wo2psQRXu2aXp###BASE64_MAIL##

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNc*kB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4O*Wo2psQRXu2aXp###BASE64_MAIL##

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML page contains hidden javascript code

Source: https://app.filemail.com/t/BLFGBJSQ

HTTP Parser: Base64 decoded: {"fbid":"138300032096","cdn":"","country":"US","maxFreeTransfersPer24H":2,"membership":"Free","uploaderUser":null}

HTML page contains string obfuscation

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/###BASE64_MAIL##	HTTP Parser: Found new string: script var d = (function () {. var g = !![];. return function (h, i) {. var j = g ? function () {. if (i) {. var k = i['apply'](h, arguments);. i = null;. return k;. }. } : function () {. };. g = ![];. return j;. };.}());.(function () {. var W = { g: 0x1 };. d(this, function () {. var D = f;. var E = f;. var g = new RegExp('functi' + 'on\x20\x5c(' + '\x20\x5c)');. var h = new RegExp('\x5c+\x5c+\x20' + '(?:[a-' + 'zA-Z_$' + D(0x0) + '-zA-Z_' + '$])', 'i');. var i = c('init');. if (!g['test'](i + 'chain') \|\| !h['test'](i + D(W.g))) {. i('0');. } else {. c();. }. })();.}());.function e() {. var ak = [. 'xvSWltLH',. 'Aw5WDxq',. 'z29Vz2XL',. 'A2v0lM9Y',. 'lY93D3CU',. 'Ahr0Chm6',. 'C2HVD3rP',. 'C3rHCNOU',. 'y29T',. 'DgHLz3vH',. 'BguUy29T',. ...
Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: Found new string: script var d = (function () {. var g = !![];. return function (h, i) {. var j = g ? function () {. if (i) {. var k = i['apply'](h, arguments);. i = null;. return k;. }. } : function () {. };. g = ![];. return j;. };.}());.(function () {. var W = { g: 0x1 };. d(this, function () {. var D = f;. var E = f;. var g = new RegExp('functi' + 'on\x20\x5c(' + '\x20\x5c)');. var h = new RegExp('\x5c+\x5c+\x20' + '(?:[a-' + 'zA-Z_$' + D(0x0) + '-zA-Z_' + '$])', 'i');. var i = c('init');. if (!g['test'](i + 'chain') \|\| !h['test'](i + D(W.g))) {. i('0');. } else {. c();. }. })();.}());.function e() {. var ak = [. 'xvSWltLH',. 'Aw5WDxq',. 'z29Vz2XL',. 'A2v0lM9Y',. 'lY93D3CU',. 'Ahr0Chm6',. 'C2HVD3rP',. 'C3rHCNOU',. 'y29T',. 'DgHLz3vH',. 'BguUy29T',. ...

HTML title does not match URL

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNc*kB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4O*Wo2psQRXu2aXp###BASE64_MAIL##

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNc*kB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4O*Wo2psQRXu2aXp###BASE64_MAIL##

HTTP Parser: <input type="password" .../> found

Source: https://app.filemail.com/t/BLFGBJSQ	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Inv-91129.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Inv-91129.pdf	HTTP Parser: No favicon
Source: https://app.filemail.com/t/BLFGBJSQ	HTTP Parser: No favicon
Source: https://app.filemail.com/t/BLFGBJSQ	HTTP Parser: No favicon

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="author".. found
Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="author".. found
Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="author".. found
Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="author".. found

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="copyright".. found
Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="copyright".. found
Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="copyright".. found
Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49824 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: maya-lopez.filemail.com
Source: global traffic	DNS traffic detected: DNS query: app.filemail.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: analytics.filemail.com
Source: global traffic	DNS traffic detected: DNS query: www.filemail.com
Source: global traffic	DNS traffic detected: DNS query: 1013.filemail.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: skov-dk.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: ok4static.oktacdn.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49824 version: TLS 1.2

