Edit tour

Windows Analysis Report
https://maya-lopez.filemail.com/t/XhcWEjoR

Overview

General Information

Sample URL:	https://maya-lopez.filemail.com/t/XhcWEjoR
Analysis ID:	1590247
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found potential malicious PDF (bad image similarity)

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Phishing site or detected (based on various text indicators)

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2104 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2128,i,6585608803107381090,107769894197230907,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6564 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://maya-lopez.filemail.com/t/XhcWEjoR" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

Acrobat.exe (PID: 2568 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\Inv-10319.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3964 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5664 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1736,i,7133644685456521837,7590877476969925145,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 6692 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://q6zm.omimpether.ru/KEX1OS/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2012,i,5037218291940872250,1452618677564776779,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /matomo.php?action_name=Maya%20Lopez%20-%20Maya%20Lopez%20shared%20Ref%23Inv-10319%22%20With%20you&idsite=1&rec=1&r=796043&h=14&m=28&s=19&url=https%3A%2F%2Fapp.filemail.com%2Ft%2FXhcWEjoR&_id=a97cc10ed58ab510&_idn=1&send_image=0&_refts=0&pv_id=kP5v9P&pf_net=898&pf_srv=466&pf_tfr=346&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1280x1024 HTTP/1.1Host: analytics.filemail.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded; charset=utf-8Accept: */*Origin: https://app.filemail.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://app.filemail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _pk_id.1.c4fe=a97cc10ed58ab510.1736796499.; _pk_ses.1.c4fe=1

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 13 Jan 2025 19:28:50 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uM4ftgNL3r9rPJpBtVKy9OPGLRAdJeVjnpiXvMSu0CJt5ds2qbMiCa6PVheqggNxtnTvT1TDeoKqyXZBRrw%2Fb7krdrAe%2BYZ51a1dOzgrz%2FCCqLoRGKvNQDr7nzlzTA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=73854&min_rtt=73845&rtt_var=27698&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2233&delivery_rate=38567&cwnd=219&unsent_bytes=0&cid=ff5be5854ac4d27f&ts=389&x=0"CF-Cache-Status: MISSServer: cloudflareCF-RAY: 9017caa7f82642e9-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1801&min_rtt=1782&rtt_var=707&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1900&delivery_rate=1505154&cwnd=241&unsent_bytes=0&cid=f6b600c1f6c82da6&ts=4906&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 13 Jan 2025 19:28:52 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: toEtmktFFuVfOfqbPX3fow==$+r8MJp9PK65k7MWImO110A==Server: cloudflareCF-RAY: 9017caba9eff7c6a-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 13 Jan 2025 19:29:05 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: P9LgCsAMoykGBr2qJbhuzA==$HWJypF+H9zuhiaj5FZ9J0w==Server: cloudflareCF-RAY: 9017cb0ab81042fb-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 13 Jan 2025 19:30:01 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: JpUBhBTGe0q/jvXslJM6EQ==$ftOdlY+qpSlVB+DoxAK5dw==Server: cloudflareCF-RAY: 9017cc671a994385-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 13 Jan 2025 19:30:08 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: WSxFYJ+NtL2fjEQaOfGsew==$xuwY/JuEB/6h0Wu8bUUVKQ==Server: cloudflareCF-RAY: 9017cc9459f85e64-EWRalt-svc: h3=":443"; ma=86400

