Edit tour

Windows Analysis Report
Customer forms.pdf

Overview

General Information

Sample name:	Customer forms.pdf
Analysis ID:	1558808
MD5:	d2b0cea861dc25604597d81e97b1cdfa
SHA1:	037cceee86448c81b7f3e17048cacbeeb4ae9f6e
SHA256:	79f9e47974cd93da175cf816bf377472f4c86be2981ef2558381af4375e53382
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

HTML page contains obfuscated script src

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 6608 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Customer forms.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6980 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5736 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1556,i,10081857485962753476,11158937292355319089,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://ghcmechanicala3794.referralrock.com/l/GHC392/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8012 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2224,i,12846664628895839428,3145546052249127153,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1732044098052&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756

Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,KGZ1bmN0aW9uKHcsZCxzLGwsaSl7d1tsXT13W2xdfHxbXTt3W2xdLnB1c2goeydndG0uc3RhcnQnOgpuZXcgRGF0ZSgpLmdldFRpbWUoKSxldmVudDonZ3RtLmpzJ30pO3ZhciBmPWQuZ2V0RWxlbWVudHNCeVRhZ05hbWUocylbMF0sCmo9ZC5jcmVhdGVFbGVtZW50KHMpLGRsPWwhPSdkYXRhTG
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,ICh3aW5kb3cucmVmZXJyYWxKUyA/Pz0ge30pLnNjcmlwdENvbmZpZyA9IHsgcGFyYW1ldGVyczogeyBzcmM6ICIvL3JlZmVycmFscy5yZWZlcnJhbHJvY2suY29tL3Nkay9yZWZlcnJhbC5qcyIsIHRyYW5zYWN0aW9uS2V5OiAiOTJmYTMzZWQtNzQwMy00NWE0LWEzMGEtNjVhYzQ5ZDFlMmY3Ii
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,Ci8qISBsb2FkQ1NTIHJlbD1wcmVsb2FkIHBvbHlmaWxsLiBbY10yMDE3IEZpbGFtZW50IEdyb3VwLCBJbmMuIE1JVCBMaWNlbnNlICovCihmdW5jdGlvbih3KXsidXNlIHN0cmljdCI7aWYoIXcubG9hZENTUyl7dy5sb2FkQ1NTPWZ1bmN0aW9uKCl7fX0KdmFyIHJwPWxvYWRDU1MucmVscHJlbG
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CgkJCQljb25zdCBsYXp5bG9hZFJ1bk9ic2VydmVyID0gKCkgPT4gewoJCQkJCWNvbnN0IGxhenlsb2FkQmFja2dyb3VuZHMgPSBkb2N1bWVudC5xdWVyeVNlbGVjdG9yQWxsKCBgLmUtY29uLmUtcGFyZW50Om5vdCguZS1sYXp5bG9hZGVkKWAgKTsKCQkJCQljb25zdCBsYXp5bG9hZEJhY2tncm
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CiJ1c2Ugc3RyaWN0Ijt2YXIgX2NyZWF0ZUNsYXNzPWZ1bmN0aW9uKCl7ZnVuY3Rpb24gZGVmaW5lUHJvcGVydGllcyh0YXJnZXQscHJvcHMpe2Zvcih2YXIgaT0wO2k8cHJvcHMubGVuZ3RoO2krKyl7dmFyIGRlc2NyaXB0b3I9cHJvcHNbaV07ZGVzY3JpcHRvci5lbnVtZXJhYmxlPWRlc2NyaX
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CihmdW5jdGlvbigpIHsKInVzZSBzdHJpY3QiO3ZhciByPSJmdW5jdGlvbiI9PXR5cGVvZiBTeW1ib2wmJiJzeW1ib2wiPT10eXBlb2YgU3ltYm9sLml0ZXJhdG9yP2Z1bmN0aW9uKGUpe3JldHVybiB0eXBlb2YgZX06ZnVuY3Rpb24oZSl7cmV0dXJuIGUmJiJmdW5jdGlvbiI9PXR5cGVvZiBTeW
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CgkJdmFyIGVsZW1lbnRza2l0ID0gewoJCQlyZXN0dXJsOiAnaHR0cHM6Ly9yZWZlcnJhbHJvY2suY29tL3dwLWpzb24vZWxlbWVudHNraXQvdjEvJywKCQl9CgoJCQo=
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,KGZ1bmN0aW9uKHcsZCxzLGwsaSl7d1tsXT13W2xdfHxbXTt3W2xdLnB1c2goeydndG0uc3RhcnQnOgpuZXcgRGF0ZSgpLmdldFRpbWUoKSxldmVudDonZ3RtLmpzJ30pO3ZhciBmPWQuZ2V0RWxlbWVudHNCeVRhZ05hbWUocylbMF0sCmo9ZC5jcmVhdGVFbGVtZW50KHMpLGRsPWwhPSdkYXRhTG
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,ICh3aW5kb3cucmVmZXJyYWxKUyA/Pz0ge30pLnNjcmlwdENvbmZpZyA9IHsgcGFyYW1ldGVyczogeyBzcmM6ICIvL3JlZmVycmFscy5yZWZlcnJhbHJvY2suY29tL3Nkay9yZWZlcnJhbC5qcyIsIHRyYW5zYWN0aW9uS2V5OiAiOTJmYTMzZWQtNzQwMy00NWE0LWEzMGEtNjVhYzQ5ZDFlMmY3Ii
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,Ci8qISBsb2FkQ1NTIHJlbD1wcmVsb2FkIHBvbHlmaWxsLiBbY10yMDE3IEZpbGFtZW50IEdyb3VwLCBJbmMuIE1JVCBMaWNlbnNlICovCihmdW5jdGlvbih3KXsidXNlIHN0cmljdCI7aWYoIXcubG9hZENTUyl7dy5sb2FkQ1NTPWZ1bmN0aW9uKCl7fX0KdmFyIHJwPWxvYWRDU1MucmVscHJlbG
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CgkJCQljb25zdCBsYXp5bG9hZFJ1bk9ic2VydmVyID0gKCkgPT4gewoJCQkJCWNvbnN0IGxhenlsb2FkQmFja2dyb3VuZHMgPSBkb2N1bWVudC5xdWVyeVNlbGVjdG9yQWxsKCBgLmUtY29uLmUtcGFyZW50Om5vdCguZS1sYXp5bG9hZGVkKWAgKTsKCQkJCQljb25zdCBsYXp5bG9hZEJhY2tncm
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CiJ1c2Ugc3RyaWN0Ijt2YXIgX2NyZWF0ZUNsYXNzPWZ1bmN0aW9uKCl7ZnVuY3Rpb24gZGVmaW5lUHJvcGVydGllcyh0YXJnZXQscHJvcHMpe2Zvcih2YXIgaT0wO2k8cHJvcHMubGVuZ3RoO2krKyl7dmFyIGRlc2NyaXB0b3I9cHJvcHNbaV07ZGVzY3JpcHRvci5lbnVtZXJhYmxlPWRlc2NyaX
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CihmdW5jdGlvbigpIHsKInVzZSBzdHJpY3QiO3ZhciByPSJmdW5jdGlvbiI9PXR5cGVvZiBTeW1ib2wmJiJzeW1ib2wiPT10eXBlb2YgU3ltYm9sLml0ZXJhdG9yP2Z1bmN0aW9uKGUpe3JldHVybiB0eXBlb2YgZX06ZnVuY3Rpb24oZSl7cmV0dXJuIGUmJiJmdW5jdGlvbiI9PXR5cGVvZiBTeW
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CgkJdmFyIGVsZW1lbnRza2l0ID0gewoJCQlyZXN0dXJsOiAnaHR0cHM6Ly9yZWZlcnJhbHJvY2suY29tL3dwLWpzb24vZWxlbWVudHNraXQvdjEvJywKCQl9CgoJCQo=
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CndwLmkxOG4uc2V0TG9jYWxlRGF0YSggeyAndGV4dCBkaXJlY3Rpb25cdTAwMDRsdHInOiBbICdsdHInIF0gfSApOwo=
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CnZhciBFbGVtZW50b3JQcm9Gcm9udGVuZENvbmZpZyA9IHsiYWpheHVybCI6Imh0dHBzOlwvXC9yZWZlcnJhbHJvY2suY29tXC93cC1hZG1pblwvYWRtaW4tYWpheC5waHAiLCJub25jZSI6IjUwMGQ1YjI5NTQiLCJ1cmxzIjp7ImFzc2V0cyI6Imh0dHBzOlwvXC9yZWZlcnJhbHJvY2suY29tXC
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CnZhciBlbGVtZW50b3JGcm9udGVuZENvbmZpZyA9IHsiZW52aXJvbm1lbnRNb2RlIjp7ImVkaXQiOmZhbHNlLCJ3cFByZXZpZXciOmZhbHNlLCJpc1NjcmlwdERlYnVnIjpmYWxzZX0sImkxOG4iOnsic2hhcmVPbkZhY2Vib29rIjoiU2hhcmUgb24gRmFjZWJvb2siLCJzaGFyZU9uVHdpdHRlci
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,KGZ1bmN0aW9uKHcsZCxzLGwsaSl7d1tsXT13W2xdfHxbXTt3W2xdLnB1c2goeydndG0uc3RhcnQnOgpuZXcgRGF0ZSgpLmdldFRpbWUoKSxldmVudDonZ3RtLmpzJ30pO3ZhciBmPWQuZ2V0RWxlbWVudHNCeVRhZ05hbWUocylbMF0sCmo9ZC5jcmVhdGVFbGVtZW50KHMpLGRsPWwhPSdkYXRhTG
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,ICh3aW5kb3cucmVmZXJyYWxKUyA/Pz0ge30pLnNjcmlwdENvbmZpZyA9IHsgcGFyYW1ldGVyczogeyBzcmM6ICIvL3JlZmVycmFscy5yZWZlcnJhbHJvY2suY29tL3Nkay9yZWZlcnJhbC5qcyIsIHRyYW5zYWN0aW9uS2V5OiAiOTJmYTMzZWQtNzQwMy00NWE0LWEzMGEtNjVhYzQ5ZDFlMmY3Ii
