Edit tour

Windows Analysis Report
Universal Radio Programmer.pdf

Overview

General Information

Sample name:	Universal Radio Programmer.pdf
Analysis ID:	1483943
MD5:	d1b2cbd6f3bff6e8f4b269e0b23a38b4
SHA1:	600c0b25196c9491b9a6f6bf4ec6da968f73cdfd
SHA256:	55aaaf427722b9e94ad226ecf4079f0c1b36a13409c1a856765c52686cf8dd39
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Connects to many different domains

Connects to several IPs in different countries

Detected non-DNS traffic on DNS port

Executes massive DNS lookups (> 100)

HTML page contains hidden javascript code

HTML page contains string obfuscation

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

Stores files to the Windows start menu directory

Suspicious form URL found

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 1732 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Universal Radio Programmer.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5660 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6696 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1568,i,11455965130725462407,9431319710212433800,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "http://www.cqham.ru/uniprog2_eng.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1896,i,11439083397119314046,16504384329666213646,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Suricata Signatures

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 142.250.186.66 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:30.006259+0200
SID:	2012510
Source Port:	443
Destination Port:	49756
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 87.250.251.119 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:47.562026+0200
SID:	2012510
Source Port:	443
Destination Port:	49845
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 87.250.250.119 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:13:48.862459+0200
SID:	2012510
Source Port:	443
Destination Port:	61502
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 87.250.251.119 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:47.565543+0200
SID:	2012510
Source Port:	443
Destination Port:	49845
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 193.3.184.16 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:13:19.459084+0200
SID:	2012510
Source Port:	443
Destination Port:	61322
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 178.154.131.215 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:42.741060+0200
SID:	2012510
Source Port:	443
Destination Port:	49803
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 87.250.250.119 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:13:48.911812+0200
SID:	2012510
Source Port:	443
Destination Port:	61502
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 178.154.131.215 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:42.737809+0200
SID:	2012510
Source Port:	443
Destination Port:	49810
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 178.154.131.215 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:45.520389+0200
SID:	2012510
Source Port:	443
Destination Port:	49815
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 178.154.131.215 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:42.640942+0200
SID:	2012510
Source Port:	443
Destination Port:	49810
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 178.154.131.215 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:45.297160+0200
SID:	2012510
Source Port:	443
Destination Port:	49815
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 87.250.251.119 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:47.560291+0200
SID:	2012510
Source Port:	443
Destination Port:	49845
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 77.88.44.55 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:13:17.431490+0200
SID:	2012510
Source Port:	443
Destination Port:	61312
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 77.88.44.55 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:13:19.209911+0200
SID:	2012510
Source Port:	443
Destination Port:	61323
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:09.581534+0200
SID:	2022930
Source Port:	443
Destination Port:	49714
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 178.154.131.215 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:45.159481+0200
SID:	2012510
Source Port:	443
Destination Port:	49814
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 87.250.251.119 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:13:50.533707+0200
SID:	2012510
Source Port:	443
Destination Port:	61505
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 178.154.131.215 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:45.536721+0200
SID:	2012510
Source Port:	443
Destination Port:	49815
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 87.250.251.119 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:45.510016+0200
SID:	2012510
Source Port:	443
Destination Port:	49824
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 142.250.186.66 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:29.835360+0200
SID:	2012510
Source Port:	443
Destination Port:	49756
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 142.132.138.212 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:13:17.172259+0200
SID:	2012510
Source Port:	443
Destination Port:	61314
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 142.250.185.194 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:28.124320+0200
SID:	2012510
Source Port:	443
Destination Port:	49744
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:47.900757+0200
SID:	2022930
Source Port:	443
Destination Port:	49861
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 178.154.131.215 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:45.376561+0200
SID:	2012510
Source Port:	443
Destination Port:	49815
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 87.250.250.119 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:13:48.872166+0200
SID:	2012510
Source Port:	443
Destination Port:	61502
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 87.250.251.119 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:13:50.502157+0200
SID:	2012510
Source Port:	443
Destination Port:	61505
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 142.250.185.194 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:28.098208+0200
SID:	2012510
Source Port:	443
Destination Port:	49744
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 178.154.131.215 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:43.842878+0200
SID:	2012510
Source Port:	443
Destination Port:	49803
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 178.154.131.215 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:42.657802+0200
SID:	2012510
Source Port:	443
Destination Port:	49803
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 178.154.131.215 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:43.838478+0200
SID:	2012510
Source Port:	443
Destination Port:	49803
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 87.250.251.119 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:13:50.501098+0200
SID:	2012510
Source Port:	443
Destination Port:	61505
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 87.250.251.119 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:45.501727+0200
SID:	2012510
Source Port:	443
Destination Port:	49824
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 178.154.131.215 - Destination IP: 192.168.2.5

Timestamp:	2024-07-29T12:12:45.064293+0200
SID:	2012510
Source Port:	443
Destination Port:	49814
Protocol:	TCP
Classtype:	Potentially Bad Traffic

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1722247898083&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: https://ha7jca.tripod.com/rajzok/prog/prog.htm	LLM: Score: 8 brands: Reasons: The URL 'https://ha7jca.tripod.com/rajzok/prog/prog.htm' is hosted on 'tripod.com', which is a legitimate domain. However, the URL structure and the presence of an external link to 'http://kom-inform.euro.ru/programm.html' are suspicious. The external link uses a .ru domain, which is often associated with phishing and malicious activities. The page does not have a prominent login form or captcha, but it does use social engineering techniques by displaying misleading ads. The combination of these factors, especially the suspicious external link and the use of social engineering techniques, strongly suggests that this site is a phishing site. DOM: 40.36.pages.csv
Source: https://ha7jca.tripod.com/rajzok/prog/prog.htm	LLM: Score: 8 brands: Reasons: The URL 'https://ha7jca.tripod.com/rajzok/prog/prog.htm' is hosted on 'tripod.com', a free web hosting service often used for personal pages and not typically associated with professional or legitimate business sites. The page contains a link to 'http://kom-inform.euro.ru/programm.html', which is a suspicious domain as it uses multiple subdomains and a .ru TLD, often associated with phishing and malicious activities. The page also contains misleading ads, which is a common social engineering technique to lure users into clicking on potentially harmful links. There is no prominent login form or captcha, but the presence of suspicious links and the use of social engineering techniques strongly indicate that this is a phishing site. DOM: 40.37.pages.csv
Source: https://citater.ru/data/siemens_c25_s25_pinout.shtml	LLM: Score: 8 Reasons: The URL citater.ru does not match the legitimate domain associated with the brand Citater. The URL has an unusual domain extension (.ru) and the brand name is not commonly associated with this domain. The webpage contains a lot of text in Russian, which may be a red flag. The repeated phrases ' ' (All courses) suggest that the webpage may be a phishing attempt to lure users into taking online courses or providing personal information. DOM: 32.20.pages.csv

Source: http://www.cqham.ru/sch.htm	HTTP Parser: Found new string: script <!--.yandex_partner_id = 45493;.yandex_site_charset = 'windows-1251';.yandex_ad_format = 'direct';.yandex_font_size = 0.6;.yandex_font_family = 'verdana';.yandex_direct_type = 'horizontal';.yandex_direct_limit = 3;.yandex_direct_header_bg_color = 'FEEAC7';.yandex_direct_title_color = '0066FF';.yandex_direct_url_color = '006600';.yandex_direct_text_color = '000000';.yandex_direct_hover_color = '0066FF';.document.write('<sc'+'ript type="text/javascript" src="http://an.yandex.ru/resource/context.js?rnd=' + Math.round(Math.random() * 100000) + '"></sc'+'ript>');.//-->..
Source: https://scripts.lycos.com/catman/init.js	HTTP Parser: Found new string: script function AdManager(){function loadScript(_1){document.write("<scr" + "ipt type=\"text/javascript\" src=\""+_1+"\"></scr" + "ipt>");}.function getCookie(_2){var dc=document.cookie;var _4=_2+"=";var _5=dc.indexOf("; "+_4);if(_5==-1){_5=dc.indexOf(_4);if(_5!=0){return null;}}else{_5+=2;}.var _6=document.cookie.indexOf(";",_5);if(_6==-1){_6=dc.length;}.return unescape(dc.substring(_5+_4.length,_6));}.function getQueryVariable(_7){var qs=window.location.search.substring(1);var _9=qs.split("&");for(var i=0;i<_9.length;i++){var _b=_9[i].indexOf("=");if(_b==-1){continue;}.var _c=_9[i].substring(0,_b);var _d=_9[i].substring(_b+1);if(_c==_7){return decodeURIComponent(_d.replace("+"," "));}}.return null;}.this.chooseProductSet=function(){};this.getSlot=function(_e){if(this.slots&&this.slots[_e]){return this.slots[_e];}else{return null;}};this.isSlotAvailable=function(_f){return Boolean(this.getSlot(_f));};this.renderSlot=function(_10){var str=this.getSlot(_10);if(str){document.write(str);}};this.renderHeader=function(){...
Source: https://ams3-ib.adnxs.com/ab?an_audit=0&referrer=https%3A%2F%2Fha7jca.tripod.com%2Frajzok%2Fprog%2Fprog.htm&e=wqT_3QKZD_BMmQcAAAMA1gAFAQiW1521BhDqr5-q2aDxuTMYsaatrfO_kKY3KjYJgsXhzK_msD8Rg_5bLLlIqT8ZAAAAYGZmBkAhg_5bLLlIqT8pgsUJJNgxAAAAIFyP0j8w9aTXDDiCYEDzU0gCUNqH4_0BWLGTkAFgAGj91sMBePXyBYABAYoBA1VTRJIBAQbgmAHAAqABMqgBAbABALgBAsABBcgBAtABCdgBAOABAPABAIoCaXVmKCdhJywgMzY3Nzk4MiwgMCk7ARQsaScsIDc0MTc4ODAsERQsZycsIDI0ODAzNzE4FRUAcwEVHDk1OTYxNjg2FRYscicsIDUzMjIwMjQ1CSzwi5ICxQUhdXBJOGZRaUdtY2NjRU5xSDRfMEJHQUFnc1pPUUFUQUJPQUJBQUVqelUxRDFwTmNNV0FCZ2tRVm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUtvQVFLd0FRQzVBZkhyV002UDVyQV93UUh4NjFqT2otYXdQOGtCQUFBQUFBQUE4RF9aQVFBCQ50UEFfNEFHWTRNUUQ5UUVBQUNCQW1BSUFvQUlBdFFJBSQAdg0I8NB3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01PQ0t6eDlUd1FCQmdCTFZNYkZUcWlBdzRJX08yWU5oQUtHQUV0QUFDQVA2SUREZ2kzNjVnMkVBc1lBaTBBQUFBQXVnTUpRVTFUTXpvMk1EUXk0QVAtUm9BRTNNX25DSWdFMWJfUkRaQUVBWmdFQkxJRUNnaTdqYklGRUliNzF3MnlCQW9JaGRqa0RSQ0ctOWNOdWdRZkNKNEpFY0wxS0Z5UHdzVV9HUUFBQQXeeEFBSUx1TnNnVWdoZGprRGNFRXd2VW9YSV...	HTTP Parser: Found new string: script document.write("<!-- Creative 532202458 served by Member 10739 via AppNexus. -->");try{document.write('<a href="https://ams3-ib.adnxs.com/click2?e=wqT_3QKbAfBDmwAAAAMAxBkFAQiW1521BhDqr5-q2aDxuTMYsaatrfO_kKY3IPWk1wwogmAw81M4AkDah-P9AUixk5ABUABaA1VTRGIBBehowAJwMnj91sMBgAH18gWIAQGQAQKYAQWgAQKpAYLF4cyv5rA_sQGD_lssuUipP7kBAAAAYGZmBkDBAREUPMkBgsXhzK_msD_YAQDgAQA./s=ec718ac605ce454d1df9e976b76316efc7221814/bcr=AAAAAAAA8D8=/cnd=%21BhZhiAiGmcccENqH4_0BGLGTkAEgACgAMQAAAAAAAARAOglBTVMzOjYwNDJA_kZJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhwvUoXI_CxT9pAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8./cca=MTA3MzkjQU1TMzo2MDQy/bn=96629/clickenc=https%3A%2F%2Fwww.quaillodge.com%2Fgolf-club%2Fclub-membership" target="_blank"><img width="320" height="50" style="border-style: none" src="https://crcdn01.adnxs-simple.com/creative20/p/10739/2024/6/24/58647964/82cf7893-95f6-4a2e-8940-6fa5d7912a0e.jpg" /></a>');document.write('<iframe src="https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=12290&pub_id=1886142" width="1" height="1" fr...
Source: https://citater.ru/rate/voting.js?18	HTTP Parser: Found new string: script // Ajax Voting Script - http://coursesweb.net..var ivotings = []; // store the items with voting..var ar_elm = []; // store the items that will be send to votAjax()..var i_elm = 0; // Index for elements aded in ar_elm..var itemvotin =''; // store the voting of voted item..var voting_mp ='/rate/'; // directory with files for script..var advote = 0; // variable checked in addVote(), if is 0 cann vote, else, not....// gets all DIVs, store in $ivotings, and in $ar_elm DIVs with class: "vot_plus", "vot_mp", and data-vote_id="..", sends to votAjax()..var getVotsElm = function () {.. var obj_div = document.querySelectorAll('.vot_mp1, .vot_mp2, .vot_plus');.. for(var i=0; i<obj_div.length; i++) {.. var elm_id = obj_div[i].getAttribute('data-vote_id');.. if(elm_id) {.. ivotings[elm_id] = obj_div[i]; // store object item in $ivotings.. ar_elm[i_elm] = elm_id; // add item_ID in $ar_elm array, to be send in json string tp php.. i_elm++; // index order in...