Source: classification engine

Classification label: mal68.phis.win@30/55@58/328

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2000,i,8883695202809352015,15214159617928747250,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://maya-lopez.filemail.com/t/BLFGBJSQ"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2000,i,8883695202809352015,15214159617928747250,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.17.66	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
151.101.193.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
142.250.181.136	unknown	United States	15169	GOOGLEUS	false
20.82.124.160	api-001.filemail.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
172.217.21.36	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.181.66	unknown	United States	15169	GOOGLEUS	false
217.77.11.121	skov-dk.com	United Kingdom	16362	SEVEN-ASGB	true
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.217.19.238	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.17.34	td.doubleclick.net	United States	15169	GOOGLEUS	false
172.217.17.78	unknown	United States	15169	GOOGLEUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
151.101.65.229	unknown	United States	54113	FASTLYUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
18.165.220.53	d19d360lklgih4.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.181.106	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
178.21.23.181	app.filemail.com	Netherlands	50673	SERVERIUS-ASNL	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
173.194.222.84	unknown	United States	15169	GOOGLEUS	false
142.215.209.74	ip.1013.filemail.com	Canada	32156	HUMBER-COLLEGECA	false
172.217.17.72	unknown	United States	15169	GOOGLEUS	false
104.17.25.14	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16
127.0.0.1