Source: chromecache_461.2.dr, chromecache_391.2.dr	String found in binary or memory: http://angularjs.org
Source: chromecache_461.2.dr, chromecache_391.2.dr	String found in binary or memory: http://errors.angularjs.org/1.8.2/
Source: chromecache_391.2.dr	String found in binary or memory: http://www.kekaosx.com/en/
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: chromecache_447.2.dr	String found in binary or memory: https://1005.filemail.com/api/thumbnail/get?fileid=MNVGE5LINBWG66DGONUXA2TUPR6HYSLOOYWTCMBTGE4S44DEM
Source: chromecache_431.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_447.2.dr	String found in binary or memory: https://analytics.filemail.com/js/container_UpE19V8Y.js
Source: chromecache_447.2.dr	String found in binary or memory: https://api.filemail.com
Source: chromecache_447.2.dr	String found in binary or memory: https://app.filemail.com
Source: chromecache_429.2.dr, chromecache_431.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_463.2.dr, chromecache_426.2.dr, chromecache_356.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_463.2.dr, chromecache_426.2.dr, chromecache_356.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_447.2.dr	String found in binary or memory: https://deeplink.filemail.com
Source: chromecache_443.2.dr, chromecache_382.2.dr	String found in binary or memory: https://developer.matomo.org/api-reference/tracking-javascript
Source: chromecache_443.2.dr, chromecache_382.2.dr	String found in binary or memory: https://developer.matomo.org/guides/tracking-javascript-guide#multiple-piwik-trackers
Source: chromecache_463.2.dr, chromecache_426.2.dr, chromecache_356.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_463.2.dr, chromecache_426.2.dr, chromecache_356.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_463.2.dr, chromecache_426.2.dr, chromecache_356.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/dotsfont.eot
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/dotsfont.eot?#iefix
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/dotsfont.svg#dotsfontregular
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/dotsfont.ttf
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/dotsfont.woff
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/fa-brands-400.eot
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/fa-brands-400.eot?#iefix
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/fa-brands-400.svg#fontawesome
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/fa-brands-400.ttf
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/fa-brands-400.woff
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/fa-brands-400.woff2
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/fa-light-300.eot
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/fa-light-300.eot?#iefix
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/fa-light-300.svg#fontawesome
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/fa-light-300.ttf
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/fa-light-300.woff
Source: chromecache_447.2.dr	String found in binary or memory: https://filemail.b-cdn.net/webapp/fonts/fa-light-300.woff2
Source: chromecache_406.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wXg.woff2)
Source: chromecache_406.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjxAwXjeu.woff2)
Source: chromecache_391.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_443.2.dr, chromecache_382.2.dr	String found in binary or memory: https://github.com/matomo-org/matomo/blob/master/js/piwik.js
Source: chromecache_443.2.dr, chromecache_382.2.dr	String found in binary or memory: https://github.com/matomo-org/tag-manager/blob/master/js/piwik.js
Source: chromecache_443.2.dr, chromecache_382.2.dr	String found in binary or memory: https://github.com/salesforce/secure-filters/blob/master/LICENSE.txt
Source: chromecache_443.2.dr, chromecache_382.2.dr	String found in binary or memory: https://github.com/salesforce/secure-filters/blob/master/lib/secure-filters.js
Source: chromecache_461.2.dr, chromecache_391.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_461.2.dr, chromecache_391.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_431.2.dr	String found in binary or memory: https://google.com
Source: chromecache_431.2.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_367.2.dr, chromecache_350.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_367.2.dr, chromecache_350.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_443.2.dr, chromecache_382.2.dr	String found in binary or memory: https://matomo.org
Source: chromecache_443.2.dr, chromecache_382.2.dr	String found in binary or memory: https://matomo.org/free-software/bsd/
Source: chromecache_431.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_429.2.dr, chromecache_431.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_461.2.dr, chromecache_391.2.dr	String found in binary or memory: https://passy.me/
Source: chromecache_443.2.dr, chromecache_382.2.dr	String found in binary or memory: https://piwik.org
Source: chromecache_443.2.dr, chromecache_382.2.dr	String found in binary or memory: https://piwik.org/free-software/bsd/
Source: chromecache_356.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_447.2.dr	String found in binary or memory: https://support.filemail.com
Source: chromecache_446.2.dr, chromecache_365.2.dr	String found in binary or memory: https://support.filemail.com/downloading-files/my-files-are-expired
Source: chromecache_356.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_463.2.dr, chromecache_426.2.dr, chromecache_356.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_463.2.dr, chromecache_426.2.dr, chromecache_356.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_463.2.dr, chromecache_426.2.dr, chromecache_356.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_429.2.dr, chromecache_431.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_447.2.dr	String found in binary or memory: https://widget.intercom.io/widget/p41r18ox
Source: chromecache_447.2.dr	String found in binary or memory: https://www.filemail.com
Source: chromecache_447.2.dr	String found in binary or memory: https://www.filemail.com/price-plans-comparison
Source: chromecache_447.2.dr	String found in binary or memory: https://www.filemail.com/t/XhcWEjoR
Source: chromecache_431.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_385.2.dr, chromecache_398.2.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/1039234079/?random
Source: chromecache_447.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?render=
Source: chromecache_393.2.dr, chromecache_463.2.dr, chromecache_436.2.dr, chromecache_426.2.dr, chromecache_356.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_431.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_431.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_429.2.dr, chromecache_431.2.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_429.2.dr, chromecache_431.2.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_463.2.dr, chromecache_426.2.dr, chromecache_356.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__.
Source: chromecache_393.2.dr, chromecache_357.2.dr, chromecache_436.2.dr, chromecache_390.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js
Source: chromecache_432.2.dr, Inv-10319.pdf.crdownload.0.dr, 20fc9f19-1335-42d3-8794-13a9079f62bd.tmp.0.dr	String found in binary or memory: https://www.pdfescape.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 50293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 50253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50293
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 50254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50249
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50246
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50250
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 50250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443

System Summary

Found potential malicious PDF (bad image similarity)

Source: Inv-10319.pdf.crdownload.0.dr	Static PDF information: Image stream: 29
Source: 20fc9f19-1335-42d3-8794-13a9079f62bd.tmp.0.dr	Static PDF information: Image stream: 29
Source: chromecache_432.2.dr	Static PDF information: Image stream: 29

Source: classification engine

Classification label: mal68.phis.win@75/244@109/34

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\2d6ab75e-79cd-4a6f-953e-845ce73d6e9f.tmp

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-13 14-29-32-253.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2128,i,6585608803107381090,107769894197230907,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://maya-lopez.filemail.com/t/XhcWEjoR"
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\Inv-10319.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1736,i,7133644685456521837,7590877476969925145,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://q6zm.omimpether.ru/KEX1OS/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2012,i,5037218291940872250,1452618677564776779,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2128,i,6585608803107381090,107769894197230907,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1736,i,7133644685456521837,7590877476969925145,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2012,i,5037218291940872250,1452618677564776779,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\crash_reporter.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 432
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 432			Jump to dropped file