Source: http://www.cqham.ru/uniprog2_eng.html	HTTP Parser: No favicon
Source: http://www.cqham.ru/uniprog2_eng.html	HTTP Parser: No favicon
Source: http://www.cqham.ru/uniprog2_eng.html	HTTP Parser: No favicon
Source: http://www.cqham.ru/uniprog2_eng.html	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/aframe	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/aframe	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/aframe	HTTP Parser: No favicon
Source: http://www.ultra.renet.ru/	HTTP Parser: No favicon
Source: https://yastatic.net/safeframe-bundles/0.83/1-1-0/render.html	HTTP Parser: No favicon
Source: http://www.cqham.ru/cons.htm	HTTP Parser: No favicon
Source: http://www.cqham.ru/cons.htm	HTTP Parser: No favicon
Source: http://www.cqham.ru/sch.htm	HTTP Parser: No favicon
Source: https://www.acint.net/mc/?dp=10	HTTP Parser: No favicon
Source: http://www.cqham.ru/IN/uniprog2/image3/uniprog600.gif	HTTP Parser: No favicon
Source: https://ha7jca.tripod.com/rajzok/prog/prog.htm	HTTP Parser: No favicon
Source: https://ha7jca.tripod.com/rajzok/prog/prog.htm	HTTP Parser: No favicon
Source: https://ha7jca.tripod.com/rajzok/prog/prog.htm	HTTP Parser: No favicon
Source: https://ha7jca.tripod.com/rajzok/prog/prog.htm	HTTP Parser: No favicon
Source: https://ha7jca.tripod.com/rajzok/prog/prog.htm	HTTP Parser: No favicon
Source: https://ha7jca.tripod.com/rajzok/prog/prog.htm	HTTP Parser: No favicon
Source: https://ha7jca.tripod.com/rajzok/prog/prog.htm	HTTP Parser: No favicon
Source: https://ha7jca.tripod.com/rajzok/prog/prog.htm	HTTP Parser: No favicon
Source: https://ha7jca.tripod.com/rajzok/prog/prog.htm	HTTP Parser: No favicon
Source: https://ha7jca.tripod.com/rajzok/prog/prog.htm	HTTP Parser: No favicon
Source: https://ha7jca.tripod.com/rajzok/prog/prog.htm	HTTP Parser: No favicon
Source: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html	HTTP Parser: No favicon
Source: https://topics.authorizedvault.com/topicsapi.html?bidder=rtbhouse	HTTP Parser: No favicon
Source: https://ha7jca.tripod.com/adm/ad/footerAd.iframe.html	HTTP Parser: No favicon
Source: https://ha7jca.tripod.com/adm/ad/injectAd.iframe.html	HTTP Parser: No favicon
Source: https://onetag-sys.com/usync/?cb=1722248048249	HTTP Parser: No favicon
Source: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156631&s=1180592&predirect=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3Da208d9366469aa64%26fi%3De19a4d4f1a5bfe2e%26uid%3D	HTTP Parser: No favicon
Source: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156631&s=1180592&predirect=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3Da208d9366469aa64%26fi%3De19a4d4f1a5bfe2e%26uid%3D	HTTP Parser: No favicon
Source: https://sync.adkernel.com/user-sync?zone=205227&r=https%3A%2F%2Fcs.admanmedia.com%2Fe28c2f69c6fdb454a8460bf902940220.gif%3Fpuid%3D%7BUID%7D%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BGDPR_CONSENT%5D%26ccpa%3D%5BCCPA%5D%26coppa%3D%5BCOPPA%5D	HTTP Parser: No favicon
Source: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D	HTTP Parser: No favicon
Source: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID	HTTP Parser: No favicon
Source: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID	HTTP Parser: No favicon
Source: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID	HTTP Parser: No favicon
Source: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID	HTTP Parser: No favicon
Source: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID	HTTP Parser: No favicon
Source: https://cdn.dxkulture.com/x/sync.html	HTTP Parser: No favicon
Source: https://cdn.dxkulture.com/x/sync.html	HTTP Parser: No favicon
Source: https://cdn.dxkulture.com/x/sync.html	HTTP Parser: No favicon
Source: https://hde.tynt.com/deb/?m=xch&rt=html&id=0015a00002egvRSAAY&ru=https%3A%2F%2Fcs.admanmedia.com%2Fc0fe8ff240c531de0a2b8e0217a562d9.gif%3Fpuid%3D33XUSERID33X&b=1	HTTP Parser: No favicon
Source: https://player.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html?pid=62f53b2c7850d0786f227f64&r=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DANIVIEW%26ttl%3D720%26uid%3De8ecb87ff2ef3a3b16ba16c51e7986ac%26visitor%3D%5BAV_UID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://player.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html?pid=62f53b2c7850d0786f227f64&r=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DANIVIEW%26ttl%3D720%26uid%3De8ecb87ff2ef3a3b16ba16c51e7986ac%26visitor%3D%5BAV_UID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=	HTTP Parser: No favicon
Source: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=	HTTP Parser: No favicon
Source: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=	HTTP Parser: No favicon
Source: https://de.tynt.com/deb/?m=xch&rt=html&id=0015a00002egvRSAAY&ru=https%3A%2F%2Fcs.admanmedia.com%2Fc0fe8ff240c531de0a2b8e0217a562d9.gif%3Fpuid%3D33XUSERID33X	HTTP Parser: No favicon
Source: https://de.tynt.com/deb/?m=xch&rt=html&id=0015a00002egvRSAAY&ru=https%3A%2F%2Fcs.admanmedia.com%2Fc0fe8ff240c531de0a2b8e0217a562d9.gif%3Fpuid%3D33XUSERID33X	HTTP Parser: No favicon
Source: https://de.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://de.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://de.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://us-u.openx.net/w/1.0/cm?id=5c25ba01-8014-471d-b115-9488b0bab07b&ph=bb3dfa1e-28f2-4379-aa01-73e27cdce2ee&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs.openwebmp.com%2Fcs%3Faid%3D40019%26id%3D%7BOPENX_ID%7D	HTTP Parser: No favicon
Source: https://us-u.openx.net/w/1.0/cm?id=5c25ba01-8014-471d-b115-9488b0bab07b&ph=bb3dfa1e-28f2-4379-aa01-73e27cdce2ee&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs.openwebmp.com%2Fcs%3Faid%3D40019%26id%3D%7BOPENX_ID%7D	HTTP Parser: No favicon
Source: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D	HTTP Parser: No favicon
Source: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D	HTTP Parser: No favicon
Source: https://eus.rubiconproject.com/usync.html?p=14558&endpoint=us-east	HTTP Parser: No favicon
Source: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east	HTTP Parser: No favicon
Source: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5107433834614603355	HTTP Parser: No favicon
Source: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU566ae6cb589e494baf6b312d1546c406	HTTP Parser: No favicon
Source: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3984632334688932657&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=RO9hsv43VjtJegiqx3XZlggueyE&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA%3D&piggybackCookie=7396999076146510192&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM3MDcmdGw9MjAxNjA=	HTTP Parser: No favicon
Source: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=9h_HgfZLkY7tHpTV8UiL1_FIkdDtS5WB9B7UBoTt	HTTP Parser: No favicon
Source: https://cs.admanmedia.com/iframe?pbjs=1&coppa=0	HTTP Parser: No favicon
Source: https://cs.admanmedia.com/iframe?pbjs=1&coppa=0	HTTP Parser: No favicon
Source: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]	HTTP Parser: No favicon
Source: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID	HTTP Parser: No favicon
Source: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID	HTTP Parser: No favicon
Source: https://u-ams03.e-planning.net/um?dc=a208d9366469aa64&fi=e19a4d4f1a5bfe2e&uid=373F7418-6E87-44EC-B856-199C0BFB5420	HTTP Parser: No favicon
Source: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=373F7418-6E87-44EC-B856-199C0BFB5420&redir=true&gdpr=0&gdpr_consent=&dcc=t	HTTP Parser: No favicon
Source: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZqdreAAABvIDNwBK	HTTP Parser: No favicon
Source: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://visitor-waardex.omnitagjs.com/visitor/isync?uid=f9f79c63be893b97a3364690a09d0b8d&name=WAARDEX_SSP&url=https%3A%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D205227%26dsp%3D688143%26t%3Diframe%26uid%3D%5BBUYER_USERID%5D	HTTP Parser: No favicon
Source: https://visitor-waardex.omnitagjs.com/visitor/isync?uid=f9f79c63be893b97a3364690a09d0b8d&name=WAARDEX_SSP&url=https%3A%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D205227%26dsp%3D688143%26t%3Diframe%26uid%3D%5BBUYER_USERID%5D	HTTP Parser: No favicon
Source: https://visitor-waardex.omnitagjs.com/visitor/isync?uid=f9f79c63be893b97a3364690a09d0b8d&name=WAARDEX_SSP&url=https%3A%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D205227%26dsp%3D688143%26t%3Diframe%26uid%3D%5BBUYER_USERID%5D	HTTP Parser: No favicon
Source: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D	HTTP Parser: No favicon
Source: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D	HTTP Parser: No favicon
Source: https://usersync.gumgum.com/usersync?b=adf&i=553826832608040581&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://usersync.gumgum.com/usersync?b=rth&i=uoiUGy35B2hVwIVwN115QFxpOvwJ0qOrj2m7FxE-zHo&pi=gumgum	HTTP Parser: No favicon
Source: https://usersync.gumgum.com/usersync?b=ttd&i=a58fd8ae-aee0-46b3-86c2-c92a9822258f	HTTP Parser: No favicon
Source: https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID	HTTP Parser: No favicon
Source: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV9mNWIwN2MzNC04MTlhLTRmMDQtYTYwMS04YTY5Y2FhYzM0NDY=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv	HTTP Parser: No favicon
Source: https://visitor-us-west-2.omnitagjs.com/visitor/sync?name=AIDEM&ttl=720&uid=b2f604635d0b9abde52139fc8a8034be&visitor=&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1	HTTP Parser: No favicon
Source: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D	HTTP Parser: No favicon
Source: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D	HTTP Parser: No favicon
Source: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://ssbsync.smartadserver.com/api/sync?callerId=22&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://eu-west-1-cs-rtb.openwebmp.com/sync-iframe?redirect=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DOPENWEB%26ttl%3D720%26uid%3D9f93135e824096b627ff609f5cdee636%26visitor%3D%7BpartnerId%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://eu-west-1-cs-rtb.openwebmp.com/sync-iframe?redirect=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DOPENWEB%26ttl%3D720%26uid%3D9f93135e824096b627ff609f5cdee636%26visitor%3D%7BpartnerId%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://eu-west-1-cs-rtb.openwebmp.com/sync-iframe?redirect=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DOPENWEB%26ttl%3D720%26uid%3D9f93135e824096b627ff609f5cdee636%26visitor%3D%7BpartnerId%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://usersync.gumgum.com/usersync?b=sus&i=Zqdre8Co8XwAAFEfXhAAAAAA	HTTP Parser: No favicon
Source: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DRISE_CODES%26ttl%3D720%26uid%3D48b439bcf2930e6408d6e795f7f1cdd2%26visitor%3D%7BpartnerId%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DRISE_CODES%26ttl%3D720%26uid%3D48b439bcf2930e6408d6e795f7f1cdd2%26visitor%3D%7BpartnerId%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fvisitor-us-west-2.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DRISE_CODES%26ttl%3D720%26uid%3D48b439bcf2930e6408d6e795f7f1cdd2%26visitor%3D%7BpartnerId%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://c1.adform.net/serving/cookie/match?party=14&cid=373F7418-6E87-44EC-B856-199C0BFB5420&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}	HTTP Parser: No favicon
Source: https://usersync.gumgum.com/usersync?b=pbm&i=373F7418-6E87-44EC-B856-199C0BFB5420	HTTP Parser: No favicon
Source: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=5385a0dc-4d93-11ef-b371-0ee37296b3d2	HTTP Parser: No favicon
Source: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=25&external_user_id=373F7418-6E87-44EC-B856-199C0BFB5420	HTTP Parser: No favicon
Source: http://kom-inform.euro.ru/eindex.html	HTTP Parser: No favicon
Source: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent={gdpr_consent}&us_privacy={us_privacy}&predirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Dg%26ep%3D76%26traffic_source%3Dsnippet%26session%3D42E5B26BF6A43647%26sp%3D827978%26pb%3D745570%26c%3D631382%26a%3D558003%26domain%3Dhttps%3A%2F%2Fha7jca.tripod.com%2Frajzok%2Fprog%2Fprog.htm%26extuid%3D	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=12290&pub_id=1886142	HTTP Parser: No favicon
Source: https://de.tynt.com/deb/?m=xch&rt=html&id=0015a00003HljHyAAJ&ru=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3D33ACROSS%26ttl%3D720%26uid%3D2f9442d7df2189f76c8b593d5f54ce95%26visitor%3D33XUSERID33X%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://cs.visiblemeasures.com/iframe?pbjs=1&coppa=0	HTTP Parser: No favicon
Source: https://sync.adtelligent.com/csync?t=g&ep=76&traffic_source=snippet&session=42E5B26BF6A43647&sp=827978&pb=745570&c=631382&a=558003&domain=https://ha7jca.tripod.com/rajzok/prog/prog.htm&extuid=373F7418-6E87-44EC-B856-199C0BFB5420	HTTP Parser: No favicon
Source: https://visitor.omnitagjs.com/visitor/isync?uid=19340f4f097d16f41f34fc0274981ca4	HTTP Parser: No favicon
Source: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D	HTTP Parser: No favicon
Source: https://visitor.omnitagjs.com/visitor/sync?name=AIDEM&ttl=720&uid=b2f604635d0b9abde52139fc8a8034be&visitor=&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=0a6366ca-25a1-4701-8a8b-4b422d86c5ec&expiration=1730196907	HTTP Parser: No favicon
Source: https://eu-west-1-cs-rtb.openwebmp.com/sync-iframe?redirect=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DOPENWEB%26ttl%3D720%26uid%3D9f93135e824096b627ff609f5cdee636%26visitor%3D%7BpartnerId%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	HTTP Parser: No favicon
Source: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DRISE_CODES%26ttl%3D720%26uid%3D48b439bcf2930e6408d6e795f7f1cdd2%26visitor%3D%7BpartnerId%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.228.174.117:443 -> 192.168.2.5:61969 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.5:63242 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:62660 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:61773 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:61960 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:61296 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 37.252.171.149 37.252.171.149
Source: Joe Sandbox View	IP Address: 91.228.74.200 91.228.74.200
Source: Joe Sandbox View	IP Address: 185.89.210.153 185.89.210.153