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,Ci8qISBsb2FkQ1NTIHJlbD1wcmVsb2FkIHBvbHlmaWxsLiBbY10yMDE3IEZpbGFtZW50IEdyb3VwLCBJbmMuIE1JVCBMaWNlbnNlICovCihmdW5jdGlvbih3KXsidXNlIHN0cmljdCI7aWYoIXcubG9hZENTUyl7dy5sb2FkQ1NTPWZ1bmN0aW9uKCl7fX0KdmFyIHJwPWxvYWRDU1MucmVscHJlbG
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CgkJCQljb25zdCBsYXp5bG9hZFJ1bk9ic2VydmVyID0gKCkgPT4gewoJCQkJCWNvbnN0IGxhenlsb2FkQmFja2dyb3VuZHMgPSBkb2N1bWVudC5xdWVyeVNlbGVjdG9yQWxsKCBgLmUtY29uLmUtcGFyZW50Om5vdCguZS1sYXp5bG9hZGVkKWAgKTsKCQkJCQljb25zdCBsYXp5bG9hZEJhY2tncm
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CiJ1c2Ugc3RyaWN0Ijt2YXIgX2NyZWF0ZUNsYXNzPWZ1bmN0aW9uKCl7ZnVuY3Rpb24gZGVmaW5lUHJvcGVydGllcyh0YXJnZXQscHJvcHMpe2Zvcih2YXIgaT0wO2k8cHJvcHMubGVuZ3RoO2krKyl7dmFyIGRlc2NyaXB0b3I9cHJvcHNbaV07ZGVzY3JpcHRvci5lbnVtZXJhYmxlPWRlc2NyaX
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CihmdW5jdGlvbigpIHsKInVzZSBzdHJpY3QiO3ZhciByPSJmdW5jdGlvbiI9PXR5cGVvZiBTeW1ib2wmJiJzeW1ib2wiPT10eXBlb2YgU3ltYm9sLml0ZXJhdG9yP2Z1bmN0aW9uKGUpe3JldHVybiB0eXBlb2YgZX06ZnVuY3Rpb24oZSl7cmV0dXJuIGUmJiJmdW5jdGlvbiI9PXR5cGVvZiBTeW
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CgkJdmFyIGVsZW1lbnRza2l0ID0gewoJCQlyZXN0dXJsOiAnaHR0cHM6Ly9yZWZlcnJhbHJvY2suY29tL3dwLWpzb24vZWxlbWVudHNraXQvdjEvJywKCQl9CgoJCQo=
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CndwLmkxOG4uc2V0TG9jYWxlRGF0YSggeyAndGV4dCBkaXJlY3Rpb25cdTAwMDRsdHInOiBbICdsdHInIF0gfSApOwo=
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CnZhciBFbGVtZW50b3JQcm9Gcm9udGVuZENvbmZpZyA9IHsiYWpheHVybCI6Imh0dHBzOlwvXC9yZWZlcnJhbHJvY2suY29tXC93cC1hZG1pblwvYWRtaW4tYWpheC5waHAiLCJub25jZSI6IjUwMGQ1YjI5NTQiLCJ1cmxzIjp7ImFzc2V0cyI6Imh0dHBzOlwvXC9yZWZlcnJhbHJvY2suY29tXC
Source: https://referralrock.com/	HTTP Parser: Script src: data:text/javascript;base64,CnZhciBlbGVtZW50b3JGcm9udGVuZENvbmZpZyA9IHsiZW52aXJvbm1lbnRNb2RlIjp7ImVkaXQiOmZhbHNlLCJ3cFByZXZpZXciOmZhbHNlLCJpc1NjcmlwdERlYnVnIjpmYWxzZX0sImkxOG4iOnsic2hhcmVPbkZhY2Vib29rIjoiU2hhcmUgb24gRmFjZWJvb2siLCJzaGFyZU9uVHdpdHRlci

Source: https://ghcmechanicala3794.referralrock.com/l/GHC392/	HTTP Parser: No favicon
Source: https://ghcmechanicala3794.referralrock.com/l/GHC392/?RR_WCID=F36FF4C2-8544-463C-918A-038A1324146B&RR_WCID_TTL=396&REFERRALCODE=GHC392&utm_campaign=Referral+Program+%231	HTTP Parser: No favicon
Source: https://ghcmechanicala3794.referralrock.com/l/GHC392/?RR_WCID=F36FF4C2-8544-463C-918A-038A1324146B&RR_WCID_TTL=396&REFERRALCODE=GHC392&RR_WCID=F36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B&RR_WCID_TTL=396%2c396%2c396%2c396%2c396%2c396%2c396%2c396%2c396%2c396%2c396%2c396%2c396%2c396&REFERRALCODE=GHC392%2cGHC392%2cGHC392%2cGHC392%2cGHC392%2cGHC392%2cGHC392%2cGHC392%2cGHC392%2cGHC392%2cGHC392%2cGHC392%2cGHC392%2cGHC392&utm_campaign=Referral+Program+%231	HTTP Parser: No favicon
Source: https://ghcmechanicala3794.referralrock.com/l/GHC392/?RR_WCID=F36FF4C2-8544-463C-918A-038A1324146B&RR_WCID_TTL=396&REFERRALCODE=GHC392&RR_WCID=F36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A...	HTTP Parser: No favicon
Source: https://ghcmechanicala3794.referralrock.com/l/GHC392/?RR_WCID=F36FF4C2-8544-463C-918A-038A1324146B&RR_WCID_TTL=396&REFERRALCODE=GHC392&RR_WCID=F36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A-038A1324146B%2cF36FF4C2-8544-463C-918A...	HTTP Parser: No favicon
Source: https://i.referralrock.com/nosite/	HTTP Parser: No favicon
Source: https://referralrock.com/	HTTP Parser: No favicon
Source: https://referralrock.com/	HTTP Parser: No favicon
Source: https://referralrock.com/	HTTP Parser: No favicon
Source: https://referralrock.com/	HTTP Parser: No favicon
Source: https://referralrock.com/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50228 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 104.16.139.209 104.16.139.209
Source: Joe Sandbox View	IP Address: 169.150.247.39 169.150.247.39
Source: Joe Sandbox View	IP Address: 35.174.127.31 35.174.127.31

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: chromecache_581.9.dr, chromecache_507.9.dr	String found in binary or memory: <a class="elementor-icon elementor-social-icon elementor-social-icon-facebook elementor-repeater-item-12a98b7" href="https://www.facebook.com/referralrock/" target="_blank"> equals www.facebook.com (Facebook)
Source: chromecache_581.9.dr, chromecache_507.9.dr	String found in binary or memory: <a class="elementor-icon elementor-social-icon elementor-social-icon-linkedin elementor-repeater-item-928c8fc" href="https://www.linkedin.com/company/referral-rock" target="_blank"> equals www.linkedin.com (Linkedin)
Source: chromecache_526.9.dr, chromecache_533.9.dr, chromecache_675.9.dr, chromecache_552.9.dr, chromecache_630.9.dr, chromecache_475.9.dr, chromecache_664.9.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},Ak:function(){e=qb()},zd:function(){d()}}};var Zb=wa(["data-gtm-yt-inspected-"]),HD=["www.youtube.com","www.youtube-nocookie.com"],ID,JD=!1; equals www.youtube.com (Youtube)
Source: chromecache_526.9.dr, chromecache_533.9.dr, chromecache_675.9.dr, chromecache_552.9.dr, chromecache_630.9.dr, chromecache_475.9.dr, chromecache_664.9.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=nB(a,c,e);V(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return V(122),!0;if(d&&f){for(var m=Bb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},qB=function(){var a=[],b=function(c){return eb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_526.9.dr, chromecache_533.9.dr, chromecache_675.9.dr, chromecache_552.9.dr, chromecache_630.9.dr, chromecache_475.9.dr, chromecache_664.9.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={Dh:e,Bh:f,Ch:g,ji:k,ki:m,Re:n,Ib:b},q=B.YT;if(q)return q.ready&&q.ready(d),b;var r=B.onYouTubeIframeAPIReady;B.onYouTubeIframeAPIReady=function(){r&&r();d()};H(function(){for(var u=E.getElementsByTagName("script"),v=u.length,t=0;t<v;t++){var w=u[t].getAttribute("src");if(SD(w,"iframe_api")\|\|SD(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!JD&&QD(x[A],p.Re))return qc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_521.9.dr, chromecache_393.9.dr, chromecache_544.9.dr, chromecache_489.9.dr, chromecache_592.9.dr	String found in binary or memory: return b}FD.F="internal.enableAutoEventOnTimer";var Zb=wa(["data-gtm-yt-inspected-"]),HD=["www.youtube.com","www.youtube-nocookie.com"],ID,JD=!1; equals www.youtube.com (Youtube)