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: https://app.filemail.com/t/XhcWEjoR	Joe Sandbox AI: Page contains button: 'Download file' Source: '1.2.pages.csv'
Source: https://app.filemail.com/t/XhcWEjoR	Joe Sandbox AI: Page contains button: 'Download file' Source: '1.4.pages.csv'
Source: file:///C:/Users/user/Downloads/Inv-10319.pdf	Joe Sandbox AI: Page contains button: 'Access Document' Source: '2.6.pages.csv'
Source: file:///C:/Users/user/Downloads/Inv-10319.pdf	Joe Sandbox AI: Page contains button: 'Access Document' Source: '2.7.pages.csv'

Source: 0.25.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://q6zm.omimpether.ru/KEX1OS/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script collects user data and sends it to an unknown domain, and it also redirects the user to a Microsoft login page, which could be part of a phishing attempt. Overall, the script demonstrates highly suspicious and potentially malicious behavior.
Source: 0.24.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://q6zm.omimpether.ru/KEX1OS/... This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common developer tools and keyboard shortcuts, and redirecting the user to a suspicious domain. The script also includes a self-executing function that triggers a debugger and then redirects the user, which is a common technique used in malicious scripts. Overall, this script demonstrates a high level of malicious intent and should be considered a significant security risk.
Source: 0.58.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://q6zm.omimpether.ru/KEX1OS/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script collects user data and sends it to an untrusted domain, and it also redirects the user to a Microsoft login page, which is likely a phishing attempt. Overall, this script demonstrates highly suspicious and malicious behavior, posing a significant security risk.
Source: 0.23.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://q6zm.omimpether.ru/KEX1OS/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and URLs further increases the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of malicious intent.
Source: 0.57.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://q6zm.omimpether.ru/KEX1OS/... This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to a suspicious domain. The script also uses obfuscated variable names and setInterval to repeatedly trigger a debugger statement, which could be an attempt to detect and evade analysis. Overall, this script demonstrates a high level of malicious intent and should be considered a significant security risk.
Source: 0.56.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://q6zm.omimpether.ru/KEX1OS/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the presence of anti-debugging techniques further increase the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of malicious intent.