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.112.182
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91

Source: chromecache_1016.9.dr	String found in binary or memory: oD.prototype.l=function(a){switch(a.type){case "playing":qD(this);break;case "pause":case "ended":this.g.enabled&&this.g.stop();break;case "timeupdate":!this.B&&pD(this)>0&&(this.B=!0,qD(this))}};var qD=function(a){!a.g.enabled&&a.B&&(a.D=pD(a)1E3,a.C=Date.now(),a.A=!1,a.g.start())};oD.prototype.G=function(){var a=Date.now(),b=a-this.C,c=pD(this)1E3;c-this.D<b.5?this.A\|\|(this.A=!0,this.dispatchEvent("playbackStalled")):this.A=!1;this.D=c;this.C=a};var rD="://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.].moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/xsul www.youtube.com/pagead/slav".split(" "),sD=/\bocr\b/;function tD(a){if(sb(mi(a))\|\|qc&&a.length>2048)return!1;try{if((new S(a)).D().match(sD))return!0}catch(b){}return rD.find(function(b){return a.match(b)!=null})!=null};function uD(a,b){return sb(b)?!1:(new RegExp(a)).test(b)}function vD(a){var b={};a.split(",").forEach(function(c){var d=c.split("=");d.length==2&&(c=tb(d[0]),d=tb(d[1]),c.length>0&&(b[c]=d))});return b} equals www.youtube.com (Youtube)
Source: chromecache_832.9.dr, chromecache_1138.9.dr	String found in binary or memory: return b}fC.J="internal.enableAutoEventOnTimer";var lc=ja(["data-gtm-yt-inspected-"]),hC=["www.youtube.com","www.youtube-nocookie.com"],iC,jC=!1; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.cqham.ru
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: u042.89.spylog.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.ultra.renet.ru
Source: global traffic	DNS traffic detected: DNS query: top100-images.rambler.ru
Source: global traffic	DNS traffic detected: DNS query: counter.rambler.ru
Source: global traffic	DNS traffic detected: DNS query: ric.cqham.ru
Source: global traffic	DNS traffic detected: DNS query: an.yandex.ru
Source: global traffic	DNS traffic detected: DNS query: yastatic.net
Source: global traffic	DNS traffic detected: DNS query: avatars.mds.yandex.net
Source: global traffic	DNS traffic detected: DNS query: mc.yandex.ru
Source: global traffic	DNS traffic detected: DNS query: ads.adfox.ru
Source: global traffic	DNS traffic detected: DNS query: yandex.ru
Source: global traffic	DNS traffic detected: DNS query: favicon.yandex.net
Source: global traffic	DNS traffic detected: DNS query: px.arcspire.io
Source: global traffic	DNS traffic detected: DNS query: acint.net
Source: global traffic	DNS traffic detected: DNS query: ads.betweendigital.com
Source: global traffic	DNS traffic detected: DNS query: cm.a.mts.ru
Source: global traffic	DNS traffic detected: DNS query: cm.tns-counter.ru
Source: global traffic	DNS traffic detected: DNS query: cr.frontend.weborama.fr
Source: global traffic	DNS traffic detected: DNS query: dm.hybrid.ai
Source: global traffic	DNS traffic detected: DNS query: dmg.digitaltarget.ru
Source: global traffic	DNS traffic detected: DNS query: dsp.mpartner.digital
Source: global traffic	DNS traffic detected: DNS query: mc.yandex.com
Source: global traffic	DNS traffic detected: DNS query: 5184382291722247965848.cm.a.mts.ru
Source: global traffic	DNS traffic detected: DNS query: euw-ice.360yield.com
Source: global traffic	DNS traffic detected: DNS query: exchange.buzzoola.com
Source: global traffic	DNS traffic detected: DNS query: eye.targetads.io
Source: global traffic	DNS traffic detected: DNS query: ssp-rtb.sape.ru
Source: global traffic	DNS traffic detected: DNS query: gw-iad-bid.ymmobi.com
Source: global traffic	DNS traffic detected: DNS query: kimberlite.io
Source: global traffic	DNS traffic detected: DNS query: match.new-programmatic.com
Source: global traffic	DNS traffic detected: DNS query: mitdmp.whiteboxdigital.ru
Source: global traffic	DNS traffic detected: DNS query: nr.bidderstack.com
Source: global traffic	DNS traffic detected: DNS query: profile.ssp.rambler.ru
Source: global traffic	DNS traffic detected: DNS query: sm.rtb.mts.ru
Source: global traffic	DNS traffic detected: DNS query: px.adhigh.net
Source: global traffic	DNS traffic detected: DNS query: match.360yield.com
Source: global traffic	DNS traffic detected: DNS query: rtb-eu-warsaw.intent.ai
Source: global traffic	DNS traffic detected: DNS query: s.uuidksinc.net
Source: global traffic	DNS traffic detected: DNS query: shopnetic.com
Source: global traffic	DNS traffic detected: DNS query: sonar.semantiqo.com
Source: global traffic	DNS traffic detected: DNS query: vma.mts.ru
Source: global traffic	DNS traffic detected: DNS query: ssp.adriver.ru
Source: global traffic	DNS traffic detected: DNS query: sync.bumlam.com
Source: global traffic	DNS traffic detected: DNS query: counter.yadro.ru
Source: global traffic	DNS traffic detected: DNS query: sync.dmp.otm-r.com
Source: global traffic	DNS traffic detected: DNS query: sync.gonet-ads.com
Source: global traffic	DNS traffic detected: DNS query: sync.upravel.com
Source: global traffic	DNS traffic detected: DNS query: x01.aidata.io
Source: global traffic	DNS traffic detected: DNS query: yandex-dmp-sync.rutarget.ru
Source: global traffic	DNS traffic detected: DNS query: yandex-sync.rutarget.ru
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: sync.dsp.solta.io
Source: global traffic	DNS traffic detected: DNS query: ad.mail.ru
Source: global traffic	DNS traffic detected: DNS query: t.adx.opera.com
Source: global traffic	DNS traffic detected: DNS query: ysa-static.passport.yandex.ru
Source: global traffic	DNS traffic detected: DNS query: t.rtbwave.com
Source: global traffic	DNS traffic detected: DNS query: d0.c8.bf.a0.top.list.ru
Source: global traffic	DNS traffic detected: DNS query: www.acint.net
Source: global traffic	DNS traffic detected: DNS query: top-fwz1.mail.ru
Source: global traffic	DNS traffic detected: DNS query: ev.adriver.ru
Source: global traffic	DNS traffic detected: DNS query: a.utraff.com
Source: global traffic	DNS traffic detected: DNS query: dm-eu.hybrid.ai
Source: global traffic	DNS traffic detected: DNS query: tag.digitaltarget.ru
Source: global traffic	DNS traffic detected: DNS query: s.ccsyncuuid.net
Source: global traffic	DNS traffic detected: DNS query: redirect.frontend.weborama.fr
Source: global traffic	DNS traffic detected: DNS query: mc.acint.net
Source: global traffic	DNS traffic detected: DNS query: ssp.bestssp.com
Source: global traffic	DNS traffic detected: DNS query: sync.adspend.space
Source: global traffic	DNS traffic detected: DNS query: sape-sync.rutarget.ru
Source: global traffic	DNS traffic detected: DNS query: ads.adlook.me
Source: global traffic	DNS traffic detected: DNS query: ssp.bidvol.com
Source: global traffic	DNS traffic detected: DNS query: match.qtarget.tech
Source: global traffic	DNS traffic detected: DNS query: mts-dsp-sync.rutarget.ru
Source: global traffic	DNS traffic detected: DNS query: pix.bumlam.com
Source: global traffic	DNS traffic detected: DNS query: cs.agency2.ru
Source: global traffic	DNS traffic detected: DNS query: match.ohmy.bid
Source: global traffic	DNS traffic detected: DNS query: 1d8ad75e-4d93-11ef-86e0-002590c0647c.n1.sync.bumlam.com
Source: global traffic	DNS traffic detected: DNS query: sync.opendsp.ru
Source: global traffic	DNS traffic detected: DNS query: sync.programmatica.com
Source: global traffic	DNS traffic detected: DNS query: adx.com.ru
Source: global traffic	DNS traffic detected: DNS query: sync.rambler.ru
Source: global traffic	DNS traffic detected: DNS query: ssp.al-adtech.com
Source: global traffic	DNS traffic detected: DNS query: solta-sync.rutarget.ru
Source: global traffic	DNS traffic detected: DNS query: dmp.sbermarketing.ru
Source: global traffic	DNS traffic detected: DNS query: pixel.dsp.onetarget.ru
Source: global traffic	DNS traffic detected: DNS query: a.adspector.io
Source: global traffic	DNS traffic detected: DNS query: 1d8ad75e-4d93-11ef-86e0-002590c0647c.n7.sync.bumlam.com
Source: global traffic	DNS traffic detected: DNS query: a.adsource.tech
Source: global traffic	DNS traffic detected: DNS query: www.pinouts.ru
Source: global traffic	DNS traffic detected: DNS query: citater.ru
Source: global traffic	DNS traffic detected: DNS query: ha7jca.tripod.com
Source: global traffic	DNS traffic detected: DNS query: scripts.lycos.com
Source: global traffic	DNS traffic detected: DNS query: px.owneriq.net
Source: global traffic	DNS traffic detected: DNS query: www.googletagservices.com
Source: global traffic	DNS traffic detected: DNS query: udmserve.net
Source: global traffic	DNS traffic detected: DNS query: platform.bidgear.com

Source: Universal Radio Programmer.pdf	Initial sample: http://www.cqham.ru/uniprog2_eng.html
Source: Universal Radio Programmer.pdf	Initial sample: http://www.pinouts.ru/data/siemens_c25_s25_pinout.shtml
Source: Universal Radio Programmer.pdf	Initial sample: http://kom-inform.euro.ru/
Source: Universal Radio Programmer.pdf	Initial sample: http://kominform.by.ru/
Source: Universal Radio Programmer.pdf	Initial sample: http://ha7jca.tripod.com/rajzok/prog/prog.htm
Source: Universal Radio Programmer.pdf	Initial sample: http://www.cqham.ru/sch_eng.html
Source: Universal Radio Programmer.pdf	Initial sample: http://www.cqham.ru/image3/uniprog600.gif
Source: Universal Radio Programmer.pdf	Initial sample: mailto:kominform@rosnet.ru