Source: chromecache_526.9.dr, chromecache_533.9.dr, chromecache_675.9.dr, chromecache_552.9.dr, chromecache_630.9.dr, chromecache_475.9.dr, chromecache_664.9.dr	String found in binary or memory: var UC=function(a,b,c,d,e){var f=LA("fsl",c?"nv.mwt":"mwt",0),g;g=c?LA("fsl","nv.ids",[]):LA("fsl","ids",[]);if(!g.length)return!0;var k=QA(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);V(121);if(m==="https://www.facebook.com/tr/")return V(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!wz(k,yz(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: ghcmechanicala3794.referralrock.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: i.referralrock.com
Source: global traffic	DNS traffic detected: DNS query: referralrock.com
Source: global traffic	DNS traffic detected: DNS query: referrals.referralrock.com
Source: global traffic	DNS traffic detected: DNS query: snap.licdn.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: js.hs-scripts.com
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: js.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: js.hs-analytics.net
Source: global traffic	DNS traffic detected: DNS query: js.hsadspixel.net
Source: global traffic	DNS traffic detected: DNS query: js.hs-banner.com
Source: global traffic	DNS traffic detected: DNS query: cta-service-cms2.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: api.hubapi.com
Source: global traffic	DNS traffic detected: DNS query: widget.intercom.io
Source: global traffic	DNS traffic detected: DNS query: track.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: a.optmstr.com
Source: global traffic	DNS traffic detected: DNS query: perf-na1.hsforms.com
Source: global traffic	DNS traffic detected: DNS query: a.omappapi.com
Source: global traffic	DNS traffic detected: DNS query: api.omappapi.com
Source: global traffic	DNS traffic detected: DNS query: js.intercomcdn.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: api-iam.intercom.io
Source: global traffic	DNS traffic detected: DNS query: nexus-websocket-a.intercom.io

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Customer forms.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1556,i,10081857485962753476,11158937292355319089,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://ghcmechanicala3794.referralrock.com/l/GHC392/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2224,i,12846664628895839428,3145546052249127153,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1556,i,10081857485962753476,11158937292355319089,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2224,i,12846664628895839428,3145546052249127153,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=AspN3mky9wCSa+L&MD=DRM3mb8E HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: Customer forms.pdf	Initial sample: PDF keyword /JS count = 0
Source: Customer forms.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A912fcz9z_1d6w2q0_3a8.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A912fcz9z_1d6w2q0_3a8.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://ghcmechanicala3794.referralrock.com/l/GHC392/	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://ghcmechanicala3794.referralrock.com/plugins/jquery-validation/jquery.validate.min.js	0%	Avira URL Cloud	safe
https://ghcmechanicala3794.referralrock.com/template/gridly/css/font-awesome.min.css	0%	Avira URL Cloud	safe
https://ampyfanclub.com/v2/6/register	0%	Avira URL Cloud	safe
https://ghcmechanicala3794.referralrock.com/ScriptResource.axd?d=Jw6tUGWnA15YEa3ai3FadIYhaCkNECXuI_S0itndMM_5t_LhV965bsNA9jBF6CsmMO9uJxByutMUxtLDucmr6WCIfZfo_pJjeeROOmP0a3Srft0dszPppsbWvryR7gmbj__g0PixSRLSPhfo9L2SXIbyktw1&t=583299c4	0%	Avira URL Cloud	safe
https://support.referralrock.com/	0%	Avira URL Cloud	safe
https://ghcmechanicala3794.referralrock.com/ScriptResource.axd?d=uHIkleVeDJf4xS50Krz-yHOS3hPA6ybfhPX1z8TRCPLaqbXD_a8LoODYEux6XRNgu89_tPFnPSj3woTiAVPL-9FeD6EPsRSvDUu6SRyUnGkMR50C7VkwOq6M-w1GHG6SLRXmSmnjhkkRlrRoJP0GSJHfkbw1&t=583299c4	0%	Avira URL Cloud	safe
https://ghcmechanicala3794.referralrock.com/l/GHC392/?RR_WCID=F36FF4C2-8544-463C-918A-038A1324146B&a	0%	Avira URL Cloud	safe
https://ghcmechanicala3794.referralrock.com/WebResource.axd?d=pynGkmcFUV13He1Qd6_TZAliHRFgQsTXIqQE7KlK2fBqRT1u9_ja4GufzFvcEGfboWAPdQ2&t=638562563416868089	0%	Avira URL Cloud	safe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Name	IP	Active	Malicious	Reputation
i.referralrock.com	20.75.106.146	true	false	unknown
js.hs-banner.com	104.18.40.240	true	false	high
widget.intercom.io	13.224.189.74	true	false	high
js.hubspot.com	104.16.117.116	true	false	high
cta-service-cms2.hubspot.com	104.16.117.116	true	false	high
js.hsadspixel.net	104.17.223.152	true	false	high
referralrock.com	157.245.80.197	true	false	high
js.hs-analytics.net	104.17.175.201	true	false	high
api-iam.intercom.io	3.216.187.236	true	false	high
omapp.b-cdn.net	169.150.247.39	true	false	high
api.omappapi.com	172.66.42.248	true	false	high
ghcmechanicala3794.referralrock.com	20.75.106.146	true	false	unknown
track.hubspot.com	104.16.117.116	true	false	high
googleads.g.doubleclick.net	142.250.185.98	true	false	high
js.hs-scripts.com	104.16.139.209	true	false	high
api.hubapi.com	104.18.242.108	true	false	high
www.google.com	142.250.185.196	true	false	high
td.doubleclick.net	142.250.184.226	true	false	high
nexus-websocket-a.intercom.io	35.174.127.31	true	false	high
referrals.referralrock.com	20.75.106.146	true	false	unknown
perf-na1.hsforms.com	104.18.80.204	true	false	high
js.intercomcdn.com	18.66.147.43	true	false	high
a.omappapi.com	unknown	unknown	false	high
x1.i.lencr.org	unknown	unknown	false	high
www.linkedin.com	unknown	unknown	false	high