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723933486059141.ZDA5MDY2M2EtNzI0Ni00MTNiLTg4YTgtNjg5NjVhZjUzYjlmNmMxMjczYWUtMTVmNi00MWE0LTlhOWEtNzFhNDRkYzc3N2Zm&ui_locales=en-US&mkt=en-US&client-request-id=f417508e-ab1e-4ca5-b503-bb40f5d756b0&state=ExjvZrCULSkZc_ikGpAmupbzo2Q5LOK4DFe0pVdylsB0eyj0JeHBfMTC4G0NMmf-oDMo0tJm0-KoBj3_wpT7XAV2deFw8IS7vYddX0iRO749u4XbD0y-D647SBaul8NKL8P0qI3-U0TpWcG0HXSaO3qylvbxW7g1M8P1f-TA_Jzs_tcjvp9ixOdXUf-gsvXQk1unXo9HtZM00Lj8xRyhFR2AOwNMJ1HzJWndbLzTcWaUWwJbW45nQYRjPxEY6oTIZtRcF7EIL_2XWaKCnL2w2g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723933486059141.ZDA5MDY2M2EtNzI0Ni00MTNiLTg4YTgtNjg5NjVhZjUzYjlmNmMxMjczYWUtMTVmNi00MWE0LTlhOWEtNzFhNDRkYzc3N2Zm&ui_locales=en-US&mkt=en-US&client-request-id=f417508e-ab1e-4ca5-b503-bb40f5d756b0&state=ExjvZrCULSkZc_ikGpAmupbzo2Q5LOK4DFe0pVdylsB0eyj0JeHBfMTC4G0NMmf-oDMo0tJm0-KoBj3_wpT7XAV2deFw8IS7vYddX0iRO749u4XbD0y-D647SBaul8NKL8P0qI3-U0TpWcG0HXSaO3qylvbxW7g1M8P1f-TA_Jzs_tcjvp9ixOdXUf-gsvXQk1unXo9HtZM00Lj8xRyhFR2AOwNMJ1HzJWndbLzTcWaUWwJbW45nQYRjPxEY6oTIZtRcF7EIL_2XWaKCnL2w2g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723934118729664.NzRkYWU3ZjgtM2I0Zi00ZGIwLWE4MTgtMGNjODNmNDJkZGM3ODI0ODZjZjYtOGVkYy00OWE0LWFhNzktNGZhYmYyZDcyM2Y5&ui_locales=en-US&mkt=en-US&client-request-id=18b88b00-5d2d-4051-ab7d-4a1eed192396&state=f-orUxBneI2GaDKM0ZFpDrQdwXeOHlmZj0gpRMBYprC0YCn4UIeT8B2H8GI9qR6r-Fwg99dfSaEuWFGYFD1P-K8P-O1ynDeYhrHk9j7468wgpD8jmTawEk0q3jrrKeoPowUix-fTVXBQYOIKv-e8l_aqJQtkTKXBbr2ENRucX7VPGOnc5e-EXV0bFQaoH29ItBOTcM4eij35d3ok28uLTGqEf8MzxfNrE6jDgvP2SL3vlWmxfnSumGUFsG9QN8uxQkP7yH42EJVJVtIg5KNB_g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723934118729664.NzRkYWU3ZjgtM2I0Zi00ZGIwLWE4MTgtMGNjODNmNDJkZGM3ODI0ODZjZjYtOGVkYy00OWE0LWFhNzktNGZhYmYyZDcyM2Y5&ui_locales=en-US&mkt=en-US&client-request-id=18b88b00-5d2d-4051-ab7d-4a1eed192396&state=f-orUxBneI2GaDKM0ZFpDrQdwXeOHlmZj0gpRMBYprC0YCn4UIeT8B2H8GI9qR6r-Fwg99dfSaEuWFGYFD1P-K8P-O1ynDeYhrHk9j7468wgpD8jmTawEk0q3jrrKeoPowUix-fTVXBQYOIKv-e8l_aqJQtkTKXBbr2ENRucX7VPGOnc5e-EXV0bFQaoH29ItBOTcM4eij35d3ok28uLTGqEf8MzxfNrE6jDgvP2SL3vlWmxfnSumGUFsG9QN8uxQkP7yH42EJVJVtIg5KNB_g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723933486059141.ZDA5MDY2M2EtNzI0Ni00MTNiLTg4YTgtNjg5NjVhZjUzYjlmNmMxMjczYWUtMTVmNi00MWE0LTlhOWEtNzFhNDRkYzc3N2Zm&ui_locales=en-US&mkt=en-US&client-request-id=f417508e-ab1e-4ca5-b503-bb40f5d756b0&state=ExjvZrCULSkZc_ikGpAmupbzo2Q5LOK4DFe0pVdylsB0eyj0JeHBfMTC4G0NMmf-oDMo0tJm0-KoBj3_wpT7XAV2deFw8IS7vYddX0iRO749u4XbD0y-D647SBaul8NKL8P0qI3-U0TpWcG0HXSaO3qylvbxW7g1M8P1f-TA_Jzs_tcjvp9ixOdXUf-gsvXQk1unXo9HtZM00Lj8xRyhFR2AOwNMJ1HzJWndbLzTcWaUWwJbW45nQYRjPxEY6oTIZtRcF7EIL_2XWaKCnL2w2g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