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Universal Radio Programmer.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1568,i,11455965130725462407,9431319710212433800,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "http://www.cqham.ru/uniprog2_eng.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1896,i,11439083397119314046,16504384329666213646,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1568,i,11455965130725462407,9431319710212433800,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1896,i,11439083397119314046,16504384329666213646,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Universal Radio Programmer.pdf	Initial sample: PDF keyword /JS count = 0
Source: Universal Radio Programmer.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	5 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	6 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID	0%	URL Reputation	safe
https://getbootstrap.com/)	0%	URL Reputation	safe
https://match.new-programmatic.com/userbind?src=sape&id=0A00007F1E6BA766C65BDC8F0217B4B1	0%	Avira URL Cloud	safe
http://euro.ru/06-18/js/feedbackForm.js?3	0%	Avira URL Cloud	safe
https://sync.bumlam.com/?src=sap1&uid=0A00007F1E6BA766C65BDC8F0217B4B1	0%	Avira URL Cloud	safe
https://mc.acint.net/rmatch?dp=296&euid=01w9YlPOFJI9kxMjDzgIBu&r=https%3A%2F%2Fmc.acint.net%2Fcmatch%3Fdp%3D296	0%	Avira URL Cloud	safe
https://ps.eyeota.net/pixel?pid=gdomg51&t=gif&cat=&us_privacy=&random=1722248111882.2	0%	Avira URL Cloud	safe
https://ads.stickyadstv.com/user-matching?id=3663&gdpr=0&gdpr_consent=	0%	Avira URL Cloud	safe
https://cdn.prplads.com/load.js?publisherId=3105e1fb6246bd5aca2a3ecb52bb4e6c:572bb2b7841c9515200fe3d0cd80bf01eb806025eda7d4c63ee5cd8dff72e7bdd97cc17139ab92ab97f13ddcbd23656bea647abfe2ae7dc7923fd32a9fa8211c	0%	Avira URL Cloud	safe
https://ssp.adriver.ru/cgi-bin/sync.cgi?dsp_id=153&external_id=0A00007F1E6BA766C65BDC8F0217B4B1&redirect_url=https%3A%2F%2Fmc.acint.net%2Fcmatch%3Fdp%3D85	0%	Avira URL Cloud	safe
https://creatives.purpleads.io	0%	Avira URL Cloud	safe
https://ssp.adriver.ru/cgi-bin/sync.cgi?dsp_id=153&external_id=0A00007F1E6BA766C65BDC8F0217B4B1&redi	0%	Avira URL Cloud	safe
https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fha7jca.tripod.com%2Frajzok%2Fprog%2Fprog.htm&PageUrl=https%3A%2F%2Fha7jca.tripod.com%2Frajzok%2Fprog%2Fprog.htm&PageReferrer=https%3A%2F%2Fha7jca.tripod.com%2Frajzok%2Fprog%2Fprog.htm	0%	Avira URL Cloud	safe
https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID	0%	Avira URL Cloud	safe
https://creatives.purpleads.io	0%	Virustotal		Browse
https://ads.stickyadstv.com/user-matching?id=3663&gdpr=0&gdpr_consent=	0%	Virustotal		Browse
https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZqdrdtHM6agAAEPGAGu6HgAA%263596&gpdr	0%	Avira URL Cloud	safe
http://www.cqham.ru/image3/ALA1e.gif	0%	Avira URL Cloud	safe
http://www.cqham.ru/image/get_djvu2.gif	0%	Avira URL Cloud	safe
http://www.cqham.ru/eurasia/BURST-2000A-380x60-1.gif	0%	Avira URL Cloud	safe
https://api.purpleads.io/x/a/0bdd0160a95f82844a0cc6c998eaec8a:ced819f603fd8699fc67acc4ed3d2ad2e29265013b9a51c94cdf1b0c28640912379216e8c46c1cef625973880c212d40c4d5c8537439b91915b099f8e41171b839e9441a86ce9c59da8f81414a6b91a6636ce456dfc0d8296e272f51d380ae40c84402562605b75490885844e8336c8b811e473bd58cbbd0e1b307b624f42f9c6e08af4525b22560e38c5deda019ab65/i?id=34ed506b-ed6e-48c9-abcb-e373e6cb3a85	0%	Avira URL Cloud	safe
https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID	1%	Virustotal		Browse
https://sync.dmp.otm-r.com/match/yandex_dsp_new?id=2D42FE159FCA3D51	0%	Avira URL Cloud	safe
https://mc.acint.net/rmatch?dp=95&r=https%3A%2F%2Fmc.acint.net%2Fcmatch%3Fdp%3D95&euid=UFMANMYW	0%	Avira URL Cloud	safe
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai	0%	Avira URL Cloud	safe
https://sync.bumlam.com/?src=yandex2	0%	Avira URL Cloud	safe
https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=	0%	Avira URL Cloud	safe
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai	1%	Virustotal		Browse
http://www.cqham.ru/t12.gif	0%	Avira URL Cloud	safe
https://an.yandex.ru/mapuid/adsniperis/1d8ad75e-4d93-11ef-86e0-002590c0647c	0%	Avira URL Cloud	safe
https://sync.bumlam.com/?src=yandex2	0%	Virustotal		Browse
https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=	0%	Virustotal		Browse
https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fha7jca.tripod.com%2Frajzok%2Fprog%2Fprog.htm&PublisherDomain=https%3A%2F%2Fha7jca.tripod.com	0%	Avira URL Cloud	safe
https://an.yandex.ru/mapuid/buzzooladspis/1aedd120-7bda-46eb-4d81-26e72bf203a9	0%	Avira URL Cloud	safe
https://pixel-eu.onaudience.com/?partner=270&smartmap=1&gdpr=0&gdpr_consent=&redirect=image2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw%26piggybackCookie%3D%25_rid%26gdpr%3D0%26gdpr_consent%3D%25_gdpr_consent	0%	Avira URL Cloud	safe
https://rtb-csync.smartadserver.com/redir/?partnerid=130&partneruserid=b5ec9328-f0ea-4599-80b5-4376f3e14697	0%	Avira URL Cloud	safe
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=2fc5fedd37&gdpr=0&gdpr_consent=	0%	Avira URL Cloud	safe
https://events-ssc.33across.com/match?bidder_id=43&external_user_id=RX-c85c15c9-9cb2-4fec-a02e-445d053e0610-003&ts=1722248065&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1---	0%	Avira URL Cloud	safe
https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZqdrdtHM6agAAEPGAGu6HgAA%263596&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=96b0c5ede6d841308fe49d29f6a2b734	0%	Avira URL Cloud	safe
https://events-ssc.33across.com/match?bidder_id=33&external_user_id=1088072852856334017168&ts=1722248063&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=	0%	Avira URL Cloud	safe
https://ssc-cms.33across.com/ps/?xi=127&us_privacy=&xu=49b8041b2fd052bfb3541352ad10d9e6	0%	Avira URL Cloud	safe
https://www.cloudflare.com/5xx-error-landing	0%	Avira URL Cloud	safe
http://www.cqham.ru/cqham_5.gif	0%	Avira URL Cloud	safe
https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D	0%	Avira URL Cloud	safe
https://an.yandex.ru/mapuid/mediascope/50c4066da0f59e06665ecbc52b0f77248952e29d8d1208dacaad7753626bb5a9	0%	Avira URL Cloud	safe
https://pixel.onaudience.com/?partner=252&mapped=y-Y1xjwvRE2pTLzLvgu1pMdoRBN.fHY.gmCg--~A&gdpr=0	0%	Avira URL Cloud	safe
https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D	0%	Virustotal		Browse
https://citater.ru/css/bootstrap.css	0%	Avira URL Cloud	safe
https://ssum-sec.casalemedia.com/usermatchredir?s=190532&gdpr=0&gdpr_consent=&cb=https%3A%2F%2Fcs.openwebmp.com%2Fcs%3Faid%3D40025%26id%3D	0%	Avira URL Cloud	safe
https://an.yandex.ru/mapuid/targetrtbis/	0%	Avira URL Cloud	safe
https://ums.acuityplatform.com/tum?umid=139&uid=ec2ce3c8-a8f3-4513-bf91-6d78d9f59d77	0%	Avira URL Cloud	safe
https://usersync.gumgum.com/usersync?b=vnt&i=efc22363-0d10-4c21-a08f-022fe5546f4c	0%	Avira URL Cloud	safe
https://www.cloudflare.com/5xx-error-landing	0%	Virustotal		Browse
https://sm.rtb.mts.ru/p?ssp=sape&id=0A00007F1E6BA766C65BDC8F0217B4B1	0%	Avira URL Cloud	safe
https://us.ck-ie.com/vim027.gif?gdpr=[GDPR]&gdpr_consent=[GDPR_Consent]&us_privacy=[CCPA]&coppa=0&redir=https%3A%2F%2Fcs.visiblemeasures.com%2Fccfce5df60bcfd6e784ca3dc61d287e0.gif%3Fpuid%3D%5B%24PARTNER_UID%5D	0%	Avira URL Cloud	safe
https://api.purpleads.io/x/a/e23a87ea9944a85b66a6748eb38c4ca8:e17e7950eebe0d6f269ac25bdf6c10eb3622c7282666013549da82eba5ffe407f3c9691beac712373a00cc4abf724b11de0b4538ae0cc2c862bebbf04006e5f2e22e58626c18824d47acbccd6b52a998c3e9ad0cc61dbc1eb28339d926cdf746/i?id=0a86d7d0-d1af-4fe5-82ab-f753a44829d0	0%	Avira URL Cloud	safe
https://dmg.digitaltarget.ru/awg/custom/119/i/i?call_source=awg&ts=1722247966291&i=1722247962	0%	Avira URL Cloud	safe
http://www.cqham.ru/image2/cq.gif	0%	Avira URL Cloud	safe
https://github.com/google/safevalues/issues	0%	Avira URL Cloud	safe
https://cs.admanmedia.com/58f2acddbab01615ad29d353f5c19de5.gif?puid=fcef317d-c0e1-441b-8ff5-aa2d58d7402b&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&ccpa=[CCPA]&coppa=[COPPA]	0%	Avira URL Cloud	safe
https://csync.loopme.me/?pubid=11575&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fxi%3D122%26us_privacy%3D%26xu%3D%7Bviewer_token%7D	0%	Avira URL Cloud	safe
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156631&s=1180592&predirect=https%3A%2F%2Fu-ams	0%	Avira URL Cloud	safe
http://www.cqham.ru/image/o13.gif	0%	Avira URL Cloud	safe
https://u.openx.net/w/1.0/cm?id=ce0642e2-639c-4d10-8c5d-e263dddf6c33&r=https%3A%2F%2Fcs.admanmedia.com%2Fsync%2Fopenx%3Fpuid%3D	0%	Avira URL Cloud	safe
https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D	0%	Avira URL Cloud	safe
https://ads.avads.net/sync/bsw?bidswitch_ssp_id=adyoulike&bidswitch_param=76cadc6d-9352-43aa-a1a1-ac6aff85a1a7&gdpr=0&gdpr_consent=	0%	Avira URL Cloud	safe
https://bh.contextweb.com/bh/rtset?pid=561516&ev=1&us_privacy=&rurl=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fxi%3D5%26xu%3D%25%25VGUID%25%25	0%	Avira URL Cloud	safe
https://sync.go.sonobi.com/us.gif?nw=st&nuid=RO9hsv43VjtJegiqx3XZlggueyE	0%	Avira URL Cloud	safe
https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=76cadc6d-9352-43aa-a1a1-ac6aff85a1a7&gdpr=0&gdpr_consent=&us_privacy=	0%	Avira URL Cloud	safe
https://ads.servenobid.com/sync?pid=312&uid=3984632334688932657	0%	Avira URL Cloud	safe