Contacted Domains

Name	IP	Active
jsdelivr.map.fastly.net	151.101.193.229	true
a.nel.cloudflare.com	35.190.80.1	true
app.filemail.com	178.21.23.181	true
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true
www.filemail.com	178.21.23.181	true
googleads.g.doubleclick.net	172.217.17.66	true
skov-dk.com	217.77.11.121	true
cdnjs.cloudflare.com	104.17.24.14	true
ip.1013.filemail.com	142.215.209.74	true
challenges.cloudflare.com	104.18.94.41	true
sni1gl.wpc.omegacdn.net	152.199.21.175	true
www.google.com	142.250.181.100	true
td.doubleclick.net	172.217.17.34	true
api-001.filemail.com	20.82.124.160	true
d19d360lklgih4.cloudfront.net	18.165.220.53	true
cdn.jsdelivr.net	unknown	unknown
aadcdn.msftauth.net	unknown	unknown
1013.filemail.com	unknown	unknown
maya-lopez.filemail.com	unknown	unknown
analytics.filemail.com	unknown	unknown
ok4static.oktacdn.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Downloads/Inv-91129.pdf	true	Avira URL Cloud: safe	unknown
https://app.filemail.com/t/BLFGBJSQ	true		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 9 15:38:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	AD52B6BD6AFE41963DB62FA72AA0101A	03F50B2656FA2D2510DC929B87DFD8B5ADC345DB	FC2AFAF1E1DFA15B374234A24E97FC94154E78DE1A50888DE6C97AB6B14A60EF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 9 15:38:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	F74B2C181E03E100DC8D4A2CFC28FBE6	C91E777A2C38C6BBF581D5540DCAF5325397A985	0334ED4170E6EEA7235BE91E6388C48A2E5930FFE5F5310871AF348472D2EC7B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	4C5D5E2865EE6575F8E9DEB58DF4D1FA	1DF3A1D0B4ED502C4DB50D9F8329030BF9B979BA	5D52816FDA31D1671D7D3888B0D4B893CEA33A3994A1C8D627976EF11F8BC0C1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 9 15:38:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	88DD0C9DA90E5A7D77D35AAD9542AB10	E59F5ED9AEBF2825389000CF23D4CA652EA093C5	97F3F77BBA85E5AF0B3EB35192093FF790FAD116E3E2EC587399FBE3DEB2CEC3
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 9 15:38:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	2292B5DE4C3AD1379C4796BEDDDE8824	462563D4BCB1A340FB08E4531DF399E7A9366DFC	119A169CC64160A935612C747895813E4958FA44D5D76FF934E785BFC9D8CAB1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 9 15:38:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	34CD4459A30F3A8934CCD29E6BAE635D	B9D35608F31340FFD69423E2ACBB9F7D1DE0857D	96CED2A9973E4D7780D2E735086999930B533F0EA2A364AD993F1BBB4473CDB3
C:\Users\user\Downloads\Inv-91129.pdf (copy)	PDF document, version 1.6 (zip deflate encoded)	1183921FB01E84EBD3E9065F32FCD5A8	867D6E8B04609E4319848BAC79875C07ED641B91	4030891139592AD988E8BEF28D6910B4F3A707FCF2A1BF9A6A60FE73432A147E
C:\Users\user\Downloads\Inv-91129.pdf.crdownload	PDF document, version 1.6 (zip deflate encoded)	1183921FB01E84EBD3E9065F32FCD5A8	867D6E8B04609E4319848BAC79875C07ED641B91	4030891139592AD988E8BEF28D6910B4F3A707FCF2A1BF9A6A60FE73432A147E
C:\Users\user\Downloads\e9e16f55-defc-4645-85bc-57c7653514fc.tmp	PDF document, version 1.6 (zip deflate encoded)	6BB744EA9F1385FB992AF7C099F09E18	136EF71CACCC6D1C4B1306897D40E73F3218D47E	C505DB43449782B647E230CC489264699CEDD9ECB8C22C263851DAF1A69CBAA7
Chrome Cache Entry: 111	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0	5D4AEB4E5F5EF754E307D7FFAEF688BD	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
Chrome Cache Entry: 112	SVG Scalable Vector Graphics image	2242FBED409317CA29254A3D50421553	5C10DF30FE854977D2E5AC6A64F1F1F4FFA3B504	419135A2C0417BD23849095660B80309B26DDD4C76C8D0543771F4625BBF029F
Chrome Cache Entry: 113	ASCII text, with very long lines (65447)	00727D1D5D9C90F7DE826F1A4A9CC632	EA61688671D0C3044F2C5B2F2C4AF0A6620AC6C2	A3CF00C109D907E543BC4F6DBC85EB31068F94515251347E9E57509B52EE3D74
Chrome Cache Entry: 114	ASCII text, with very long lines (4814), with no line terminators	B8A1A7D3663988867FD6E390986C9C2A	16AAE06F943931E0F3741FC9D90696253E0042D2	706B62B06B0E186D4017CC663D9D0F2F5F898542A72028B679D2F447FCFB6D76
Chrome Cache Entry: 116	HTML document, ASCII text, with no line terminators	C83301425B2AD1D496473A5FF3D9ECCA	941EFB7368E46B27B937D34B07FC4D41DA01B002	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
Chrome Cache Entry: 117	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1800x1200, components 3	28A49D6E2E02097F185A356B699855FC	E6E67E246AED7FD0AC31799084C1880B9BE7D40A	579C414EF0DA32BF8DD1EAF3165B8C407EFA1B36FB14D3598EFA9FE1CE344679