723933486059141.ZDA5MDY2M2EtNzI0Ni00MTNiLTg4YTgtNjg5NjVhZjUzYjlmNmMxMjczYWUtMTVmNi00MWE0LTlhOWEtNzFhNDRkYzc3N2Zm&ui_locales=en-US&mkt=en-US&client-request-id=f417508e-ab1e-4ca5-b503-bb40f5d756b0&state=ExjvZrCULSkZc_ikGpAmupbzo2Q5LOK4DFe0pVdylsB0eyj0JeHBfMTC4G0NMmf-oDMo0tJm0-KoBj3_wpT7XAV2deFw8IS7vYddX0iRO749u4XbD0y-D647SBaul8NKL8P0qI3-U0TpWcG0HXSaO3qylvbxW7g1M8P1f-TA_Jzs_tcjvp9ixOdXUf-gsvXQk1unXo9HtZM00Lj8xRyhFR2AOwNMJ1HzJWndbLzTcWaUWwJbW45nQYRjPxEY6oTIZtRcF7EIL_2XWaKCnL2w2g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723934118729664.NzRkYWU3ZjgtM2I0Zi00ZGIwLWE4MTgtMGNjODNmNDJkZGM3ODI0ODZjZjYtOGVkYy00OWE0LWFhNzktNGZhYmYyZDcyM2Y5&ui_locales=en-US&mkt=en-US&client-request-id=18b88b00-5d2d-4051-ab7d-4a1eed192396&state=f-orUxBneI2GaDKM0ZFpDrQdwXeOHlmZj0gpRMBYprC0YCn4UIeT8B2H8GI9qR6r-Fwg99dfSaEuWFGYFD1P-K8P-O1ynDeYhrHk9j7468wgpD8jmTawEk0q3jrrKeoPowUix-fTVXBQYOIKv-e8l_aqJQtkTKXBbr2ENRucX7VPGOnc5e-EXV0bFQaoH29ItBOTcM4eij35d3ok28uLTGqEf8MzxfNrE6jDgvP2SL3vlWmxfnSumGUFsG9QN8uxQkP7yH42EJVJVtIg5KNB_g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723934118729664.NzRkYWU3ZjgtM2I0Zi00ZGIwLWE4MTgtMGNjODNmNDJkZGM3ODI0ODZjZjYtOGVkYy00OWE0LWFhNzktNGZhYmYyZDcyM2Y5&ui_locales=en-US&mkt=en-US&client-request-id=18b88b00-5d2d-4051-ab7d-4a1eed192396&state=f-orUxBneI2GaDKM0ZFpDrQdwXeOHlmZj0gpRMBYprC0YCn4UIeT8B2H8GI9qR6r-Fwg99dfSaEuWFGYFD1P-K8P-O1ynDeYhrHk9j7468wgpD8jmTawEk0q3jrrKeoPowUix-fTVXBQYOIKv-e8l_aqJQtkTKXBbr2ENRucX7VPGOnc5e-EXV0bFQaoH29ItBOTcM4eij35d3ok28uLTGqEf8MzxfNrE6jDgvP2SL3vlWmxfnSumGUFsG9QN8uxQkP7yH42EJVJVtIg5KNB_g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723933486059141.ZDA5MDY2M2EtNzI0Ni00MTNiLTg4YTgtNjg5NjVhZjUzYjlmNmMxMjczYWUtMTVmNi00MWE0LTlhOWEtNzFhNDRkYzc3N2Zm&ui_locales=en-US&mkt=en-US&client-request-id=f417508e-ab1e-4ca5-b503-bb40f5d756b0&state=ExjvZrCULSkZc_ikGpAmupbzo2Q5LOK4DFe0pVdylsB0eyj0JeHBfMTC4G0NMmf-oDMo0tJm0-KoBj3_wpT7XAV2deFw8IS7vYddX0iRO749u4XbD0y-D647SBaul8NKL8P0qI3-U0TpWcG0HXSaO3qylvbxW7g1M8P1f-TA_Jzs_tcjvp9ixOdXUf-gsvXQk1unXo9HtZM00Lj8xRyhFR2AOwNMJ1HzJWndbLzTcWaUWwJbW45nQYRjPxEY6oTIZtRcF7EIL_2XWaKCnL2w2g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723934118729664.NzRkYWU3ZjgtM2I0Zi00ZGIwLWE4MTgtMGNjODNmNDJkZGM3ODI0ODZjZjYtOGVkYy00OWE0LWFhNzktNGZhYmYyZDcyM2Y5&ui_locales=en-US&mkt=en-US&client-request-id=18b88b00-5d2d-4051-ab7d-4a1eed192396&state=f-orUxBneI2GaDKM0ZFpDrQdwXeOHlmZj0gpRMBYprC0YCn4UIeT8B2H8GI9qR6r-Fwg99dfSaEuWFGYFD1P-K8P-O1ynDeYhrHk9j7468wgpD8jmTawEk0q3jrrKeoPowUix-fTVXBQYOIKv-e8l_aqJQtkTKXBbr2ENRucX7VPGOnc5e-EXV0bFQaoH29ItBOTcM4eij35d3ok28uLTGqEf8MzxfNrE6jDgvP2SL3vlWmxfnSumGUFsG9QN8uxQkP7yH42EJVJVtIg5KNB_g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: <input type="password" .../> found