https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@	0%	Avira URL Cloud	safe
https://cse.google.com/cse.js	0%	Avira URL Cloud	safe
http://www.cqham.ru/images/z28.gif	0%	Avira URL Cloud	safe
https://dpm.demdex.net/ibs:dpid=423652&dpuuid=691B999789715DC9	0%	Avira URL Cloud	safe
https://cdn.ampproject.org/rtv/$	0%	Avira URL Cloud	safe
https://mc.yandex.com/sync_cookie_image_check	0%	Avira URL Cloud	safe
https://sync.go.sonobi.com/us.gif?nw=if&nuid=6da166a7-6bb2-4b00-b8a5-c1693c90cefc	0%	Avira URL Cloud	safe
https://ap.lijit.com/pixel?redir=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DSOVRN%26ttl%3D720%26uid%3D4b30a0b1f289a261ab592e1e53c126eb%26visitor%3D%24UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	0%	Avira URL Cloud	safe
https://adxbid.info/tripodcomdynamic.js	0%	Avira URL Cloud	safe
https://ssp-rtb.sape.ru/rmatch?r=https%3A%2F%2Facint.net%2Frmatch%3Fdp%3D14%26euid%3D$%7BUSER_ID%7D%26r%3Dhttps%253A%252F%252Fan.yandex.ru%252Fmapuid%252Fsapeis%252F$%257BUSER_ID%257D&dp=14	0%	Avira URL Cloud	safe
https://prebid.a-mo.net/cchain/0/688?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=1YN-&A=9ea1b0fe-fc62-45a2-b34f-f87c9670dc1e&bidder=appnexus&cbx=aHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%3D&uid=3984632334688932657	0%	Avira URL Cloud	safe
https://ssc-cms.33across.com/ps/?us_privacy=&ts=1722248057133.5&ri=2&ru=https%3A%2F%2Fssum-sec.casalemedia.com%2Fusermatchredir%3Fs%3D191740%26us_privacy%3D%24%7BUS_PRIVACY%7D%26cb%3Dhttps%253A%252F%252Fevents-ssc.33across.com%252Fmatch%253Fliv%253Dh%2526us_privacy%253D%24%7BUS_PRIVACY%7D%2526bidder_id%253D2%2526external_user_id%253D	0%	Avira URL Cloud	safe
https://goo.gl/pxwQGp)	0%	Avira URL Cloud	safe
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fpx.owneriq.net%252Feucm%252Fp%252Fapndmp%253Foi%253D1%2526tid%253D%2524UID%2526redir%253Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D13%2526code%253D%28OIQ_UUID%29	0%	Avira URL Cloud	safe
https://mwzeom.zeotap.com/mw?zpartnerid=1384&env=mWeb&gdpr=0&gdpr_consent=&cid=373F7418-6E87-44EC-B856-199C0BFB5420	0%	Avira URL Cloud	safe
https://maxcdn.bootstrapcdn.com/font-awesome/4.6.3/css/font-awesome.min.css	0%	Avira URL Cloud	safe
https://ha7jca.tripod.com/rajzok/rajzok.htm	0%	Avira URL Cloud	safe
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202407230101/pubads_impl.js	0%	Avira URL Cloud	safe
https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID	0%	Avira URL Cloud	safe
https://onetag-sys.com/prebid-request	0%	Avira URL Cloud	safe
https://id.a-mx.com/u?gdpr=0&gdpr_consent=&cb=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D9ea1b0fe-fc62-45a2-b34f-f87c9670dc1e%26bidder%3Damx_com%26uid%3D	0%	Avira URL Cloud	safe
https://exchange.buzzoola.com/cookiesync/dsp/sape-banner?uid=0A00007F1E6BA766C65BDC8F0217B4B1&url=ht	0%	Avira URL Cloud	safe
https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID&gdpr=0&gdpr_consent=	0%	Avira URL Cloud	safe
https://cs.admanmedia.com/7df8d99918d2854384fc4c2d197ec3ff.gif?puid=ua-224dbbae-81e8-387f-873d-9929b1cbe964	0%	Avira URL Cloud	safe
https://kimberlite.io/rtb/sync/yandex	0%	Avira URL Cloud	safe
https://match.360yield.com/match?publisher_dsp_id=434&external_user_id=b5ec9328-f0ea-4599-80b5-4376f3e14697	0%	Avira URL Cloud	safe
http://ha7jca.tripod.com/rajzok/prog/prog.htm	0%	Avira URL Cloud	safe
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1	0%	Avira URL Cloud	safe
https://ssc-cms.33across.com/ps/?xi=44&ts=1722248058355.4&us_privacy=&xu=7556854650816705608	0%	Avira URL Cloud	safe
https://uipus.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=373F7418-6E87-44EC-B856-199C0BFB5420&sInitiator=external&gdpr=0&gdpr_consent=	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
securepubads.g.doubleclick.net	216.58.212.162	true	false	unknown
um.simpli.fi	35.204.158.49	true	false	unknown
cms-xch.33across.com	34.117.239.71	true	false	unknown
pix.bumlam.com	31.172.81.159	true	false	unknown
global.px.quantserve.com	91.228.74.159	true	false	unknown
ssum.casalemedia.com	104.18.36.155	true	false	unknown
imp9.bidgear.com	172.67.74.36	true	false	unknown
d-ams1.turn.com	46.228.164.13	true	false	unknown
rtb.openx.net	35.186.253.211	true	false	unknown
1.cpm.ak-is2.net	77.245.57.72	true	false	unknown
bttrack.com	192.132.33.68	true	false	unknown
euro.ru	31.31.205.163	true	true	unknown
mwzeom.zeotap.com	104.22.51.98	true	false	unknown
ats-eks.eu-central-1.dcs-online-targeting-prd.aws.oath.cloud	3.71.149.231	true	false	unknown
sync.intentiq.com	3.160.150.74	true	false	unknown
creatives.purpleads.io	108.138.7.17	true	false	unknown
dckrl2e5yf7xg.cloudfront.net	18.245.46.117	true	false	unknown
id.rlcdn.com	35.244.174.68	true	false	unknown
p-vip.al-adtech.com	45.139.25.123	true	false	unknown
match.adsrvr.org	52.223.40.198	true	false	unknown
favicon.yandex.net	77.88.21.36	true	false	unknown
rtactivateloadbalancer-2076579973.us-east-1.elb.amazonaws.com	54.237.160.12	true	false	unknown
pagead-googlehosted.l.google.com	142.250.184.225	true	false	unknown
creativecdn.com	185.184.8.90	true	false	unknown
acint.net	193.3.184.140	true	false	unknown
uip.semasio.net	77.243.51.122	true	false	unknown
ActivationEdge-activation-1631408035.eu-central-1.elb.amazonaws.com	3.127.2.55	true	false	unknown
r.mail.ru	95.163.41.56	true	false	unknown
m.deepintent.com	169.197.150.8	true	false	unknown
iad-2-apex.go.sonobi.com	69.166.1.8	true	false	unknown
cm.tns-counter.ru	194.226.130.228	true	false	unknown
pixel-sync.sitescout.com	34.36.216.150	true	false	unknown
pixel.onaudience.com	54.38.113.5	true	false	unknown
sync-unosync-com.geodns.me	185.83.71.234	true	false	unknown
ssum-sec.casalemedia.com	172.64.151.101	true	false	unknown
us-e.visiblemeasures.com	8.2.110.233	true	false	unknown
rtb.adgrx.com	52.215.155.11	true	false	unknown
ric.cqham.ru	194.186.45.251	true	false	unknown
webpub-https-proxy.bo3.lycos.com	209.202.252.105	true	false	unknown
www.googletagservices.com	142.250.186.34	true	false	unknown
id.crwdcntrl.net	52.30.227.82	true	false	unknown
iad-2-sync.go.sonobi.com	69.166.1.66	true	false	unknown
am1-direct-bgp.contextweb.com	208.93.169.131	true	false	unknown
hbx.media.net	23.212.88.20	true	false	unknown
nlb-dflb-496f722d06cc67e2.elb.eu-north-1.amazonaws.com	13.53.196.230	true	false	unknown
hde.tynt.com	67.202.105.31	true	false	unknown
dsp.mpartner.digital	185.151.241.151	true	false	unknown
pixel-eu.onaudience.com	54.38.113.4	true	false	unknown
spug-lhrc.pubmnet.com	185.64.190.81	true	false	unknown
cookie.active-agent.com	80.82.210.217	true	false	unknown
sync.rambler.ru	87.242.127.163	true	false	unknown
am-vip001.taboola.com	141.226.228.48	true	false	unknown
pixel.tapad.com	34.111.113.62	true	false	unknown
rtb-csync-euw2.smartadserver.com	178.32.197.57	true	false	unknown
ssp.ads.betweendigital.com	188.42.196.115	true	false	unknown
imgsync-amsfpairbc.pubmnet.com	198.47.127.18	true	false	unknown
am6-tmp.a-mx.net	147.75.34.47	true	false	unknown
h7mzk9dlb.puzztake.com	157.230.58.12	true	false	unknown
lvs-dec-vip2.rtbwave.com	148.153.84.157	true	false	unknown
counter.rambler.ru	81.19.89.17	true	false	unknown
outspot2-ams.adx.opera.com	82.145.213.8	true	false	unknown
match.adsby.bidtheatre.com	188.166.17.21	true	false	unknown
matching.truffle.bid	23.88.86.2	true	false	unknown
jsdelivr.map.fastly.net	151.101.193.229	true	false	unknown
eye.targetads.io	51.250.77.168	true	false	unknown
sync.dsp.solta.io	217.199.220.73	true	false	unknown
sync-sc-main-was.aniview.com	172.240.45.78	true	false	unknown
x01.aidata.io	89.108.119.43	true	false	unknown
api.purpleads.io	44.214.36.227	true	false	unknown
1x1.a-mo.net	52.28.30.24	true	false	unknown
httplogserver-lb.global.unified-prod.sharethis.net	3.74.109.89	true	false	unknown
sync.1rx.io	46.228.174.117	true	false	unknown
ds-pr-bh.ybp.gysm.yahoodns.net	108.128.81.98	true	false	unknown
idaas-ext.cph.liveintent.com	35.171.39.111	true	false	unknown
lb-prod.adlook.me	176.122.21.139	true	false	unknown
ow-amsc.pubmnet.com	185.64.189.116	true	false	unknown
mp.4dex.io	104.18.10.176	true	false	unknown
d1mee2k02h94hw.cloudfront.net	13.32.27.96	true	false	unknown
nydc1.outbrain.org	70.42.32.223	true	false	unknown
us-u.openx.net	34.98.64.218	true	false	unknown
pixel.dsp.onetarget.ru	130.193.53.230	true	false	unknown
ads.servenobid.com	34.251.204.22	true	false	unknown
udmserve.net	68.71.249.118	true	false	unknown
cs.mobfox.com	8.2.110.206	true	false	unknown
ads.adfox.ru	77.88.21.179	true	false	unknown
5184382291722247965848.cm.a.mts.ru	185.65.149.228	true	false	unknown
a.utraff.com	104.26.6.189	true	false	unknown
t.seedtag.com	104.16.187.87	true	false	unknown
dmp.brand-display.com	34.160.19.107	true	false	unknown
px.arcspire.io	35.177.4.157	true	false	unknown
sync.adspend.space	172.67.168.127	true	false	unknown
dm-eu.hybrid.ai	37.230.131.22	true	false	unknown
s333.adxpremium.services	172.255.100.116	true	false	unknown
top100.rambler.ru	87.242.127.163	true	false	unknown
prod.appnexus.map.fastly.net	151.101.1.108	true	false	unknown
cm.a.mts.ru	185.65.149.228	true	false	unknown
pixel-origin.mathtag.com	74.121.140.211	true	false	unknown
hb.digbearings.com	54.220.255.252	true	false	unknown
pb-am.a-mo.net	147.75.84.158	true	false	unknown
tagr-pixel-nginx-odr-euw4.mookie1.com	34.160.236.64	true	false	unknown