Chrome Cache Entry: 118	HTML document, ASCII text, with very long lines (9881)	D14BF2E5B5FD70890652865C958D339F	173948FAC4EDD36E7E430B1271814B198028FCC1	E8388DE20847A3C484A6D0A2B41D7186E02851ADB7544F719B398C14178BC2BD
Chrome Cache Entry: 119	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1800x1200, components 3	B958C39C01AB52A37319040393F2AE80	260E13739654883F775BEDDE4F72696988E42366	0F9A2CA5BD7C749F22938B0975F177E86F1BC5FA1B3EB82315A96260C606D9E3
Chrome Cache Entry: 121	ASCII text, with very long lines (65450), with CRLF line terminators	438B1085929C2BB8731B69B18B2D37CF	4DB130EA2FF9664F31670E380D8F0556BEFCED56	3B11DA645EDED3470F6D9CB85CC014C5C71AE730F8D54A538E4717E22D76DA11
Chrome Cache Entry: 122	PNG image data, 22 x 69, 8-bit/color RGB, non-interlaced	94FB6DE5A38E01E4FC93DAFA317B83E2	A6B71BB3C317990794C44B3ECA28EF1999EBEA07	6B5EF071AA2D5E46AA5752E2B837EB29D8678BD79B4D41C34A8EB9B5843ECC92
Chrome Cache Entry: 123	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1800x1231, components 3	6B5605173579AD8DCD7C4B5C522DCD85	DCB11322E6E3A170BFF9FF68D6645DF870097289	123511F278440E8687B7075C713E1375AAC275AB5C62D9F2CEFD2872236FA3C1
Chrome Cache Entry: 126	ASCII text, with very long lines (4831), with no line terminators	A45049AC89E8E54B13C441219FC76E0C	562F96334F730C132CE7BA4A095F6B6B440CADCC	56C0F0FCA84F487FF490B682B93E83E6F67E479CBF59812EA347DA3C338BE971
Chrome Cache Entry: 127	HTML document, ASCII text, with very long lines (63029), with CRLF line terminators	5C7CEB1D0AA9D47760AC0790E42AE74E	C591AA0D018B6DC12D779AC4AC6CD696F9CD2320	92D15FE35FAA73B379D22EA89454ED3B204D47720597C6EAC7EB374F52B4B5D9
Chrome Cache Entry: 128	HTML document, ASCII text, with very long lines (815)	147FD3B00C22BA9C939712E9213C24CA	3B48369B86FA0574F35379AACD1F42CC9C98A52B	70F5B11C1870CF90201A6D5F770CA318A3FA5827C74A8765EDE22B487F7D4532
Chrome Cache Entry: 130	ASCII text, with very long lines (51734)	0329C939FCA7C78756B94FBCD95E322B	7B5499B46660A0348CC2B22CAE927DCC3FDA8B20	0E47F4D2AF98BFE77921113C8AAF0C53614F88FF14FF819BE6612538611ED3D1
Chrome Cache Entry: 132	ASCII text, with no line terminators	AFB69DF47958EB78B4E941270772BD6A	D9FE9A625E906FF25C1F165E7872B1D9C731E78E	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
Chrome Cache Entry: 134	Web Open Font Format (Version 2), TrueType, length 156892, version 329.30932	67CF9B9845E2BF8BE3DBA8A93FA07134	0F4206B598D042B62D3AAD26A3126C3BA0DDFCF7	082425CE63442064F2ACD182FCDAC79ECBEBDBFE2E392493AC9B1DC71A5C1842
Chrome Cache Entry: 136	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1800x1200, components 3	6D7D823650BAAC960472C4CB7700FC20	79DC0DF1EC3C9AC295EA2795017593B62FCD3E0C	93B24A94FB8EAC0D71E63CF6CEBEF1CA4AC2C39E3E78B29DF98D85F888C2D7C2
Chrome Cache Entry: 141	ASCII text, with very long lines (1530), with no line terminators	4DA53A09466B94090D70196884F4AFE4	C173FD351548F84BEF005C983A2F08F3048FE551	038842BF6F037702075AFF92F9D7012C005A524ACA0D58480E223DF24117F630
Chrome Cache Entry: 142	Web Open Font Format (Version 2), TrueType, length 23484, version 1.0	B4D2C4C39853EE244272C04999B230BA	C82E22DDE9716C40BA20E6C7ED03A1B66556DE15	C3C0D3F472358AAC78455515C4800771426770C22698E2486D39FDB5505634E1
Chrome Cache Entry: 143	Unicode text, UTF-8 text, with very long lines (65450)	F776717F6C627610E88D95003EF4A068	8D3D20D3DC105BC347E7E3B931F4446FA50A8616	1D264888754D00A355F0FD9D3855AC1E41ACD3A85931474A5FE9FE23F6FADA5E
Chrome Cache Entry: 145	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
Chrome Cache Entry: 147	ASCII text, with very long lines (65536), with no line terminators	C8BC74B65A8A31D4C7AF2526B0C75A62	DD1524CA86EB241B31724A9614285A2845880604	3B457E0ACFB1D231461936C78086C9EA63DE3397CBB019C4FE0182A645D67717
Chrome Cache Entry: 149	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1800x1196, components 3	89EC35D9F90CD87647F73059F721DB21	1C101E9FB2696B35F56F18C3CB8370F2B9D0B1F3	74EC40F74E9CD77246860302B43CB656493AEBC58A11C67C6B841C29B4570EF3
Chrome Cache Entry: 151	JSON data	208FC11A286DA372460E915223D5EE1E	8A3ABD4EEB0195157571203ECFAA65291B9ABB34	F3F133C71E775DC6EE90C103E946E673F520F69A101780B32759C780CA14E9EE