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
https://maya-lopez.filemail.com/t/XhcWEjoR

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Source: https://app.filemail.com/t/XhcWEjoR	HTTP Parser: No favicon
Source: https://app.filemail.com/t/XhcWEjoR	HTTP Parser: No favicon
Source: https://app.filemail.com/t/XhcWEjoR	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Inv-10319.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Inv-10319.pdf	HTTP Parser: No favicon
Source: https://q6zm.omimpether.ru/KEX1OS/	HTTP Parser: No favicon
Source: https://q6zm.omimpether.ru/KEX1OS/	HTTP Parser: No favicon
Source: https://q6zm.omimpether.ru/KEX1OS/	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723933486059141.ZDA5MDY2M2EtNzI0Ni00MTNiLTg4YTgtNjg5NjVhZjUzYjlmNmMxMjczYWUtMTVmNi00MWE0LTlhOWEtNzFhNDRkYzc3N2Zm&ui_locales=en-US&mkt=en-US&client-request-id=f417508e-ab1e-4ca5-b503-bb40f5d756b0&state=ExjvZrCULSkZc_ikGpAmupbzo2Q5LOK4DFe0pVdylsB0eyj0JeHBfMTC4G0NMmf-oDMo0tJm0-KoBj3_wpT7XAV2deFw8IS7vYddX0iRO749u4XbD0y-D647SBaul8NKL8P0qI3-U0TpWcG0HXSaO3qylvbxW7g1M8P1f-TA_Jzs_tcjvp9ixOdXUf-gsvXQk1unXo9HtZM00Lj8xRyhFR2AOwNMJ1HzJWndbLzTcWaUWwJbW45nQYRjPxEY6oTIZtRcF7EIL_2XWaKCnL2w2g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723934118729664.NzRkYWU3ZjgtM2I0Zi00ZGIwLWE4MTgtMGNjODNmNDJkZGM3ODI0ODZjZjYtOGVkYy00OWE0LWFhNzktNGZhYmYyZDcyM2Y5&ui_locales=en-US&mkt=en-US&client-request-id=18b88b00-5d2d-4051-ab7d-4a1eed192396&state=f-orUxBneI2GaDKM0ZFpDrQdwXeOHlmZj0gpRMBYprC0YCn4UIeT8B2H8GI9qR6r-Fwg99dfSaEuWFGYFD1P-K8P-O1ynDeYhrHk9j7468wgpD8jmTawEk0q3jrrKeoPowUix-fTVXBQYOIKv-e8l_aqJQtkTKXBbr2ENRucX7VPGOnc5e-EXV0bFQaoH29ItBOTcM4eij35d3ok28uLTGqEf8MzxfNrE6jDgvP2SL3vlWmxfnSumGUFsG9QN8uxQkP7yH42EJVJVtIg5KNB_g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723933486059141.ZDA5MDY2M2EtNzI0Ni00MTNiLTg4YTgtNjg5NjVhZjUzYjlmNmMxMjczYWUtMTVmNi00MWE0LTlhOWEtNzFhNDRkYzc3N2Zm&ui_locales=en-US&mkt=en-US&client-request-id=f417508e-ab1e-4ca5-b503-bb40f5d756b0&state=ExjvZrCULSkZc_ikGpAmupbzo2Q5LOK4DFe0pVdylsB0eyj0JeHBfMTC4G0NMmf-oDMo0tJm0-KoBj3_wpT7XAV2deFw8IS7vYddX0iRO749u4XbD0y-D647SBaul8NKL8P0qI3-U0TpWcG0HXSaO3qylvbxW7g1M8P1f-TA_Jzs_tcjvp9ixOdXUf-gsvXQk1unXo9HtZM00Lj8xRyhFR2AOwNMJ1HzJWndbLzTcWaUWwJbW45nQYRjPxEY6oTIZtRcF7EIL_2XWaKCnL2w2g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723933486059141.ZDA5MDY2M2EtNzI0Ni00MTNiLTg4YTgtNjg5NjVhZjUzYjlmNmMxMjczYWUtMTVmNi00MWE0LTlhOWEtNzFhNDRkYzc3N2Zm&ui_locales=en-US&mkt=en-US&client-request-id=f417508e-ab1e-4ca5-b503-bb40f5d756b0&state=ExjvZrCULSkZc_ikGpAmupbzo2Q5LOK4DFe0pVdylsB0eyj0JeHBfMTC4G0NMmf-oDMo0tJm0-KoBj3_wpT7XAV2deFw8IS7vYddX0iRO749u4XbD0y-D647SBaul8NKL8P0qI3-U0TpWcG0HXSaO3qylvbxW7g1M8P1f-TA_Jzs_tcjvp9ixOdXUf-gsvXQk1unXo9HtZM00Lj8xRyhFR2AOwNMJ1HzJWndbLzTcWaUWwJbW45nQYRjPxEY6oTIZtRcF7EIL_2XWaKCnL2w2g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723933486059141.ZDA5MDY2M2EtNzI0Ni00MTNiLTg4YTgtNjg5NjVhZjUzYjlmNmMxMjczYWUtMTVmNi00MWE0LTlhOWEtNzFhNDRkYzc3N2Zm&ui_locales=en-US&mkt=en-US&client-request-id=f417508e-ab1e-4ca5-b503-bb40f5d756b0&state=ExjvZrCULSkZc_ikGpAmupbzo2Q5LOK4DFe0pVdylsB0eyj0JeHBfMTC4G0NMmf-oDMo0tJm0-KoBj3_wpT7XAV2deFw8IS7vYddX0iRO749u4XbD0y-D647SBaul8NKL8P0qI3-U0TpWcG0HXSaO3qylvbxW7g1M8P1f-TA_Jzs_tcjvp9ixOdXUf-gsvXQk1unXo9HtZM00Lj8xRyhFR2AOwNMJ1HzJWndbLzTcWaUWwJbW45nQYRjPxEY6oTIZtRcF7EIL_2XWaKCnL2w2g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723934118729664.NzRkYWU3ZjgtM2I0Zi00ZGIwLWE4MTgtMGNjODNmNDJkZGM3ODI0ODZjZjYtOGVkYy00OWE0LWFhNzktNGZhYmYyZDcyM2Y5&ui_locales=en-US&mkt=en-US&client-request-id=18b88b00-5d2d-4051-ab7d-4a1eed192396&state=f-orUxBneI2GaDKM0ZFpDrQdwXeOHlmZj0gpRMBYprC0YCn4UIeT8B2H8GI9qR6r-Fwg99dfSaEuWFGYFD1P-K8P-O1ynDeYhrHk9j7468wgpD8jmTawEk0q3jrrKeoPowUix-fTVXBQYOIKv-e8l_aqJQtkTKXBbr2ENRucX7VPGOnc5e-EXV0bFQaoH29ItBOTcM4eij35d3ok28uLTGqEf8MzxfNrE6jDgvP2SL3vlWmxfnSumGUFsG9QN8uxQkP7yH42EJVJVtIg5KNB_g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723934118729664.NzRkYWU3ZjgtM2I0Zi00ZGIwLWE4MTgtMGNjODNmNDJkZGM3ODI0ODZjZjYtOGVkYy00OWE0LWFhNzktNGZhYmYyZDcyM2Y5&ui_locales=en-US&mkt=en-US&client-request-id=18b88b00-5d2d-4051-ab7d-4a1eed192396&state=f-orUxBneI2GaDKM0ZFpDrQdwXeOHlmZj0gpRMBYprC0YCn4UIeT8B2H8GI9qR6r-Fwg99dfSaEuWFGYFD1P-K8P-O1ynDeYhrHk9j7468wgpD8jmTawEk0q3jrrKeoPowUix-fTVXBQYOIKv-e8l_aqJQtkTKXBbr2ENRucX7VPGOnc5e-EXV0bFQaoH29ItBOTcM4eij35d3ok28uLTGqEf8MzxfNrE6jDgvP2SL3vlWmxfnSumGUFsG9QN8uxQkP7yH42EJVJVtIg5KNB_g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723934118729664.NzRkYWU3ZjgtM2I0Zi00ZGIwLWE4MTgtMGNjODNmNDJkZGM3ODI0ODZjZjYtOGVkYy00OWE0LWFhNzktNGZhYmYyZDcyM2Y5&ui_locales=en-US&mkt=en-US&client-request-id=18b88b00-5d2d-4051-ab7d-4a1eed192396&state=f-orUxBneI2GaDKM0ZFpDrQdwXeOHlmZj0gpRMBYprC0YCn4UIeT8B2H8GI9qR6r-Fwg99dfSaEuWFGYFD1P-K8P-O1ynDeYhrHk9j7468wgpD8jmTawEk0q3jrrKeoPowUix-fTVXBQYOIKv-e8l_aqJQtkTKXBbr2ENRucX7VPGOnc5e-EXV0bFQaoH29ItBOTcM4eij35d3ok28uLTGqEf8MzxfNrE6jDgvP2SL3vlWmxfnSumGUFsG9QN8uxQkP7yH42EJVJVtIg5KNB_g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723933486059141.ZDA5MDY2M2EtNzI0Ni00MTNiLTg4YTgtNjg5NjVhZjUzYjlmNmMxMjczYWUtMTVmNi00MWE0LTlhOWEtNzFhNDRkYzc3N2Zm&ui_locales=en-US&mkt=en-US&client-request-id=f417508e-ab1e-4ca5-b503-bb40f5d756b0&state=ExjvZrCULSkZc_ikGpAmupbzo2Q5LOK4DFe0pVdylsB0eyj0JeHBfMTC4G0NMmf-oDMo0tJm0-KoBj3_wpT7XAV2deFw8IS7vYddX0iRO749u4XbD0y-D647SBaul8NKL8P0qI3-U0TpWcG0HXSaO3qylvbxW7g1M8P1f-TA_Jzs_tcjvp9ixOdXUf-gsvXQk1unXo9HtZM00Lj8xRyhFR2AOwNMJ1HzJWndbLzTcWaUWwJbW45nQYRjPxEY6oTIZtRcF7EIL_2XWaKCnL2w2g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723933486059141.ZDA5MDY2M2EtNzI0Ni00MTNiLTg4YTgtNjg5NjVhZjUzYjlmNmMxMjczYWUtMTVmNi00MWE0LTlhOWEtNzFhNDRkYzc3N2Zm&ui_locales=en-US&mkt=en-US&client-request-id=f417508e-ab1e-4ca5-b503-bb40f5d756b0&state=ExjvZrCULSkZc_ikGpAmupbzo2Q5LOK4DFe0pVdylsB0eyj0JeHBfMTC4G0NMmf-oDMo0tJm0-KoBj3_wpT7XAV2deFw8IS7vYddX0iRO749u4XbD0y-D647SBaul8NKL8P0qI3-U0TpWcG0HXSaO3qylvbxW7g1M8P1f-TA_Jzs_tcjvp9ixOdXUf-gsvXQk1unXo9HtZM00Lj8xRyhFR2AOwNMJ1HzJWndbLzTcWaUWwJbW45nQYRjPxEY6oTIZtRcF7EIL_2XWaKCnL2w2g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723933486059141.ZDA5MDY2M2EtNzI0Ni00MTNiLTg4YTgtNjg5NjVhZjUzYjlmNmMxMjczYWUtMTVmNi00MWE0LTlhOWEtNzFhNDRkYzc3N2Zm&ui_locales=en-US&mkt=en-US&client-request-id=f417508e-ab1e-4ca5-b503-bb40f5d756b0&state=ExjvZrCULSkZc_ikGpAmupbzo2Q5LOK4DFe0pVdylsB0eyj0JeHBfMTC4G0NMmf-oDMo0tJm0-KoBj3_wpT7XAV2deFw8IS7vYddX0iRO749u4XbD0y-D647SBaul8NKL8P0qI3-U0TpWcG0HXSaO3qylvbxW7g1M8P1f-TA_Jzs_tcjvp9ixOdXUf-gsvXQk1unXo9HtZM00Lj8xRyhFR2AOwNMJ1HzJWndbLzTcWaUWwJbW45nQYRjPxEY6oTIZtRcF7EIL_2XWaKCnL2w2g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723934118729664.NzRkYWU3ZjgtM2I0Zi00ZGIwLWE4MTgtMGNjODNmNDJkZGM3ODI0ODZjZjYtOGVkYy00OWE0LWFhNzktNGZhYmYyZDcyM2Y5&ui_locales=en-US&mkt=en-US&client-request-id=18b88b00-5d2d-4051-ab7d-4a1eed192396&state=f-orUxBneI2GaDKM0ZFpDrQdwXeOHlmZj0gpRMBYprC0YCn4UIeT8B2H8GI9qR6r-Fwg99dfSaEuWFGYFD1P-K8P-O1ynDeYhrHk9j7468wgpD8jmTawEk0q3jrrKeoPowUix-fTVXBQYOIKv-e8l_aqJQtkTKXBbr2