Name	Malicious	Antivirus Detection	Reputation
http://euro.ru/06-18/js/feedbackForm.js?3	false	Avira URL Cloud: safe	unknown
https://ps.eyeota.net/pixel?pid=gdomg51&t=gif&cat=&us_privacy=&random=1722248111882.2	false	Avira URL Cloud: safe	unknown
https://sync.bumlam.com/?src=sap1&uid=0A00007F1E6BA766C65BDC8F0217B4B1	false	Avira URL Cloud: safe	unknown
https://match.new-programmatic.com/userbind?src=sape&id=0A00007F1E6BA766C65BDC8F0217B4B1	false	Avira URL Cloud: safe	unknown
https://mc.acint.net/rmatch?dp=296&euid=01w9YlPOFJI9kxMjDzgIBu&r=https%3A%2F%2Fmc.acint.net%2Fcmatch%3Fdp%3D296	false	Avira URL Cloud: safe	unknown
https://onetag-sys.com/static/topicsapi.html?bidder=onetag	false		unknown
https://cdn.prplads.com/load.js?publisherId=3105e1fb6246bd5aca2a3ecb52bb4e6c:572bb2b7841c9515200fe3d0cd80bf01eb806025eda7d4c63ee5cd8dff72e7bdd97cc17139ab92ab97f13ddcbd23656bea647abfe2ae7dc7923fd32a9fa8211c	false	Avira URL Cloud: safe	unknown
https://ssp.adriver.ru/cgi-bin/sync.cgi?dsp_id=153&external_id=0A00007F1E6BA766C65BDC8F0217B4B1&redirect_url=https%3A%2F%2Fmc.acint.net%2Fcmatch%3Fdp%3D85	false	Avira URL Cloud: safe	unknown
https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fha7jca.tripod.com%2Frajzok%2Fprog%2Fprog.htm&PageUrl=https%3A%2F%2Fha7jca.tripod.com%2Frajzok%2Fprog%2Fprog.htm&PageReferrer=https%3A%2F%2Fha7jca.tripod.com%2Frajzok%2Fprog%2Fprog.htm	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8918103505273586&output=html&adk=1812271804&adf=3025194257&abgtt=1&lmt=1722247989&plat=3%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=250x714_r&format=0x0&url=http%3A%2F%2Fwww.cqham.ru%2Fcons.htm&pra=7&wgl=1&easpi=0&aihb=0&asro=0&ailel=29~32~27~1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~30&aiael=29~32~27~1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~30&aifxl=32_7~27_15~30_19&aiixl=29_5~32_9~27_3~30_6&aslmct=0.7&asamct=0.7&dt=1722247989541&bpp=3&bdt=191&idt=363&shv=r20240724&mjsv=m202407230101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=468x60&nras=1&correlator=1132254224149&frm=20&pv=1&ga_vid=661510341.1722247990&ga_sid=1722247990&ga_hid=729362722&ga_fc=0&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1263&bih=907&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44795922%2C95330278%2C95334525%2C95334830%2C95337584%2C95337870%2C95338264%2C95336521%2C95336266%2C31078668%2C31078670&oid=2&pvsid=76883297692835&tmod=489893845&uas=0&nvt=1&fsapi=1&fc=896&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C907&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&fsb=1&dtd=375	false		unknown
https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.cqham.ru/image3/ALA1e.gif	false	Avira URL Cloud: safe	unknown
http://www.cqham.ru/image/get_djvu2.gif	false	Avira URL Cloud: safe	unknown
https://api.purpleads.io/x/a/0bdd0160a95f82844a0cc6c998eaec8a:ced819f603fd8699fc67acc4ed3d2ad2e29265013b9a51c94cdf1b0c28640912379216e8c46c1cef625973880c212d40c4d5c8537439b91915b099f8e41171b839e9441a86ce9c59da8f81414a6b91a6636ce456dfc0d8296e272f51d380ae40c84402562605b75490885844e8336c8b811e473bd58cbbd0e1b307b624f42f9c6e08af4525b22560e38c5deda019ab65/i?id=34ed506b-ed6e-48c9-abcb-e373e6cb3a85	false	Avira URL Cloud: safe	unknown
http://www.cqham.ru/eurasia/BURST-2000A-380x60-1.gif	false	Avira URL Cloud: safe	unknown
https://sync.dmp.otm-r.com/match/yandex_dsp_new?id=2D42FE159FCA3D51	false	Avira URL Cloud: safe	unknown
https://mc.acint.net/rmatch?dp=95&r=https%3A%2F%2Fmc.acint.net%2Fcmatch%3Fdp%3D95&euid=UFMANMYW	false	Avira URL Cloud: safe	unknown
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sync.bumlam.com/?src=yandex2	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.cqham.ru/t12.gif	false	Avira URL Cloud: safe	unknown
https://an.yandex.ru/mapuid/adsniperis/1d8ad75e-4d93-11ef-86e0-002590c0647c	false	Avira URL Cloud: safe	unknown
https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fha7jca.tripod.com%2Frajzok%2Fprog%2Fprog.htm&PublisherDomain=https%3A%2F%2Fha7jca.tripod.com	false	Avira URL Cloud: safe	unknown
https://an.yandex.ru/mapuid/buzzooladspis/1aedd120-7bda-46eb-4d81-26e72bf203a9	false	Avira URL Cloud: safe	unknown
https://pixel-eu.onaudience.com/?partner=270&smartmap=1&gdpr=0&gdpr_consent=&redirect=image2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw%26piggybackCookie%3D%25_rid%26gdpr%3D0%26gdpr_consent%3D%25_gdpr_consent	false	Avira URL Cloud: safe	unknown
https://rtb-csync.smartadserver.com/redir/?partnerid=130&partneruserid=b5ec9328-f0ea-4599-80b5-4376f3e14697	false	Avira URL Cloud: safe	unknown
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=2fc5fedd37&gdpr=0&gdpr_consent=	false	Avira URL Cloud: safe	unknown
https://events-ssc.33across.com/match?bidder_id=43&external_user_id=RX-c85c15c9-9cb2-4fec-a02e-445d053e0610-003&ts=1722248065&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1---	false	Avira URL Cloud: safe	unknown
https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=	false		unknown
https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZqdrdtHM6agAAEPGAGu6HgAA%263596&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=96b0c5ede6d841308fe49d29f6a2b734	false	Avira URL Cloud: safe	unknown
https://events-ssc.33across.com/match?bidder_id=33&external_user_id=1088072852856334017168&ts=1722248063&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=	false	Avira URL Cloud: safe	unknown
https://ssc-cms.33across.com/ps/?xi=127&us_privacy=&xu=49b8041b2fd052bfb3541352ad10d9e6	false	Avira URL Cloud: safe	unknown
http://www.cqham.ru/cqham_5.gif	false	Avira URL Cloud: safe	unknown
https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://an.yandex.ru/mapuid/mediascope/50c4066da0f59e06665ecbc52b0f77248952e29d8d1208dacaad7753626bb5a9	false	Avira URL Cloud: safe	unknown
https://pixel.onaudience.com/?partner=252&mapped=y-Y1xjwvRE2pTLzLvgu1pMdoRBN.fHY.gmCg--~A&gdpr=0	false	Avira URL Cloud: safe	unknown
https://citater.ru/css/bootstrap.css	false	Avira URL Cloud: safe	unknown
https://ssum-sec.casalemedia.com/usermatchredir?s=190532&gdpr=0&gdpr_consent=&cb=https%3A%2F%2Fcs.openwebmp.com%2Fcs%3Faid%3D40025%26id%3D	false	Avira URL Cloud: safe	unknown
https://an.yandex.ru/mapuid/targetrtbis/	false	Avira URL Cloud: safe	unknown
https://ums.acuityplatform.com/tum?umid=139&uid=ec2ce3c8-a8f3-4513-bf91-6d78d9f59d77	false	Avira URL Cloud: safe	unknown
https://usersync.gumgum.com/usersync?b=vnt&i=efc22363-0d10-4c21-a08f-022fe5546f4c	false	Avira URL Cloud: safe	unknown
https://sm.rtb.mts.ru/p?ssp=sape&id=0A00007F1E6BA766C65BDC8F0217B4B1	false	Avira URL Cloud: safe	unknown
https://us.ck-ie.com/vim027.gif?gdpr=[GDPR]&gdpr_consent=[GDPR_Consent]&us_privacy=[CCPA]&coppa=0&redir=https%3A%2F%2Fcs.visiblemeasures.com%2Fccfce5df60bcfd6e784ca3dc61d287e0.gif%3Fpuid%3D%5B%24PARTNER_UID%5D	false	Avira URL Cloud: safe	unknown
https://api.purpleads.io/x/a/e23a87ea9944a85b66a6748eb38c4ca8:e17e7950eebe0d6f269ac25bdf6c10eb3622c7282666013549da82eba5ffe407f3c9691beac712373a00cc4abf724b11de0b4538ae0cc2c862bebbf04006e5f2e22e58626c18824d47acbccd6b52a998c3e9ad0cc61dbc1eb28339d926cdf746/i?id=0a86d7d0-d1af-4fe5-82ab-f753a44829d0	false	Avira URL Cloud: safe	unknown
https://dmg.digitaltarget.ru/awg/custom/119/i/i?call_source=awg&ts=1722247966291&i=1722247962	false	Avira URL Cloud: safe	unknown
http://www.cqham.ru/image2/cq.gif	false	Avira URL Cloud: safe	unknown
https://cs.admanmedia.com/58f2acddbab01615ad29d353f5c19de5.gif?puid=fcef317d-c0e1-441b-8ff5-aa2d58d7402b&gdpr=[GDPR]&gdpr_consent=[GDPR_CONSENT]&ccpa=[CCPA]&coppa=[COPPA]	false	Avira URL Cloud: safe	unknown
https://csync.loopme.me/?pubid=11575&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fxi%3D122%26us_privacy%3D%26xu%3D%7Bviewer_token%7D	false	Avira URL Cloud: safe	unknown
http://www.cqham.ru/image/o13.gif	false	Avira URL Cloud: safe	unknown
https://u.openx.net/w/1.0/cm?id=ce0642e2-639c-4d10-8c5d-e263dddf6c33&r=https%3A%2F%2Fcs.admanmedia.com%2Fsync%2Fopenx%3Fpuid%3D	false	Avira URL Cloud: safe	unknown
https://ads.avads.net/sync/bsw?bidswitch_ssp_id=adyoulike&bidswitch_param=76cadc6d-9352-43aa-a1a1-ac6aff85a1a7&gdpr=0&gdpr_consent=	false	Avira URL Cloud: safe	unknown
https://bh.contextweb.com/bh/rtset?pid=561516&ev=1&us_privacy=&rurl=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fxi%3D5%26xu%3D%25%25VGUID%25%25	false	Avira URL Cloud: safe	unknown
https://sync.go.sonobi.com/us.gif?nw=st&nuid=RO9hsv43VjtJegiqx3XZlggueyE	false	Avira URL Cloud: safe	unknown
https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=76cadc6d-9352-43aa-a1a1-ac6aff85a1a7&gdpr=0&gdpr_consent=&us_privacy=	false	Avira URL Cloud: safe	unknown
https://ads.servenobid.com/sync?pid=312&uid=3984632334688932657	false	Avira URL Cloud: safe	unknown
https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@	false	Avira URL Cloud: safe	unknown
https://dpm.demdex.net/ibs:dpid=423652&dpuuid=691B999789715DC9	false	Avira URL Cloud: safe	unknown
http://www.cqham.ru/images/z28.gif	false	Avira URL Cloud: safe	unknown
https://mc.yandex.com/sync_cookie_image_check	false	Avira URL Cloud: safe	unknown
https://adxbid.info/tripodcomdynamic.js	false	Avira URL Cloud: safe	unknown
https://sync.go.sonobi.com/us.gif?nw=if&nuid=6da166a7-6bb2-4b00-b8a5-c1693c90cefc	false	Avira URL Cloud: safe	unknown
https://ap.lijit.com/pixel?redir=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DSOVRN%26ttl%3D720%26uid%3D4b30a0b1f289a261ab592e1e53c126eb%26visitor%3D%24UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	false	Avira URL Cloud: safe	unknown
https://ssp-rtb.sape.ru/rmatch?r=https%3A%2F%2Facint.net%2Frmatch%3Fdp%3D14%26euid%3D$%7BUSER_ID%7D%26r%3Dhttps%253A%252F%252Fan.yandex.ru%252Fmapuid%252Fsapeis%252F$%257BUSER_ID%257D&dp=14	false	Avira URL Cloud: safe	unknown
https://prebid.a-mo.net/cchain/0/688?gpp=&gdpr_consent=&gdpr=0&gpp_sid=&us_privacy=1YN-&A=9ea1b0fe-fc62-45a2-b34f-f87c9670dc1e&bidder=appnexus&cbx=aHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%3D&uid=3984632334688932657	false	Avira URL Cloud: safe	unknown
https://ssc-cms.33across.com/ps/?us_privacy=&ts=1722248057133.5&ri=2&ru=https%3A%2F%2Fssum-sec.casalemedia.com%2Fusermatchredir%3Fs%3D191740%26us_privacy%3D%24%7BUS_PRIVACY%7D%26cb%3Dhttps%253A%252F%252Fevents-ssc.33across.com%252Fmatch%253Fliv%253Dh%2526us_privacy%253D%24%7BUS_PRIVACY%7D%2526bidder_id%253D2%2526external_user_id%253D	false	Avira URL Cloud: safe	unknown
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fpx.owneriq.net%252Feucm%252Fp%252Fapndmp%253Foi%253D1%2526tid%253D%2524UID%2526redir%253Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D13%2526code%253D%28OIQ_UUID%29	false	Avira URL Cloud: safe	unknown
https://mwzeom.zeotap.com/mw?zpartnerid=1384&env=mWeb&gdpr=0&gdpr_consent=&cid=373F7418-6E87-44EC-B856-199C0BFB5420	false	Avira URL Cloud: safe	unknown
https://maxcdn.bootstrapcdn.com/font-awesome/4.6.3/css/font-awesome.min.css	false	Avira URL Cloud: safe	unknown
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202407230101/pubads_impl.js	false	Avira URL Cloud: safe	unknown
https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID	false	Avira URL Cloud: safe	unknown
https://onetag-sys.com/prebid-request	false	Avira URL Cloud: safe	unknown
https://id.a-mx.com/u?gdpr=0&gdpr_consent=&cb=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D9ea1b0fe-fc62-45a2-b34f-f87c9670dc1e%26bidder%3Damx_com%26uid%3D	false	Avira URL Cloud: safe	unknown
https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID&gdpr=0&gdpr_consent=	false	Avira URL Cloud: safe	unknown
https://cs.admanmedia.com/7df8d99918d2854384fc4c2d197ec3ff.gif?puid=ua-224dbbae-81e8-387f-873d-9929b1cbe964	false	Avira URL Cloud: safe	unknown
https://kimberlite.io/rtb/sync/yandex	false	Avira URL Cloud: safe	unknown
https://match.360yield.com/match?publisher_dsp_id=434&external_user_id=b5ec9328-f0ea-4599-80b5-4376f3e14697	false	Avira URL Cloud: safe	unknown
http://ha7jca.tripod.com/rajzok/prog/prog.htm	false	Avira URL Cloud: safe	unknown
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ssc-cms.33across.com/ps/?xi=44&ts=1722248058355.4&us_privacy=&xu=7556854650816705608	false	Avira URL Cloud: safe	unknown
https://uipus.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=373F7418-6E87-44EC-B856-199C0BFB5420&sInitiator=external&gdpr=0&gdpr_consent=	false	Avira URL Cloud: safe	unknown
https://sync.1rx.io/usersync/turn/7556854650816705608?dspret=1&gdpr=&gdpr_consent=&us_privacy=	false	Avira URL Cloud: safe	unknown
https://t.seedtag.com/t/1247-3790-01.js	false	Avira URL Cloud: safe	unknown
https://sync.dmp.otm-r.com/match/yandexortb?otcm_check=1722247972	false	Avira URL Cloud: safe	unknown
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LZ6U0YQG-1G-DUDF	false	Avira URL Cloud: safe	unknown
https://x.bidswitch.net/sync?ssp=the33across&us_privacy=	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3984632334688932657&gdpr=0&gdpr_consent=	false		unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Universal Radio Programmer.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\baaeea1e-790a-4e0a-8a24-6aaba8a7ada3.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240729101202Z-173.bmp