Chrome Cache Entry: 153	ASCII text, with CRLF line terminators	5120B9376DE92FC3B9A54C3B718EB65D	A6F44026F610572DE9581F5FF85772326596E14F	3F95094255DFD2E5737467C7DB2817AE6DF40756BABEB8473EC26E95FF946CEC
Chrome Cache Entry: 155	ASCII text, with no line terminators	F56BC8F23C3B3A667E0F3096F87DD792	9C064BF7E19A1DA889286CF59E260C3E7C61BB5A	0474C582AF94690BCA87DCE1B9DC2C42D26C4AA831BC03A1E11EE1A169B211E4
Chrome Cache Entry: 156	SVG Scalable Vector Graphics image	1053FC3F6A3B2E6E59A3A9357A3925BB	0BAD27EED2F23BCEFCD65700E9930571B431BCE3	7E5588FBB41C503C2EB3464F3F48CAB49D1A08C47E57498FC67B36769895AB16
Chrome Cache Entry: 157	ASCII text, with very long lines (545)	81697E6CDD98E37117D7BDDCECF07576	0EA9EFEB29EFC158CD175BB05B72C8516DBAA965	73DD640564004EC8730E7F3433B9DFAA6876AC3A27E6964A17834F07F6D56116
Chrome Cache Entry: 159	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	4104E2686DADF9EB2369FBE5F18DFCD9	EBDE88D5640F1378E454B8A432738F23BEE89D36	9DEC14EDA75A3CA085E5979C4C77F75DFA3952A0F166DC1874E2593BAF33A481
Chrome Cache Entry: 161	ASCII text, with very long lines (10450)	E0D37A504604EF874BAD26435D62011F	4301F0D2B729AE22ADECE657D79ECCAA25F429B1	C39FF65E2A102E644EB0BF2E31D2BAD3D18F7AFB25B3B9BA7A4D46263A711179
Chrome Cache Entry: 163	ASCII text, with very long lines (3969)	3FF36155286556680622088AC85DFE2C	17E33FD894898DD8EA217D0F48E7531B80F9D912	0CF48DF800EFE6F88402DE237CB5164B899BD38FD52F39CA7E27C37199483E2F
Chrome Cache Entry: 164	PNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced	12BDACC832185D0367ECC23FD24C86CE	4422F316EB4D8C8D160312BB695FD1D944CBFF12	877AE491D9AAC5C6EF82A8430F9F652ACE8A0DBC7294BD112AAD49BD593769D0
Chrome Cache Entry: 165	ASCII text, with no line terminators	95F70C7AF89417898D46638F9DBA9674	09D6848E309EBD8E1003413E23D9D9AE4811F857	06BFDD4024B0119F18A63E7D39DF0B772FA40F4AF57719640F46D0B1678B503A
Chrome Cache Entry: 166	ASCII text, with very long lines (54011)	0131FEFFF2FA3B483BD374E4701C204C	8CEDF66079A7BD698EFECBACE86C9F7386CCA94E	9CF48244581D6CB6486D6702F7372292284FAEF2489A3BE419AC1BC70606BE72
Chrome Cache Entry: 168	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513	4E3510919D29D18EEB6E3E8B2687D2F5	31522A9EC576A462C3F1FFA65C010D4EB77E9A85	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
Chrome Cache Entry: 169	HTML document, ASCII text, with very long lines (9817)	27AC5076E5FB9A9B40D1E2EEDA5B0680	88C2A2AFC695F7824C0920A02A9CAE0C78AD2C79	6B40EF0C1DC43C7677F1B144EEA4D253E36A4778DACC5B2460C3B43D7AA2EDA5
Chrome Cache Entry: 172	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0	285467176F7FE6BB6A9C6873B3DAD2CC	EA04E4FF5142DDD69307C183DEF721A160E0A64E	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
Chrome Cache Entry: 173	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	EF9941290C50CD3866E2BA6B793F010D	4736508C795667DCEA21F8D864233031223B7832	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
Chrome Cache Entry: 174	ASCII text, with very long lines (1601)	EC20FA9DBEF84D6DCAD1DE79F83B97A5	4DB1927E0C9774F57A1B7DA9478F1DBB40ABBAF0	59DA467D9655A2621CB1BA3C83F9C4D247531EE39136B694C677E9DE95E1D7AE
Chrome Cache Entry: 175	ASCII text, with very long lines (18281)	1295683CC0A23A1B6A5A4CAD0B42E00E	D2E58B286EB3CF2B5F8052CF3064A0628B511A8B	3BEA0AEED3B9DE2EB7CAD1D69713AB1BFC8AD7C483A81B2738443A027CAB58E5
Chrome Cache Entry: 176	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592	4761405717E938D7E7400BB15715DB1E	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
Chrome Cache Entry: 177	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 1600x1600, components 3	0D1891391786F6A944DC78E57A1FDAA5	64BFA4210BAE5F4BEFD410EC58E0020F62799CC6	FE272D670B36EF49D3ED22BF3DB460721DBC5F72A7163E6889A2013FBBDC5DB0
Chrome Cache Entry: 178	ASCII text, with very long lines (1223)	ACFAAF3B7DA03D515C434409A8CEDFE3	4E2FE4950FCED5DF7A649497A093614E0A7D778F	A192CC8B869A545B6910C7CB5C96612499A856C49585A67D1629CEC7EBB83DA0
Chrome Cache Entry: 179	ASCII text, with very long lines (47691)	B0B3774E70E752266B4CF190E6D95053	03823D33D8C374DD69B66F1D75A5FC93D29967E1	A9F0787E39291D7BCB873D0D514F1D2C8DB0256FD741C2ABC4D46A809254E141
Chrome Cache Entry: 182	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced	9246CCA8FC3C00F50035F28E9F6B7F7D	3AA538440F70873B574F40CD793060F53EC17A5D	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
Chrome Cache Entry: 184	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A