a.optmstr.com	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
snap.licdn.com	unknown	unknown	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://secure.gravatar.com/avatar/41235158d0dc6abf9043b4e2a01e59c8?s=96&d=mm&r=g	chromecache_507.9.dr	false		high
https://referralrock.com/reward-management/	chromecache_507.9.dr	false		high
https://referralrock.com/wp-content/plugins/elementor-pro/assets/css/conditionals/transitions.min.cs	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://referralrock.com/wp-includes/js/imagesloaded.min.js?ver=5.0.0	chromecache_581.9.dr	false		high
https://referralrock.com/wp-content/plugins/elementor/assets/css/widget-nested-accordion.min.css?ver	chromecache_507.9.dr	false		high
https://referralrock.com/#website	chromecache_507.9.dr	false		high
https://referralrock.com/how-it-works/	chromecache_507.9.dr	false		high
https://ampcid.google.com/v1/publisher:getClientId	chromecache_503.9.dr, chromecache_468.9.dr	false		high
https://swiperjs.com	chromecache_420.9.dr, chromecache_553.9.dr	false		high
https://referralrock.com/login/	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://referralrock.com/integration/	chromecache_507.9.dr	false		high
https://referralrock.com/free-tools/random-code-generator/	chromecache_581.9.dr	false		high
https://js-na1.hs-scripts.com/2143373.js	chromecache_385.9.dr, chromecache_667.9.dr	false		high
https://github.com/cotton123236/CottonJS	chromecache_580.9.dr, chromecache_585.9.dr	false		high
https://referralrock.com/free-tools/referral-code-generator/	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://referralrock.com/integration/hubspot/	chromecache_507.9.dr	false		high
https://referralrock.com/trial/	chromecache_507.9.dr	false		high
https://referralrock.com/wp-content/cache/min/1/wp-content/plugins/elementor/assets/lib/eicons/css/e	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://referralrock.com/wp-content/cache/min/1/wp-content/plugins/elementskit/modules/mouse-cursor/	chromecache_507.9.dr	false		high
https://referralrock.com/free-tools/manual-referral-tracker/	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://www.google.com/pagead/1p-user-list/854681674/?random	chromecache_570.9.dr, chromecache_536.9.dr	false		high
https://twitter.com/ReferralRock	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://secure.gravatar.com/avatar/c6b00973ece9f37090ef370c8f31de98?s=96&d=mm&r=g	chromecache_581.9.dr	false		high
https://referralrock.com/privacy/	chromecache_507.9.dr	false		high
http://www.hubspot.com	chromecache_560.9.dr, chromecache_385.9.dr, chromecache_400.9.dr, chromecache_667.9.dr	false		high
https://jqueryui.com	chromecache_663.9.dr	false		high
https://referralrock.com/wp-content/plugins/elementor/assets/css/conditionals/shapes.min.css?ver=3.2	chromecache_507.9.dr	false		high
https://referralrock.com/pricing/engage/	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://js.hs-banner.com/v2	chromecache_560.9.dr, chromecache_400.9.dr	false		high
https://www.clarity.ms/tag/	chromecache_393.9.dr, chromecache_592.9.dr	false		high
https://twitter.com/ionicframework	chromecache_510.9.dr	false		high
https://fontawesome.com/license/free	chromecache_432.9.dr, chromecache_632.9.dr, chromecache_512.9.dr, chromecache_384.9.dr, chromecache_515.9.dr, chromecache_602.9.dr, chromecache_500.9.dr	false		high
https://referralrock.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Freferralrock.com%2F	chromecache_507.9.dr	false		high
https://referralrock.com/integration/typeform/	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://referralrock.com/wp-content/plugins/elementor-pro/assets/css/widget-call-to-action.min.css?v	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://referralrock.com/free-tools/coupon-code-generator/	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://referralrock.com	chromecache_507.9.dr	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.2.dr	false		high
https://referralrock.com/#webpage	chromecache_507.9.dr	false		high
https://referralrock.com/brand-ambassador-program/	chromecache_507.9.dr	false		high
https://referralrock.com/wp-content/plugins/elementor/assets/css/widget-text-editor.min.css?ver=3.25	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://support.referralrock.com/	chromecache_507.9.dr	false	Avira URL Cloud: safe	unknown
https://referralrock.com/wp-content/uploads/2020/04/Referral-Rock-Favicon-300x300.png	chromecache_507.9.dr	false		high
https://ampyfanclub.com/v2/6/register	chromecache_581.9.dr, chromecache_507.9.dr	false	Avira URL Cloud: safe	unknown
https://referralrock.com/author/jlogic/	chromecache_581.9.dr	false		high
http://ionicons.com/	chromecache_510.9.dr	false		high
http://jqueryvalidation.org/	chromecache_386.9.dr, chromecache_605.9.dr	false		high
https://referralrock.com/comments/feed/	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://referralrock.com/wp-content/cache/background-css/referralrock.com/wp-content/cache/min/1/wp-	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://ghcmechanicala3794.referralrock.com/l/GHC392/?RR_WCID=F36FF4C2-8544-463C-918A-038A1324146B&a	chromecache_488.9.dr, chromecache_496.9.dr, chromecache_425.9.dr, chromecache_433.9.dr, chromecache_571.9.dr, chromecache_660.9.dr, chromecache_653.9.dr, chromecache_404.9.dr, chromecache_444.9.dr, chromecache_556.9.dr, chromecache_530.9.dr, chromecache_501.9.dr, chromecache_574.9.dr, chromecache_657.9.dr, chromecache_654.9.dr, chromecache_458.9.dr, chromecache_680.9.dr, chromecache_601.9.dr, chromecache_617.9.dr, chromecache_476.9.dr, chromecache_564.9.dr	true	Avira URL Cloud: safe	unknown
https://referralrock.com/integrations/	chromecache_507.9.dr	false		high
https://referralrock.com/wp-content/cache/min/1/wp-content/plugins/elementskit-lite/modules/elements	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://referralrock.com/pricing/	chromecache_507.9.dr	false		high
https://adservice.google.com/pagead/regclk?	chromecache_592.9.dr	false		high