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3224

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Windows Analysis Report
Universal Radio Programmer.pdf

Name	Source	Malicious	Antivirus Detection	Reputation
https://ads.stickyadstv.com/user-matching?id=3663&gdpr=0&gdpr_consent=	chromecache_470.9.dr, chromecache_991.9.dr, chromecache_706.9.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://creatives.purpleads.io	chromecache_772.9.dr, chromecache_891.9.dr, chromecache_730.9.dr, chromecache_523.9.dr, chromecache_475.9.dr, chromecache_1035.9.dr, chromecache_970.9.dr, chromecache_1142.9.dr, chromecache_1040.9.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ssp.adriver.ru/cgi-bin/sync.cgi?dsp_id=153&external_id=0A00007F1E6BA766C65BDC8F0217B4B1&redi	chromecache_1055.9.dr	false	Avira URL Cloud: safe	unknown
https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZqdrdtHM6agAAEPGAGu6HgAA%263596&gpdr	chromecache_596.9.dr	false	Avira URL Cloud: safe	unknown
https://www.cloudflare.com/5xx-error-landing	chromecache_912.9.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/google/safevalues/issues	chromecache_1114.9.dr	false	Avira URL Cloud: safe	unknown
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156631&s=1180592&predirect=https%3A%2F%2Fu-ams	chromecache_879.9.dr, chromecache_487.9.dr, chromecache_692.9.dr, chromecache_511.9.dr	false	Avira URL Cloud: safe	unknown
https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D	chromecache_1137.9.dr, chromecache_592.9.dr	false	Avira URL Cloud: safe	unknown
https://cse.google.com/cse.js	chromecache_821.9.dr, chromecache_686.9.dr	false	Avira URL Cloud: safe	unknown
https://cdn.ampproject.org/rtv/$	chromecache_821.9.dr, chromecache_686.9.dr	false	Avira URL Cloud: safe	unknown
https://getbootstrap.com/)	chromecache_571.9.dr, chromecache_1072.9.dr, chromecache_1097.9.dr	false	URL Reputation: safe	unknown
https://goo.gl/pxwQGp)	chromecache_571.9.dr, chromecache_1072.9.dr	false	Avira URL Cloud: safe	unknown
https://ha7jca.tripod.com/rajzok/rajzok.htm	chromecache_885.9.dr	false	Avira URL Cloud: safe	unknown
https://exchange.buzzoola.com/cookiesync/dsp/sape-banner?uid=0A00007F1E6BA766C65BDC8F0217B4B1&url=ht	chromecache_1055.9.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
37.252.171.149	unknown	European Union	29990	ASN-APPNEXUS	false
91.228.74.200	unknown	United Kingdom	27281	QUANTCASTUS	false
54.208.66.233	k8s-kongow-generalp-4b9a3bfec6-974801183.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
185.89.210.153	ams3-ib.adnxs.com	Germany	29990	ASN-APPNEXUS	false
91.192.148.30	profile.ssp.rambler.ru	Russian Federation	42481	BEGUN-ASRU	false
18.65.39.17	unknown	United States	3	MIT-GATEWAYSUS	false
3.214.247.92	unknown	United States	14618	AMAZON-AESUS	false
185.89.210.20	unknown	Germany	29990	ASN-APPNEXUS	false
198.47.127.205	pug-ams-bc.pubmnet.com	United States	62713	AS-PUBMATICUS	false
52.18.24.88	rw-yieldmo-com-tf-362867385.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
37.252.171.53	unknown	European Union	29990	ASN-APPNEXUS	false
104.18.42.227	dssp-prod-cdn.nyc3.cdn.digitaloceanspaces.com	United States	13335	CLOUDFLARENETUS	false
70.42.32.223	nydc1.outbrain.org	United States	22075	AS-OUTBRAINUS	false
23.111.37.244	shopnetic.com	Russian Federation	7979	SERVERS-COMUS	false
195.209.109.18	ssp.adriver.ru	Russian Federation	52007	ADRIVER-ASRU	false
34.193.171.116	pxl.iqm.com	United States	14618	AMAZON-AESUS	false
107.178.254.65	pippio.com	United States	15169	GOOGLEUS	false
87.250.247.182	avatars.mds.yandex.net	Russian Federation	13238	YANDEXRU	false
116.202.236.172	unknown	Germany	24940	HETZNER-ASDE	false
87.250.247.183	unknown	Russian Federation	13238	YANDEXRU	false
172.67.138.13	unknown	United States	13335	CLOUDFLARENETUS	false
8.2.110.233	us-e.visiblemeasures.com	United States	46636	NATCOWEBUS	false
77.88.21.119	unknown	Russian Federation	13238	YANDEXRU	false
95.163.92.180	match.qtarget.tech	Russian Federation	12695	DINET-ASRU	false
195.209.108.55	ev.adriver.ru	Russian Federation	52007	ADRIVER-ASRU	false
18.202.69.168	unknown	United States	16509	AMAZON-02US	false
185.255.84.152	visitor-fra02.omnitagjs.com	France	200271	IGUANE-FR	false
185.255.84.153	unknown	France	200271	IGUANE-FR	false
216.58.206.34	unknown	United States	15169	GOOGLEUS	false
185.255.84.150	unknown	France	200271	IGUANE-FR	false
87.242.127.163	sync.rambler.ru	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
31.172.81.145	unknown	Germany	44066	DE-FIRSTCOLOwwwfirst-colonetDE	false
185.255.84.151	hb-api-fra02.omnitagjs.com	France	200271	IGUANE-FR	false
8.2.110.230	cs.visiblemeasures.com	United States	46636	NATCOWEBUS	false
208.93.169.131	am1-direct-bgp.contextweb.com	United States	26228	SERVEPATHUS	false
8.2.110.224	unknown	United States	46636	NATCOWEBUS	false
31.172.81.146	sync.bumlam.com	Germany	44066	DE-FIRSTCOLOwwwfirst-colonetDE	false
52.6.48.239	unknown	United States	14618	AMAZON-AESUS	false
185.89.210.46	unknown	Germany	29990	ASN-APPNEXUS	false
34.249.98.246	unknown	United States	16509	AMAZON-02US	false
178.250.1.8	bidder.nl3.vip.prod.criteo.com	France	44788	ASN-CRITEO-EUROPEFR	false
178.250.1.9	widget.nl3.vip.prod.criteo.com	France	44788	ASN-CRITEO-EUROPEFR	false
35.186.154.107	cm-supply-web.gammaplatform.com	United States	15169	GOOGLEUS	false
178.250.1.3	static.nl3.vip.prod.criteo.net	France	44788	ASN-CRITEO-EUROPEFR	false
63.33.136.60	unknown	United States	16509	AMAZON-02US	false
172.67.75.241	script.4dex.io	United States	13335	CLOUDFLARENETUS	false
185.65.149.228	5184382291722247965848.cm.a.mts.ru	Russian Federation	197068	QRATORRU	false
142.250.181.226	unknown	United States	15169	GOOGLEUS	false
34.102.163.6	ad.mrtnsvr.com	United States	15169	GOOGLEUS	false
104.26.9.169	unknown	United States	13335	CLOUDFLARENETUS	false
54.239.38.253	unknown	United States	16509	AMAZON-02US	false
46.228.174.117	sync.1rx.io	United Kingdom	56396	TURNGB	false
3.164.68.48	hb.360yield.com	United States	16509	AMAZON-02US	false
8.18.47.7	unknown	United States	32662	GMCRUS	false
93.158.134.119	unknown	Russian Federation	13238	YANDEXRU	false
63.33.23.71	euw-ice.360yield.com	United States	16509	AMAZON-02US	false
52.73.75.52	unknown	United States	14618	AMAZON-AESUS	false
54.194.174.82	unknown	United States	16509	AMAZON-02US	false
162.19.138.82	id5-sync.com	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
69.166.1.8	iad-2-apex.go.sonobi.com	United States	27630	AS-XFERNETUS	false
34.96.71.22	s.dsp-prod.demandbase.com	United States	15169	GOOGLEUS	false
119.63.193.220	i-api.popin.cc	Japan	38627	BAIDUJPBaiduIncJP	false
104.18.36.155	ssum.casalemedia.com	United States	13335	CLOUDFLARENETUS	false
54.38.113.4	pixel-eu.onaudience.com	France	16276	OVHFR	false
108.128.81.98	ds-pr-bh.ybp.gysm.yahoodns.net	United States	16509	AMAZON-02US	false
185.15.175.158	unknown	Russian Federation	43226	SAFEDATAUplinksRU	false
167.235.180.122	unknown	United States	3525	ALBERTSONSUS	false
172.217.16.194	unknown	United States	15169	GOOGLEUS	false
88.212.201.204	counter.yadro.ru	Russian Federation	39134	UNITEDNETRU	false
167.235.14.51	match.ohmy.bid	United States	3525	ALBERTSONSUS	false
34.117.239.71	cms-xch.33across.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
3.71.149.231	ats-eks.eu-central-1.dcs-online-targeting-prd.aws.oath.cloud	United States	16509	AMAZON-02US	false
67.202.105.23	unknown	United States	32748	STEADFASTUS	false
172.64.151.101	ssum-sec.casalemedia.com	United States	13335	CLOUDFLARENETUS	false
35.214.149.91	user-data-eu.bidswitch.net	United States	19527	GOOGLE-2US	false
188.72.107.228	unknown	Netherlands	196689	DIGICUBE01FR	false
54.38.113.5	pixel.onaudience.com	France	16276	OVHFR	false
185.89.210.82	unknown	Germany	29990	ASN-APPNEXUS	false
67.202.105.33	de.tynt.com	United States	32748	STEADFASTUS	false
67.202.105.31	hde.tynt.com	United States	32748	STEADFASTUS	false
18.245.46.117	dckrl2e5yf7xg.cloudfront.net	United States	16509	AMAZON-02US	false
147.75.85.97	unknown	Switzerland	54825	PACKETUS	false
3.232.50.41	um4.eqads.com	United States	14618	AMAZON-AESUS	false
35.186.193.173	ipac.ctnsnet.com	United States	15169	GOOGLEUS	false
8.2.110.134	cs.krushmedia.com	United States	46636	NATCOWEBUS	false
77.88.21.179	ads.adfox.ru	Russian Federation	13238	YANDEXRU	false
34.254.110.245	unknown	United States	16509	AMAZON-02US	false
193.3.184.140	acint.net	Denmark	2107	ARNES-NETAcademicandResearchNetworkofSloveniaSI	false
54.201.37.2	unknown	United States	16509	AMAZON-02US	false
185.83.71.234	sync-unosync-com.geodns.me	United Kingdom	55081	24SHELLSUS	false
52.30.31.41	unknown	United States	16509	AMAZON-02US	false
104.26.3.51	unknown	United States	13335	CLOUDFLARENETUS	false
77.243.51.122	uip.semasio.net	Denmark	42697	NETIC-ASDK	false
3.124.210.90	unknown	United States	16509	AMAZON-02US	false
64.202.112.255	unknown	United States	22075	AS-OUTBRAINUS	false
35.163.86.181	unknown	United States	16509	AMAZON-02US	false
35.214.213.96	envoy-hl.envoy-csync1.core-b8mf.ov1o.com	United States	19527	GOOGLE-2US	false
158.160.128.78	sync.programmatica.com	Venezuela	721	DNIC-ASBLK-00721-00726US	false
95.163.41.56	r.mail.ru	Russian Federation	21051	NIVAL-ASRU	false
18.202.12.177	unknown	United States	16509	AMAZON-02US	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483943
Start date and time:	2024-07-29 12:11:02 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Universal Radio Programmer.pdf
Detection:	MAL
Classification:	mal48.phis.winPDF@142/1257@1275/100
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Browse: http://www.ultra.renet.ru/ Browse: http://www.cqham.ru/index.html Browse: http://www.cqham.ru/cons.htm Browse: http://www.cqham.ru/sch.htm Close Viewer Browse: http://www.pinouts.ru/data/siemens_c25_s25_pinout.shtml Browse: http://www.cqham.ru/IN/uniprog2/image3/uniprog600.gif Browse: http://ha7jca.tripod.com/rajzok/prog/prog.htm Browse: http://kom-inform.euro.ru/eindex.html