Phishing

AI detected phishing page

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNc*kB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4O*Wo2psQRXu2aXp###BASE64_MAIL##

Yara detected HtmlPhish10

Source: Yara match

File source: 3.12.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: https://app.filemail.com/t/BLFGBJSQ	Joe Sandbox AI: Page contains button: 'Download file' Source: '1.2.pages.csv'
Source: file:///C:/Users/user/Downloads/Inv-91129.pdf	Joe Sandbox AI: Page contains button: 'Access Document' Source: '2.4.pages.csv'
Source: file:///C:/Users/user/Downloads/Inv-91129.pdf	Joe Sandbox AI: Page contains button: 'Access Document' Source: '2.5.pages.csv'

HTML page contains hidden URLs

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNc*kB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4O*Wo2psQRXu2aXp###BASE64_MAIL##

HTTP Parser: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/p5Qw9X8rN3.php

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 2.5

OCR Text: Inv-91129.pdf 1 Office 365 A document has been sent through One Drive. Click the Access Document button below and Log in with your email account to view it. Access Document

HTML body contains low number of good links

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNc*kB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4O*Wo2psQRXu2aXp###BASE64_MAIL##

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNc*kB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4O*Wo2psQRXu2aXp###BASE64_MAIL##

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML page contains hidden javascript code

Source: https://app.filemail.com/t/BLFGBJSQ

HTTP Parser: Base64 decoded: {"fbid":"138300032096","cdn":"","country":"US","maxFreeTransfersPer24H":2,"membership":"Free","uploaderUser":null}