https://referralrock.com/wp-content/plugins/elementor-pro/assets/css/modules/sticky.min.css?ver=3.25	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://referralrock.com/customer-referral-program/?CTA=blogmenu	chromecache_581.9.dr, chromecache_507.9.dr	false		high
https://referralrock.com/wp-content/uploads/2024/01/1-start-testimonial-300x86.png	chromecache_507.9.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
104.16.139.209	js.hs-scripts.com	United States	13335	CLOUDFLARENETUS	false
169.150.247.39	omapp.b-cdn.net	United States	2711	SPIRITTEL-ASUS	false
35.174.127.31	nexus-websocket-a.intercom.io	United States	14618	AMAZON-AESUS	false
169.150.247.37	unknown	United States	2711	SPIRITTEL-ASUS	false
104.16.118.116	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.40.240	js.hs-banner.com	United States	13335	CLOUDFLARENETUS	false
142.250.184.226	td.doubleclick.net	United States	15169	GOOGLEUS	false
104.18.80.204	perf-na1.hsforms.com	United States	13335	CLOUDFLARENETUS	false
104.18.241.108	unknown	United States	13335	CLOUDFLARENETUS	false
3.216.187.236	api-iam.intercom.io	United States	14618	AMAZON-AESUS	false
172.217.18.4	unknown	United States	15169	GOOGLEUS	false
104.16.137.209	unknown	United States	13335	CLOUDFLARENETUS	false
104.17.175.201	js.hs-analytics.net	United States	13335	CLOUDFLARENETUS	false
104.78.188.188	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
157.245.80.197	referralrock.com	United States	14061	DIGITALOCEAN-ASNUS	false
104.18.242.108	api.hubapi.com	United States	13335	CLOUDFLARENETUS	false
18.66.147.43	js.intercomcdn.com	United States	3	MIT-GATEWAYSUS	false
18.66.147.49	unknown	United States	3	MIT-GATEWAYSUS	false
52.72.203.24	unknown	United States	14618	AMAZON-AESUS	false
172.64.147.16	unknown	United States	13335	CLOUDFLARENETUS	false
172.66.42.248	api.omappapi.com	United States	13335	CLOUDFLARENETUS	false
172.66.41.8	unknown	United States	13335	CLOUDFLARENETUS	false
13.224.189.74	widget.intercom.io	United States	16509	AMAZON-02US	false
20.75.106.146	i.referralrock.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.16.117.116	js.hubspot.com	United States	13335	CLOUDFLARENETUS	false
104.17.223.152	js.hsadspixel.net	United States	13335	CLOUDFLARENETUS	false
172.217.16.132	unknown	United States	15169	GOOGLEUS	false
142.250.185.98	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558808
Start date and time:	2024-11-19 20:20:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Customer forms.pdf
Detection:	MAL
Classification:	mal48.winPDF@41/565@110/31
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.16.139.209	https://share.hsforms.com/13Dqwfz0LRkK1qoBQuRdgjgsnbj9	Get hash	malicious	HTMLPhisher	Browse
	https://app.pandadoc.com/document/v2?token=4f650edf0fbe63c284330a0c3237efbdcb934f50?	Get hash	malicious	Unknown	Browse
	https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NkQZ0SJXHBh4xy1QJrAgdMgyCbgZWgRtkRFou0qT18YaHrZDQbzDb7_99rWaINkPrlzT0N-i15vjtunx_Nc993rcr7cH5Zt3O4TI80bLFGBkBXrNArVmFqSVAGENw14FwCtIRCuVihY1FBCxUvkvMYacM0x2FDzyjloQt34oiqpN_G0Hs3gjU9uPVBmcX7Lk3Fk7Il0ns7ETrrLeZwL3BTQFtCacfyDuNQX0H7qF9BeoMA2pyMNBf5HygF3aEMVlOCukaJBAUII5AqxaSyEiqRyBbZsSDmG6EyOabjVwA1BjRJWQflyVUniK2mNWwWrZOld8KoOLE0HM8SP31Aks8XnL92iWvXuuuHu8WX3umOTns1woNOpqMpzTmM0IdqJbvZsokucf-H2-rw8zN-_3t_9oIeXfrffbPaqYll_BvxrXGUzHeifzXy7uGhg1zQd59E4uj192kkv3bel-_j_kK--n6-b5t39DAAA__9AXKZY	Get hash	malicious	Unknown	Browse
	https://prezi.com/i/amopqalyrbyv/	Get hash	malicious	Unknown	Browse
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse
	https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NngTeRowYVzfBggLgr0jnYTDMmRw1imFIm2ET99YaDpZTcYzDf4_j-5YFTogaUxno5U6mNO7vBpPu8_Qjtn233vjPaHL2UbGDlhZQdGA3D25CwqECHxQCRtUKDBEqYowFBHIAzLTnKpBZet0FyIbh36NsUUZbSRWq6o0ZyOmIf1hCVhGuO6UGV5eawzRsIwkKvzidjgnmqdlkZtGukb6XGa_iBxPDbSv-k30p9lo3wdD1QatTUJJEohlFBchxhBckADPJi-N1FZ3iloNeeN8qyMNfc5Ys1judUQjU1gwK5EC2qllcEVWuSrLoChCMIK0bJx3mPJ19_Q6xTN6_Zu96Pc7y6XXfCBdt0HNrv0PBZaGs3DaTjQy2mYbupspnNefrFYvM3J35vc35X37_6zGK5f_2fVvaX7a1xVnPf0z2a5XZydZJdxPiwTRro9fX4wlOTmAb-lz_0effAv103-GQAA__9hXKLJ	Get hash	malicious	Unknown	Browse
	https://app.pandadoc.com/document/v2?token=a0bcffa175414e2b8694792c4d9ae865b20836dd?	Get hash	malicious	Unknown	Browse
	https://www.jasper.ai/	Get hash	malicious	Unknown	Browse
	https://email.email.pandadoc.net/c/eJxUkE9r4zwQxj-NdUuQR5ItHXQobfwG3rLQsmHbXspIGjeqE8m1FYfm0y-B7f65DcP8ht_zBOsa4XrNQvanI6XyGoPN-f7_7ilGN8iYdk8Pn-dxt_vOyNYtmMZwDpztLRpXK45GaGy9C943vK2NJgTDG-WQRQscZM1B1AJaztfS904pGYLuOTQtVZLTEeNhPWIKGLJfJyoszq9lQk_oDmTLdCJ2sPtSxrkSNxV0FXQ4jn8Qn48VdF_6FXQLVKIreaBUiTvSzgiJNQeJqLDhSoJpBAanJYFWrZO1kb6uRMdSLrGPHkvM6VqDaxuBBtpVCyBWEkW9wkbTCsko1-galQ4sT2-Y4uU39N85y5jEfDMn83C50P6beDlv2WTDe040V5K702Ggj9NhvKqziZY4_2J_iM3H6W67XV7Uop9j2dyq0D-yYr_S_TWuCk5v9M9mvl4sFtg5T8M8oqfrU_W4od1nvwdHIdy798HfDs_6ZwAAAP__1K2kLg	Get hash	malicious	Unknown	Browse
169.150.247.39	https://softworldenterprise.com	Get hash	malicious	Unknown	Browse	cdn.rawgit.com/michalsnik/aos/2.1.1/dist/aos.js
	http://cdn.bootcdn.net	Get hash	malicious	Unknown	Browse	cdn.bootcdn.net/
	PAYNOW_2023_08_002783pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.openlend.lat/aw8o/
	fjerbregners_patrol.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.openlend.lat/aw8o/?1NM6e=JwP18BaQn2gAMbwzAk/tzHq1rHqPkgowxzXz/N2AVg5llpqPoDBUT4Fbw9qJesVKC8w5QoNuWE8SYi183Rf2cdVRH8sDFcjA1Q==&P4=_n5TPHiTKZj
35.174.127.31	http://r.srvtrck.com/v1/redirect?url=http://www.ritual.com&api_key=2787b73d6d1c026b48687320e239182a&site_id=e5c21d0795544b439bdb70bae77167c9&type=url&yk_tag=973511c5431487e8a29276d8e592449d	Get hash	malicious	Unknown	Browse
	Metro Plastics Technologies.pdf	Get hash	malicious	Unknown	Browse
	https://www.filemail.com/t/cFCAI9C4	Get hash	malicious	HtmlDropper	Browse
	https://click.pstmrk.it/3s/app.markup.io%2Finvite%2Faccept%2FGAelUtD0/OI9N/z2q4AQ/AQ/914fb818-2548-4566-aa09-a2d85ddc613b/2/KJFV2S8Gzw	Get hash	malicious	Unknown	Browse
	https://gamma.app/docs/Access-Incoming-Fax-Document-yhm8n35mm598lhy	Get hash	malicious	HTMLPhisher	Browse
	attachment (15).eml	Get hash	malicious	Unknown	Browse
	http://fortcollinsfineart.com/	Get hash	malicious	Unknown	Browse