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
37.252.171.149	https://new-sneww-online-nowz-all.azurewebsites.net/?referrer=appmetrica_tracking_id%3D173005530304969909%26ym_tracking_id%3D10094745761516744100	Get hash	malicious	Unknown	Browse
	reference usfinancegl@ey.com - Search.pdf	Get hash	malicious	Unknown	Browse
	Remittance advice.htm	Get hash	malicious	Unknown	Browse
	https://na3.docusign.net/Signing/EmailStart.aspx?a=d12aabf1-0919-4f4f-92ab-0ff30b7ce84c&acct=88aa9bf9-9255-4306-b6d1-c7e74d5a654b&er=23711531-a6e1-4fe3-b437-430c24a72d79	Get hash	malicious	Unknown	Browse
	https://helps-org---metamskk.gitbook.io/us	Get hash	malicious	Unknown	Browse
	https://home-io-metaiumsk.gitbook.io/	Get hash	malicious	Unknown	Browse
	http://newer-ltd.weeblysite.com/	Get hash	malicious	Unknown	Browse
	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse
	https://forms.office.com/r/iNrLDTEJvm	Get hash	malicious	HTMLPhisher	Browse
	Magmutual-Contractual-Agreement-usqe-276342429-.docx	Get hash	malicious	HTMLPhisher	Browse
18.65.39.17	https://www.myreniwn.com	Get hash	malicious	Unknown	Browse
18.65.39.17	https://app.pipefy.com/public/form/Nw9Gu0rW	Get hash	malicious	Unknown	Browse
91.228.74.200	https://misionerosdigitales.com/2024/07/sabado-mariano-su-misericordia-se-extiende-de-generacion-en-generacion-lucas-150/	Get hash	malicious	Unknown	Browse
	Endermanch@MEMZ.exe	Get hash	malicious	Bdaejec, KillMBR	Browse
	https://forms.office.com/r/tV6LkCsNt1	Get hash	malicious	Unknown	Browse
	http://www.agrimarkeurope.com	Get hash	malicious	Unknown	Browse
	https://ctfoodshare.org	Get hash	malicious	HTMLPhisher	Browse
	http://site.foodshare.org/site/DocServer	Get hash	malicious	HTMLPhisher	Browse
	http://internet-explorer.amic-group.com/	Get hash	malicious	Unknown	Browse
	Faraday Pharmaceuticals Mid-year Benefits.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://ury.io/aVPeBa	Get hash	malicious	Unknown	Browse
	Hilcorp.pdf	Get hash	malicious	Unknown	Browse
185.89.210.153	https://help-add-metamask.gitbook.io/us	Get hash	malicious	Unknown	Browse
	https://riprogramma.consegna.52-47-206-73.cprapid.com/brt/payment.php	Get hash	malicious	Unknown	Browse
	http://att-108796-103800.weeblysite.com/	Get hash	malicious	Unknown	Browse
	202407-082 Confirmation of Operational Status.pdf	Get hash	malicious	Unknown	Browse
	https://help--chomre-metaamsk.gitbook.io/us	Get hash	malicious	Unknown	Browse
	https://en-bridge-iotrezor.github.io/	Get hash	malicious	Unknown	Browse
	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse
	https://salina311.com/members/?token=h_GaNgO4fQTAPjvjdad1G8psA2lta2yp&action=signup-paid	Get hash	malicious	Unknown	Browse
	https://1drv.ms/o/s!AhamKbFAgjbffS1Sylq61px7DxI?e=AvRhOV	Get hash	malicious	SharepointPhisher	Browse
	https://u7161484.ct.sendgrid.net/ls/click?upn=u001.hSwgV93oKqJ8ZvQ-2F-2Bg69lRG3z5eH5AhV-2BJUjpvOnP47pFgt6vcHkzmMENxzqwp-2BRKeOD_zoLhCpkIy9Do8JtP-2BvPGbCKd-2BnnQhX22X7a9bdbWbCC5gFgFTIeDJ6cwijFzpwNISqmNkWsSGKxD-2FNSJjw0k1WplZHv6o0IxvsHmD61mU5ysV55-2B96DI72sCPsjm4NC818V0m0IM3im6ASY16u81LTenkvC-2FNvpnXD8McPjpGGauIb-2BM2U-2F5-2B1mP498QsMXa-2B6AhMNBfWHNfBJ5LHwc-2FEyMJR3z91eyiHhufIom4eLGOsOMu3-2Buvb1QWgf-2Fm28xUzJQB-2F0SFg3lJlq9Unc-2BGXVXdMHoo1zYap4ERXKPHz6fFTfg-2ByjNk2fx6gMZdF5wLdJ22iNNOIfJYnQmbrLKw8amK4pf2c0srhPNUjajemS3a0XAglQQfY-2FcnYJ8JCOteF8AXW7pHPGp1k6-2FUQvEbZwCojFrVmaSNpy4g9cIMi5Wb84VMjWDQkOvt1cLwqNYONTs-2FUB2VE3s9Hh05SQ7qgXlFKEeLNAjlDc8oLcdgcfk-3D	Get hash	malicious	Unknown	Browse
91.192.148.30	http://reg.ru	Get hash	malicious	Unknown	Browse
	https://forms.yandex.ru/u/627932c27f5dc1f454010238/	Get hash	malicious	Unknown	Browse
	6E422485A19C38E3D564D96B15FC2B0863AE9E17740BD.exe	Get hash	malicious	RedLine	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://webemail.logicals.shop/communications.html?part=CA_DOA@emfa.pt	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://www.budgetnurseries.com/gy14/	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://www.heisateam.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	vTvVBCXIft.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://kalendar.ai/chat/private/nFHKxJaKEo4/eSpgnzgyxqM?pos=invitation	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://qoinbasspirologgn.gitbook.io/us	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://pub-63ee9e97e9eb46d78c12a9137fdc4d90.r2.dev/invoice.htm	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	http://pub-02ac10a1721a429f979e5a85540d30d7.r2.dev/%EA%B0%90%EC%82%AC%EB%93%9C%EB%A6%BD%EB%8B%88%EB%8B%A4.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://pub-02289f87e8ce43fe8c47a86f49b0a533.r2.dev/index.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://pub-40cb77b4a6d84294bfa2db6a96f70ff7.r2.dev/index.html	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	https://intralinks.us.com/jacekz01kryszkI1AewI1Acz2APvpkgroupz01coq01	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.12.23.50
	https://lkbg.n8xgn.com/ezvywxcwkvjglxoqhisrftpfmvkqqmprsgq75133308774767774029645633685373bga6fuirhm29v8m737gwdag6xravohuci0?50929362866490568468084865226661334gf287z59ggexy6p9o9upzgyhpsg8vx7yb	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	https://krdm.dearportal.com/invitation/595ea59f-d577-4724-a21a-0126879bb23e	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	http://www.caixaenginyers-es.com	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	https://secure-mail.web.magnetonics.com/XUllTRHJGOVVJZENWUklMeGZHYXBiUmxXc09qRFE5ays2QTdyNWpxVXlrK1A1U01sMlZoQVJVa2VCdkxxT01LKzcwME52UnBTT2YyOURQSWtFTG83ZjE5cTQ3TmlzZ251MkZvOVdYSEhGdTMwRi8ya0pVWEtSVlJFY3l5aXlCZWFuTVdGUmhsWXExZ2lndU91b3VFSTRUcjZ6TGFnYnJmam93TE1FQjhMTXJZMmNFUkhWOHBnU1p0ZS0tSTQzNklvMC9taUdZQWd4Ri0tc292ckZ2YnZMakx3UmROWG1yU2hLQT09?cid=2133891312	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.12.23.50
	https://oprcrechedemeru.bubbleapps.io/version-test/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	https://webemail.logicals.shop/communications.html?part=CA_DOA@emfa.pt	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	https://intuicent.com/3iv174f38/#https://accounts.intuit.com/app/secure/sign-in?app_group=Identity&asset_alias=Intuit.cto.iam.ius&redirect_uri=https%3A%2F%2Faccounts.intuit.com%2Fapp%2Faccount%2Foverview&c=E,1,UGGgT3sfOoC5chZlvzIL8xPpV9pseAaUR1NnnKtA9KgQuk5p3wkbSy30EXJMQfZzJfr0LGOD4an5YsArAlBIZ9iYCxroz0rFWhCF88EH&typo=1	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	https://url.de.m.mimecastprotect.com/s/qVqbCGRLg7CyG6cKfytqsyqG?domain=sway.cloud.microsoft	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	https://immenseoriententerprise.com	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2422161712587085
Encrypted:	false
SSDEEP:	6:BMcWMq2P92nKuAl9OmbnIFUt84MctZZmw+4MctzkwO92nKuAl9OmbjLJ:qMv4HAahFUt8cZ/+cz5LHAaSJ
MD5:	70451FDF5611713B29D0B7D6A9B3EED4
SHA1:	49F9A5EE85566561455D7743A0F40940AB5CB657
SHA-256:	BCA925AE62889F7B6AF1C9AA1CA79FA88ECDC99642C53C82DA65F071F864592B
SHA-512:	6592DC4B6ADEF21C2CF3DABE89194D35562720199A6D6690104ECA51BB52713167019584D789E6BF02B1E072FB95B9FC5D1CEA7943B8DEEB17E5713BB9C00F6F
Malicious:	false
Reputation:	low
Preview:	2024/07/29-06:11:57.456 1974 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/07/29-06:11:57.460 1974 Recovering log #3.2024/07/29-06:11:57.460 1974 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jul 29 09:12:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.986823197540182
Encrypted:	false
SSDEEP:	48:8sdQTU8fcHnidAKZdA19ehwiZUklqehekJy+3:8Dvfs/Yy
MD5:	682AFE148DF882B6B7BE470F67EC573C
SHA1:	255934C41449A7B64A9759FA427E4C1525A27E1F
SHA-256:	DC3C942EE11A58D3533874537E07DF3B28016A447E960A557A4E124F94AA6654
SHA-512:	DE2D10A3320F0BE104F93F01C88A49E5D413ED68F47B7047868A6EB9D84C25B46617023784AE3B90E67A6A3A1F33476BE7665B9B5B0146B8E86F97E03D5406BE
Malicious:	false
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X}Q....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.Q....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.Q....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.Q..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.Q...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............:.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	PDF document, version 1.6, 0 pages
Entropy (8bit):	7.9035114473654255
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Universal Radio Programmer.pdf
File size:	230'130 bytes
MD5:	d1b2cbd6f3bff6e8f4b269e0b23a38b4
SHA1:	600c0b25196c9491b9a6f6bf4ec6da968f73cdfd
SHA256:	55aaaf427722b9e94ad226ecf4079f0c1b36a13409c1a856765c52686cf8dd39
SHA512:	2187c362f62da8987bf2d0d56d0239da868d61e63939235c2cccbb43e30b70e2b31f7c4f11438d42811ed0353a090dad194d3bcb170d0d263a310e71f7ab6be4
SSDEEP:	6144:OPvzurdQqXBp/tgbkYFZ5DRdEkY6GM4Kr:OPrumaBp/tYP5skY6GMPr
TLSH:	1D24E1A8C4866CFCF087D3F66376BC65050DB387D8C408A7B66C0A814B51FCD5E6A697
File Content Preview:	%PDF-1.6.%......82 0 obj <</Linearized 1/L 230130/O 85/E 117223/N 2/T 228443/H [ 2256 320]>>.endobj. ..xref..82 98..0000000016 00000 n..0000002576 00000 n..0000002683 00000 n..0000002724 00000 n..0000003473 00000 n..0000003546 00000 n..000000

General
Header:	%PDF-1.6
Total Entropy:	7.903511
Total Bytes:	230130
Stream Entropy:	7.980739
Stream Bytes:	205312
Entropy outside Streams:	5.143271
Bytes outside Streams:	24818
Number of EOF found:	2
Bytes after EOF:

Name	Count
obj	179
endobj	179
stream	45
endstream	45
xref	2
trailer	2
startxref	2
/Page	2
/Encrypt	0
/ObjStm	0
/URI	16
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0