ENRucX7VPGOnc5e-EXV0bFQaoH29ItBOTcM4eij35d3ok28uLTGqEf8MzxfNrE6jDgvP2SL3vlWmxfnSumGUFsG9QN8uxQkP7yH42EJVJVtIg5KNB_g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723934118729664.NzRkYWU3ZjgtM2I0Zi00ZGIwLWE4MTgtMGNjODNmNDJkZGM3ODI0ODZjZjYtOGVkYy00OWE0LWFhNzktNGZhYmYyZDcyM2Y5&ui_locales=en-US&mkt=en-US&client-request-id=18b88b00-5d2d-4051-ab7d-4a1eed192396&state=f-orUxBneI2GaDKM0ZFpDrQdwXeOHlmZj0gpRMBYprC0YCn4UIeT8B2H8GI9qR6r-Fwg99dfSaEuWFGYFD1P-K8P-O1ynDeYhrHk9j7468wgpD8jmTawEk0q3jrrKeoPowUix-fTVXBQYOIKv-e8l_aqJQtkTKXBbr2ENRucX7VPGOnc5e-EXV0bFQaoH29ItBOTcM4eij35d3ok28uLTGqEf8MzxfNrE6jDgvP2SL3vlWmxfnSumGUFsG9QN8uxQkP7yH42EJVJVtIg5KNB_g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723934118729664.NzRkYWU3ZjgtM2I0Zi00ZGIwLWE4MTgtMGNjODNmNDJkZGM3ODI0ODZjZjYtOGVkYy00OWE0LWFhNzktNGZhYmYyZDcyM2Y5&ui_locales=en-US&mkt=en-US&client-request-id=18b88b00-5d2d-4051-ab7d-4a1eed192396&state=f-orUxBneI2GaDKM0ZFpDrQdwXeOHlmZj0gpRMBYprC0YCn4UIeT8B2H8GI9qR6r-Fwg99dfSaEuWFGYFD1P-K8P-O1ynDeYhrHk9j7468wgpD8jmTawEk0q3jrrKeoPowUix-fTVXBQYOIKv-e8l_aqJQtkTKXBbr2ENRucX7VPGOnc5e-EXV0bFQaoH29ItBOTcM4eij35d3ok28uLTGqEf8MzxfNrE6jDgvP2SL3vlWmxfnSumGUFsG9QN8uxQkP7yH42EJVJVtIg5KNB_g&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_429.2.dr, chromecache_431.2.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=vC(a,c,e);U(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return U(122),!0;if(d&&f){for(var m=yb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},yC=function(){var a=[],b=function(c){return bb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_429.2.dr, chromecache_431.2.dr	String found in binary or memory: return b}OE.F="internal.enableAutoEventOnTimer";var Vb=wa(["data-gtm-yt-inspected-"]),QE=["www.youtube.com","www.youtube-nocookie.com"],RE,SE=!1; equals www.youtube.com (Youtube)
Source: chromecache_429.2.dr, chromecache_431.2.dr	String found in binary or memory: var cE=function(a,b,c,d,e){var f=TB("fsl",c?"nv.mwt":"mwt",0),g;g=c?TB("fsl","nv.ids",[]):TB("fsl","ids",[]);if(!g.length)return!0;var k=YB(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);U(121);if(m==="https://www.facebook.com/tr/")return U(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!DA(k,FA(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: maya-lopez.filemail.com
Source: global traffic	DNS traffic detected: DNS query: app.filemail.com
Source: global traffic	DNS traffic detected: DNS query: analytics.filemail.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: filemail.b-cdn.net
Source: global traffic	DNS traffic detected: DNS query: 1005.filemail.com
Source: global traffic	DNS traffic detected: DNS query: widget.intercom.io
Source: global traffic	DNS traffic detected: DNS query: js.intercomcdn.com
Source: global traffic	DNS traffic detected: DNS query: api-iam.intercom.io
Source: global traffic	DNS traffic detected: DNS query: nexus-websocket-a.intercom.io
Source: global traffic	DNS traffic detected: DNS query: q6zm.omimpether.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: s9geii23aoxz7d1brtyiuk9zgvgpk4q1vdmenfwu31mho9jz6a1.sprocubseq.ru
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: www.office.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: qhittsjhub8zbo4zfthe5o8uixnfmafqowy6hro2brdzfqwsjz.deryposi.ru
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://maya-lopez.filemail.com/t/XhcWEjoR

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
https://maya-lopez.filemail.com/t/XhcWEjoR