	http://uppholldbcloginn.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse
	http://coinbassewalletextensin.gitbook.io/us	Get hash	malicious	Unknown	Browse
	https://mmetmask-login.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
js.hubspot.com	http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cmwiO3M6NTA6Imh0dHA6Ly93d3cub2xkdmVyc2lvbi5jb20vd2luZG93cy9wZGZjcmVhdG9yLTEtNi0yIjtzOjQ6InBhc3MiO3M6MzI6IjMwYzExNzY3MTEwNWY3MjhjYjA0YzU2ZjkzYTc1YTRjIjt9	Get hash	malicious	Unknown	Browse	104.16.117.116
	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	Get hash	malicious	Unknown	Browse	104.16.118.116
	https://www.jasper.ai/	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://app.creatopy.com/share/d/qvnqyxdo8o7m	Get hash	malicious	Unknown	Browse	104.16.118.116
	https://app.creatopy.com/share/d/qvnqyxdo8o7m	Get hash	malicious	Unknown	Browse	104.16.118.116
	https://click.pstmrk.it/3s/app.markup.io%2Finvite%2Faccept%2FGAelUtD0/OI9N/z2q4AQ/AQ/914fb818-2548-4566-aa09-a2d85ddc613b/2/KJFV2S8Gzw	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://hy.markkasmick.click/cx/tbSgVco_akr35UznLBgMmL_dGwr4A9B_vyg2WwEB0w1LRjKjQMyEnB89mCfTRy8oqnbpdFunqinBhx0TsHvSJdUHnbksc3kdcKecoDvVHa5LAm46atMmRo3D2CHoEu2bmOqt4Ic8O_7AE7Igwgbi5c8zmZf6Fqp_XqcjREPr7609oL7vKm8FfjGLhMetr2oxtpR3ywH4BUElgc7EI7usxj8CJYEUMktwlb7YUzPvYQ7P1PilEV0LqiXI5sm6QVF4ZGl5TIXhnQLOG0kl6WQ0miiZysBfhaNojnPTUvisUUkwOp2fYTxkXEIhZ7ESJ7qXYLxQbmy4RJVeZZZ3RY5rX8W5t8cudSM9Zx7UaxgLH56aOv81v4QfUnzroT9v7LR3jPEjzYXr2LwuykYQnzvV6boWlogU4jkPE6MocRRlRoC6uUx2e1Wseo8MqGWTT2uXo4HbQDneiMF84sQ34*3TnbAxXWu8xLbb_mAOQxUTA3T5TUUZKeU3ziolM8TSVV5Y5LQTFGtNArddwJKdWCb_cLYMxUJpZ3cqM_A	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://all-seasons-custom-apparel.printavo.com/invoice/d737c3f58fce8a3f391367c903598233?preauth=eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE3Mjg5MzIwMTYsImlzcyI6NTgzNTkwNywidmVyIjoiY3VzdG9tZXItcHJlYXV0aC12MiIsInBheWFibGUiOiJnaWQ6Ly9wcmludGF2by9PcmRlci8xNjg1NjM0NiJ9.LtnCZuP7zuLtxrc0qbRVc6D_HBV5HHWCYKF01jdBqYuyRzcwCAYTob8CmMYRp7Sn00U104lhcfqDv7qsmGMnOH78EaGpveHtDYtxUOElE7wAp52mtirat1X6dyvgpRhT6-eDCGCiJGzxy-YKbE_aw8K9Fw7pCzHFK5Bt7nHyz1If3LLIeBwZbi0mQUn5emqAgeKnBMJ2XFzw5Q-DA83g9HgPpmp25RoTsyHIpHXM8qV9IeOjy_mBPVDrol9kKUE7ihWInuSSYMoe2wcHXsN_CYjRq-xL5WOOWElhHTzXUkVDNZjQiBTchiuo_h5Ozhh3KZ3eiTryy5PQBER3_8r08A	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://w7950.app.blinkops.com/	Get hash	malicious	Unknown	Browse	104.16.118.116
	https://krebsonsecurity.com/2024/10/patch-tuesday-october-2024-edition	Get hash	malicious	Unknown	Browse	104.16.118.116
cta-service-cms2.hubspot.com	http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cmwiO3M6NTA6Imh0dHA6Ly93d3cub2xkdmVyc2lvbi5jb20vd2luZG93cy9wZGZjcmVhdG9yLTEtNi0yIjtzOjQ6InBhc3MiO3M6MzI6IjMwYzExNzY3MTEwNWY3MjhjYjA0YzU2ZjkzYTc1YTRjIjt9	Get hash	malicious	Unknown	Browse	104.16.117.116
	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	Get hash	malicious	Unknown	Browse	104.16.118.116
	https://www.jasper.ai/	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://app.creatopy.com/share/d/qvnqyxdo8o7m	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://app.creatopy.com/share/d/qvnqyxdo8o7m	Get hash	malicious	Unknown	Browse	104.16.118.116
	https://click.pstmrk.it/3s/app.markup.io%2Finvite%2Faccept%2FGAelUtD0/OI9N/z2q4AQ/AQ/914fb818-2548-4566-aa09-a2d85ddc613b/2/KJFV2S8Gzw	Get hash	malicious	Unknown	Browse	104.16.118.116
	https://hy.markkasmick.click/cx/tbSgVco_akr35UznLBgMmL_dGwr4A9B_vyg2WwEB0w1LRjKjQMyEnB89mCfTRy8oqnbpdFunqinBhx0TsHvSJdUHnbksc3kdcKecoDvVHa5LAm46atMmRo3D2CHoEu2bmOqt4Ic8O_7AE7Igwgbi5c8zmZf6Fqp_XqcjREPr7609oL7vKm8FfjGLhMetr2oxtpR3ywH4BUElgc7EI7usxj8CJYEUMktwlb7YUzPvYQ7P1PilEV0LqiXI5sm6QVF4ZGl5TIXhnQLOG0kl6WQ0miiZysBfhaNojnPTUvisUUkwOp2fYTxkXEIhZ7ESJ7qXYLxQbmy4RJVeZZZ3RY5rX8W5t8cudSM9Zx7UaxgLH56aOv81v4QfUnzroT9v7LR3jPEjzYXr2LwuykYQnzvV6boWlogU4jkPE6MocRRlRoC6uUx2e1Wseo8MqGWTT2uXo4HbQDneiMF84sQ34*3TnbAxXWu8xLbb_mAOQxUTA3T5TUUZKeU3ziolM8TSVV5Y5LQTFGtNArddwJKdWCb_cLYMxUJpZ3cqM_A	Get hash	malicious	Unknown	Browse	104.16.118.116
	https://all-seasons-custom-apparel.printavo.com/invoice/d737c3f58fce8a3f391367c903598233?preauth=eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE3Mjg5MzIwMTYsImlzcyI6NTgzNTkwNywidmVyIjoiY3VzdG9tZXItcHJlYXV0aC12MiIsInBheWFibGUiOiJnaWQ6Ly9wcmludGF2by9PcmRlci8xNjg1NjM0NiJ9.LtnCZuP7zuLtxrc0qbRVc6D_HBV5HHWCYKF01jdBqYuyRzcwCAYTob8CmMYRp7Sn00U104lhcfqDv7qsmGMnOH78EaGpveHtDYtxUOElE7wAp52mtirat1X6dyvgpRhT6-eDCGCiJGzxy-YKbE_aw8K9Fw7pCzHFK5Bt7nHyz1If3LLIeBwZbi0mQUn5emqAgeKnBMJ2XFzw5Q-DA83g9HgPpmp25RoTsyHIpHXM8qV9IeOjy_mBPVDrol9kKUE7ihWInuSSYMoe2wcHXsN_CYjRq-xL5WOOWElhHTzXUkVDNZjQiBTchiuo_h5Ozhh3KZ3eiTryy5PQBER3_8r08A	Get hash	malicious	Unknown	Browse	104.16.118.116
	https://w7950.app.blinkops.com/	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://krebsonsecurity.com/2024/10/patch-tuesday-october-2024-edition	Get hash	malicious	Unknown	Browse	104.16.118.116
widget.intercom.io	https://c8xomn7ab.cc.rs6.net/tn.jsp?f=001LVQvk_7YGMcWprvUGCjyoykkCp5wsj2DKX8CUElfqYjNAvoS5Vd-FoEHrnd3AGZcf8f3Kd6dmfeZCczxcmiETtRnb4EnTEVYlXoJaEA2uf64zzO8fbti6TAFwQHs1Q8omZVdwNNZakzxOS8a5W4YqJAoYIuHuCkce-Ul-fbQwZ0UfmkYHzUplX5bS_-X-WyNWeQU7HCDMgG4XZHASzyAJeR7AZc5jC156EPBJkioL6BzJCdOTGrYX814oKjdfqOcW35Q3zB4wU1aaSL6FPboUZykpQ-LNnwsP0WVZJf01y6DIpppglNQqDQeO91p1Ne44DRTrHGEcejCarJ3cn1Nl8N3TyDM7S_gMZywKefkaK6SYy38CV034CSrzs9CkEnZ&c=KHlGYD5qU3P8m6I_urIKUmkQCtlv0cORXD7xvPRFENyMvP7E79oUuQ==&ch=EBM3LyxhXOxw9y73KY8hT9M-iba87ypk2JYwx4NOQOkzUWrRR7W-Aw==	Get hash	malicious	Unknown	Browse	13.224.189.49
	https://link.edgepilot.com/s/c156b169/ta1tculxp0_Kfe6FelE-EQ?u=https://links.milanote.com/uni/ls/click?upn=u001.qLX9yCzR-2FsrNCveODBYktWd2QtsYHwBxjMjZ1TpW-2F9ng461Vm3c5YVgExxI2qEfF60jol-2FeLhYaPK8GlBsUmEiH9efaYObnhs06BMhy-2BnV9K-2FT1g-2BgCKMoIt-2BOsQ5x4z-2B0jd2R9B6J6Sadj8ZwA99g-3D-3DzV7f_2FnvF7-2FWwP6dBMnZiJJg-2FVZ56wbflsjFmFKzNzxB08Wj-2Fx2CttPGn-2F5h8MyFIcdJ3ODQy7fgm-2Fr3OjYMY9in5osqXoDc6reOgljtfQ-2FAwX1sLvCIeep1RzAkMPXrYr3uVmoIw8PZdhvqLCdI70jOD-2FqfGw6aAi7pSSe7-2BoWoH3-2Bab0SJ6OHapEhzeh0Nb40hwQ5bj2ouQCGYGMQbw31NR2JjDQjIBAubwgu2SXWETns-3D	Get hash	malicious	Unknown	Browse	13.224.189.74