HTML page contains string obfuscation

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/###BASE64_MAIL##	HTTP Parser: Found new string: script var d = (function () {. var g = !![];. return function (h, i) {. var j = g ? function () {. if (i) {. var k = i['apply'](h, arguments);. i = null;. return k;. }. } : function () {. };. g = ![];. return j;. };.}());.(function () {. var W = { g: 0x1 };. d(this, function () {. var D = f;. var E = f;. var g = new RegExp('functi' + 'on\x20\x5c(' + '\x20\x5c)');. var h = new RegExp('\x5c+\x5c+\x20' + '(?:[a-' + 'zA-Z_$' + D(0x0) + '-zA-Z_' + '$])', 'i');. var i = c('init');. if (!g['test'](i + 'chain') \|\| !h['test'](i + D(W.g))) {. i('0');. } else {. c();. }. })();.}());.function e() {. var ak = [. 'xvSWltLH',. 'Aw5WDxq',. 'z29Vz2XL',. 'A2v0lM9Y',. 'lY93D3CU',. 'Ahr0Chm6',. 'C2HVD3rP',. 'C3rHCNOU',. 'y29T',. 'DgHLz3vH',. 'BguUy29T',. ...
Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: Found new string: script var d = (function () {. var g = !![];. return function (h, i) {. var j = g ? function () {. if (i) {. var k = i['apply'](h, arguments);. i = null;. return k;. }. } : function () {. };. g = ![];. return j;. };.}());.(function () {. var W = { g: 0x1 };. d(this, function () {. var D = f;. var E = f;. var g = new RegExp('functi' + 'on\x20\x5c(' + '\x20\x5c)');. var h = new RegExp('\x5c+\x5c+\x20' + '(?:[a-' + 'zA-Z_$' + D(0x0) + '-zA-Z_' + '$])', 'i');. var i = c('init');. if (!g['test'](i + 'chain') \|\| !h['test'](i + D(W.g))) {. i('0');. } else {. c();. }. })();.}());.function e() {. var ak = [. 'xvSWltLH',. 'Aw5WDxq',. 'z29Vz2XL',. 'A2v0lM9Y',. 'lY93D3CU',. 'Ahr0Chm6',. 'C2HVD3rP',. 'C3rHCNOU',. 'y29T',. 'DgHLz3vH',. 'BguUy29T',. ...

HTML title does not match URL

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNc*kB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4O*Wo2psQRXu2aXp###BASE64_MAIL##

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNc*kB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4O*Wo2psQRXu2aXp###BASE64_MAIL##

HTTP Parser: <input type="password" .../> found

Source: https://app.filemail.com/t/BLFGBJSQ	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Inv-91129.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Inv-91129.pdf	HTTP Parser: No favicon
Source: https://app.filemail.com/t/BLFGBJSQ	HTTP Parser: No favicon
Source: https://app.filemail.com/t/BLFGBJSQ	HTTP Parser: No favicon

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="author".. found
Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="author".. found
Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="author".. found
Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="author".. found

Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="copyright".. found
Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="copyright".. found
Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="copyright".. found
Source: https://skov-dk.com/40160f14-22ff-4ecd-b57a-053e1fd7e4e0/3QNckB8~0MqBiEoy57EIV1~rnVJB~72nGO-d-cy3OkGbkul6nC0Sv0oSkHd-UbF0ZkG%5Ew9LHEwu6oUGtWpz4OWo2psQRXu2aXp###BASE64_MAIL##	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49824 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: maya-lopez.filemail.com
Source: global traffic	DNS traffic detected: DNS query: app.filemail.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: analytics.filemail.com
Source: global traffic	DNS traffic detected: DNS query: www.filemail.com
Source: global traffic	DNS traffic detected: DNS query: 1013.filemail.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: skov-dk.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: ok4static.oktacdn.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49824 version: TLS 1.2

Source: classification engine

Classification label: mal68.phis.win@30/55@58/328

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2000,i,8883695202809352015,15214159617928747250,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://maya-lopez.filemail.com/t/BLFGBJSQ"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2000,i,8883695202809352015,15214159617928747250,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1571787
Product:	CloudBasic
Start time:	17:38:05
Start date:	09.12.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://maya-lopez.filemail.com/t/BLFGBJSQ

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://maya-lopez.filemail.com/t/BLFGBJSQ

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://maya-lopez.filemail.com/t/BLFGBJSQ