	http://r.srvtrck.com/v1/redirect?url=http://www.ritual.com&api_key=2787b73d6d1c026b48687320e239182a&site_id=e5c21d0795544b439bdb70bae77167c9&type=url&yk_tag=973511c5431487e8a29276d8e592449d	Get hash	malicious	Unknown	Browse	13.224.189.35
	Metro Plastics Technologies.pdf	Get hash	malicious	Unknown	Browse	13.224.189.74
	https://u47872954.ct.sendgrid.net/ls/click?upn=u001.fn1BsYIkFXRWxBLF12AvXhKUqktmOI7EPkchHYpa8lb2yJr9vm47Biq1iwhYH4x0W6E6_1tlZTUgFpToOJRvXeJjZ1lQQtiPaV281MW3UjMlmRxOXQrHf3E28Ct8cWw3pFJv8ww35QVlHVAsV9LrE8WJ-2FqWVvVFyUxLS7XbjE4ioBaNzI7Y9AQvglzmjEqljOvLuB-2FqyLAOnwfIZ8a2UOhb0kq4DsltFbCSVl8L5tTVcXPovhejZuw7J5gFYEuhvfLU6jp9IiI6bOp4vutoVple794Svog7VmNTHCQykEIajsBwvsIA9xBhrTaUhPe3riTZOj5RQVgP8LolzHF5ds6ImaI4Q1KNsmEF06CineSoPu7BKGd-2B4IINKzojAY3yUTkdWQLuCwDcmh7vK-2Fm4MQ0xAiPJ-2BNim16FZPVrX44e4DFM1rc1r1ZYN2APdeEIThalu0Ag-2BNzl5TCF9-2F-2B4cIgV-2B8ceF573hvcKOOmdD1jbxRbFryn-2FGT77SPyR6cNo7joqYajHU5-2F1gyPof24NnmOIwvhn7qKr0Ihz3SIWFLubPXV0GdcG6guT-2FBjwN6h83YPSF-2F5Pk0uzrf9DG4ZRnISsjJaazqmdBRAAsyoWwP5iXWDQEfiJXubX9fD-2BREtQifDIoI36c8qvCy5hrOP9aAfzd2djtg-2B8gR7MvgWYCa5sA7wAgdCKrrNRjX7eeAtG5StCtmRi-2BsSO4PCFgsA4QlR8AVRyhdPdKhSYzgA-2F1BCyYmRsFeWn4YzRn0mexGeZM3PwhHAdqlfom16LJGSiVeG98p5ZK5N-2BZQuMTlINorxwlmSmaGarY5x7TUyztB-2Bv8L8gRhXdcDKSzxiMknwYCjp3XaQdwr-2Fp8kePQSl33tJvX1ITAiP7FBhlwoPgNxbRoTwVzl0I2Q2bE71pQB2jeSQldBukVcgJT-2BrmpKQA1GW5-2B59frk-3D	Get hash	malicious	Unknown	Browse	13.32.110.22
	Metro Plastics Technologies.pdf	Get hash	malicious	Unknown	Browse	13.224.189.18
	https://www.jasper.ai/	Get hash	malicious	Unknown	Browse	13.224.189.18
	https://www.filemail.com/t/cFCAI9C4	Get hash	malicious	HtmlDropper	Browse	13.224.189.74
	https://click.pstmrk.it/3s/app.markup.io%2Finvite%2Faccept%2FGAelUtD0/OI9N/z2q4AQ/AQ/914fb818-2548-4566-aa09-a2d85ddc613b/2/KJFV2S8Gzw	Get hash	malicious	Unknown	Browse	13.224.189.74
	http://youutbe.com	Get hash	malicious	Unknown	Browse	13.224.189.74
i.referralrock.com	https://bottomlinesavings.referralrock.com/I/MICHAELANT27/	Get hash	malicious	Unknown	Browse	20.75.106.146
js.hs-banner.com	https://share.hsforms.com/13Dqwfz0LRkK1qoBQuRdgjgsnbj9	Get hash	malicious	HTMLPhisher	Browse	104.18.40.240
	http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cmwiO3M6NTA6Imh0dHA6Ly93d3cub2xkdmVyc2lvbi5jb20vd2luZG93cy9wZGZjcmVhdG9yLTEtNi0yIjtzOjQ6InBhc3MiO3M6MzI6IjMwYzExNzY3MTEwNWY3MjhjYjA0YzU2ZjkzYTc1YTRjIjt9	Get hash	malicious	Unknown	Browse	172.64.147.16
	https://app.pandadoc.com/document/v2?token=4f650edf0fbe63c284330a0c3237efbdcb934f50?	Get hash	malicious	Unknown	Browse	104.18.40.240
	https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NkQZ0SJXHBh4xy1QJrAgdMgyCbgZWgRtkRFou0qT18YaHrZDQbzDb7_99rWaINkPrlzT0N-i15vjtunx_Nc993rcr7cH5Zt3O4TI80bLFGBkBXrNArVmFqSVAGENw14FwCtIRCuVihY1FBCxUvkvMYacM0x2FDzyjloQt34oiqpN_G0Hs3gjU9uPVBmcX7Lk3Fk7Il0ns7ETrrLeZwL3BTQFtCacfyDuNQX0H7qF9BeoMA2pyMNBf5HygF3aEMVlOCukaJBAUII5AqxaSyEiqRyBbZsSDmG6EyOabjVwA1BjRJWQflyVUniK2mNWwWrZOld8KoOLE0HM8SP31Aks8XnL92iWvXuuuHu8WX3umOTns1woNOpqMpzTmM0IdqJbvZsokucf-H2-rw8zN-_3t_9oIeXfrffbPaqYll_BvxrXGUzHeifzXy7uGhg1zQd59E4uj192kkv3bel-_j_kK--n6-b5t39DAAA__9AXKZY	Get hash	malicious	Unknown	Browse	104.18.40.240
	https://app.pandadoc.com/document/v2?token=e9c21c3bf4f951c78573525553193377b2f4e89c?	Get hash	malicious	Unknown	Browse	172.64.147.16
	https://prezi.com/i/amopqalyrbyv/	Get hash	malicious	Unknown	Browse	172.64.147.16
	https://d5hSNQ04.na1.hubspotlinks.com/Ctc/Y+113/d5hSNQ04/MVMKCWs_LpLW6M2tMw6fYSwDW861hN75n1762N35KTC63lcq-W6N1vHY6lZ3lRW62lrqD8myJyRVc8h0P2j1zQcW2smXf07sb8RXW1bQ5YL303bx4W17Wz_f1r2klnW53gXLB5VXdRwW5CL5dg6hNVw4W20ByFV3r0jn1W3x17fK1t50D-W96VtSV53KsqXW1rw4B23Qm-qYW7cGbkn3R7Kw9VdqC2r69fTZfW4CW0VN2c8X3vW3Tz_VR32mfptN4ksQKthRqYsW6gWhJP2gWtpNW4QQ9By5QrsRFW287Blb2ggrvXW7Vr25s8w03LtW8Sw-dM5q1jvQN72qVs4-03zvf4sq2bd04	Get hash	malicious	Unknown	Browse	172.64.147.16
	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	Get hash	malicious	Unknown	Browse	104.18.40.240
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse	104.18.40.240
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse	104.18.40.240

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPIRITTEL-ASUS	https://whimsical.com/project-960-2024-doc-KUa9Z37ZsDmpPxB99pof8A	Get hash	malicious	Unknown	Browse	169.150.247.38
	https://recaptcha-checking-v3.b-cdn.net/verifyme.html	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	169.150.247.35
	https://uymtnxoiutrbebdxcfngvhbjnklijuygtfbrdxevfcgvhbjn.b-cdn.net/updatinggeneral004/index.html?b=Y3VzdG9tZXJzZXJ2aWNldGVhbUB3YWl0cm9zZS5jby51aw==	Get hash	malicious	Unknown	Browse	169.150.247.37
	https://uymtnxoiutrbebdxcfngvhbjnklijuygtfbrdxevfcgvhbjn.b-cdn.net/updatinggeneral004/index.html?b=Y3VzdG9tZXJzZXJ2aWNldGVhbUB3YWl0cm9zZS5jby51aw==	Get hash	malicious	Unknown	Browse	169.150.236.105
	https://shorturl.at/cQwea	Get hash	malicious	Unknown	Browse	169.150.247.39
	potentialthreat.ps1	Get hash	malicious	Unknown	Browse	169.150.247.38
	http://pumpfun.board-sol.com/	Get hash	malicious	Unknown	Browse	169.150.247.36
	https://klkl9.b-cdn.net/2.txt	Get hash	malicious	Unknown	Browse	169.150.247.37
	Setup.exe	Get hash	malicious	Unknown	Browse	169.150.255.181
	https://hacktools.sh/	Get hash	malicious	Unknown	Browse	169.150.247.39
CLOUDFLARENETUS	REPLY TO NOTICE GST DRC-1A_pdf.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://online-e.net/st-manager/click/track?id=795&type=raw&url=https://msc-mu.com/apikey-tyudqnhzdgevhdbasx/secure-redirect%23Darth.Vader%2BDeathStar.com&source_url=https%3A%2F%2Fonline-e.net%2Feven-if-even-though%2F&source_title=Even%20if%E3%81%A8Even%20though	Get hash	malicious	Unknown	Browse	104.17.25.14
	xaSPJNbl.ps1	Get hash	malicious	LummaC	Browse	172.67.75.40
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	http://user.ecomab.cc	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://trimmer.to:443/GWHMY	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Your_Bonus_Breakdown_2024.docx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Your_Bonus_Breakdown_2024.docx	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://hopp.bio/wchn	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://hmjpvx0wn1.gaimensebb.shop/	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
SPIRITTEL-ASUS	https://whimsical.com/project-960-2024-doc-KUa9Z37ZsDmpPxB99pof8A	Get hash	malicious	Unknown	Browse	169.150.247.38
	https://recaptcha-checking-v3.b-cdn.net/verifyme.html	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	169.150.247.35
	https://uymtnxoiutrbebdxcfngvhbjnklijuygtfbrdxevfcgvhbjn.b-cdn.net/updatinggeneral004/index.html?b=Y3VzdG9tZXJzZXJ2aWNldGVhbUB3YWl0cm9zZS5jby51aw==	Get hash	malicious	Unknown	Browse	169.150.247.37
	https://uymtnxoiutrbebdxcfngvhbjnklijuygtfbrdxevfcgvhbjn.b-cdn.net/updatinggeneral004/index.html?b=Y3VzdG9tZXJzZXJ2aWNldGVhbUB3YWl0cm9zZS5jby51aw==	Get hash	malicious	Unknown	Browse	169.150.236.105
	https://shorturl.at/cQwea	Get hash	malicious	Unknown	Browse	169.150.247.39
	potentialthreat.ps1	Get hash	malicious	Unknown	Browse	169.150.247.38
	http://pumpfun.board-sol.com/	Get hash	malicious	Unknown	Browse	169.150.247.36
	https://klkl9.b-cdn.net/2.txt	Get hash	malicious	Unknown	Browse	169.150.247.37
	Setup.exe	Get hash	malicious	Unknown	Browse	169.150.255.181
	https://hacktools.sh/	Get hash	malicious	Unknown	Browse	169.150.247.39
AMAZON-AESUS	https://brand.site/896562718995127961820892	Get hash	malicious	HTMLPhisher	Browse	52.71.213.57
	https://hopp.bio/wchn	Get hash	malicious	HTMLPhisher	Browse	44.198.1.203
	Benefit Enrollment -eGz8VNb.pdf	Get hash	malicious	Unknown	Browse	54.144.73.197
	b.pdf	Get hash	malicious	Unknown	Browse	54.144.73.197
	f5dc5302-022c-8bef-7a8e-e20ea821f59b.eml	Get hash	malicious	HTMLPhisher	Browse	52.5.13.197
	#U65b0#U7248#U7f51#U5173.exe	Get hash	malicious	Bdaejec, Neshta, Ramnit	Browse	44.221.84.105
	#U8865#U4e01#U6253#U5305.exe	Get hash	malicious	Bdaejec, Neshta, Ramnit	Browse	44.221.84.105
	#U65b0#U7248#U7f51#U5173Srv.exe	Get hash	malicious	Bdaejec, Neshta, Ramnit	Browse	44.221.84.105
	owari.mips.elf	Get hash	malicious	Unknown	Browse	44.194.145.154
	owari.sh4.elf	Get hash	malicious	Unknown	Browse	34.234.216.71

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	http://user.ecomab.cc	Get hash	malicious	Unknown	Browse	23.1.237.91
	217469812STM.pdf	Get hash	malicious	ScreenConnect Tool, Phisher	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	Remcos	Browse	23.1.237.91
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	http://eliztalks.com/js.php?device=windows&ip=MTk5LjE2OC41OC4xMTM=&refferer=aHR0cHM6Ly93d3cuc3JhbWFuYW1pdHJhLmNvbS8yMDI0LzExLzE2L3NjYWxpbmctdG8tNTAwbS1pbi1yZXZlbnVlLW1vZG1lZC1jZW8tZGFuaWVsLWNhbmUtcGFydC0yLw==&browser=Q2hyb21l&ua=bW96aWxsYS81LjAgKHdpbmRvd3MgbnQgMTAuMDsgd2luNjQ7IHg2NCkgYXBwbGV3ZWJraXQvNTM3LjM2IChraHRtbCwgbGlrZSBnZWNrbykgY2hyb21lLzEzMS4wLjAuMCBzYWZhcmkvNTM3LjM2&domain=aHR0cHM6Ly9lbGl6dGFsa3MuY29t&loc=VVM=&is_ajax=1	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	https://doc-zionsurgery.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://online-e.net/st-manager/click/track?id=795&type=raw&url=https://msc-mu.com/apikey-tyudqnhzdgevhdbasx/secure-redirect%23Darth.Vader%2BDeathStar.com&source_url=https%3A%2F%2Fonline-e.net%2Feven-if-even-though%2F&source_title=Even%20if%E3%81%A8Even%20though	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	http://user.ecomab.cc	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://brand.site/896562718995127961820892	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	Your_Bonus_Breakdown_2024.docx	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://hmjpvx0wn1.gaimensebb.shop/	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	Benefit Enrollment -eGz8VNb.pdf	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	http://52.113.191.172	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Customer forms.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2daa4d31-d853-4745-936e-1f2133d72fc7.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241119192158Z-172.bmp

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Windows Analysis Report
Customer forms.pdf

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.19655010902716
Encrypted:	false
SSDEEP:	6:HUfLc/dOq2P92nKuAl9OmbnIFUt8YUdXZZmw+YUdXzkwO92nKuAl9OmbjLJ:pOv4HAahFUt8jXZ/+jXz5LHAaSJ
MD5:	9523BD3A703C05024C57780C275C72A4
SHA1:	CB398FD4FB365D653CFDFDC07821CD82F3E8A68F
SHA-256:	8842A409FE75FB30D439DBE6949DA7951831DCA9CEE8DD36F8B3707720C0149F
SHA-512:	A9CCABB3EDED07642FBCB269556FA752F2DF4476BFA7F60E1300B5725D7DFCD64837CE66C36DE96067E7DC9A614A71A76457A3A5E7E73DF1E6A80E719B334CAE
Malicious:	false
Reputation:	low
Preview:	2024/11/19-14:21:53.991 264 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/19-14:21:54.023 264 Recovering log #3.2024/11/19-14:21:54.023 264 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 18:22:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.983168895980788
Encrypted:	false
SSDEEP:	48:8XMdejTq+2fH+idAKZdA19ehwiZUklqehTy+3:8NfPgy
MD5:	E3EFCB102075376143339C4181C18BBC
SHA1:	4F058857F4399B4C17A50FC0C3396CB232D91799
SHA-256:	1CDE685889159676A0AE58E3B1EB648E4A6AF7F2DAC0238A30310395B4122243
SHA-512:	63E8B1693CA74A29E26A9CAA176957BD6C31A7D522AA10C6E28F1AEFC274C847642291BA57BE731A42DDEEB400AB1E8C859D04A2EA1DF3CCB1FD960ACD1DD2CC
Malicious:	false
Preview:	L..................F.@.. ...$+.,....?vP[.:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IsY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............Z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	PDF document, version 1.5
Entropy (8bit):	7.982910809439862
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Customer forms.pdf
File size:	486'998 bytes
MD5:	d2b0cea861dc25604597d81e97b1cdfa
SHA1:	037cceee86448c81b7f3e17048cacbeeb4ae9f6e
SHA256:	79f9e47974cd93da175cf816bf377472f4c86be2981ef2558381af4375e53382
SHA512:	c299ee9586414d48fbe4ae902858ab4eb7546f6e0ee8f3852b4c6a6770a8f2d4ba6d39519829f067a7af66611ec2721f832fe722558c395e79256dbabe1c44a3
SSDEEP:	12288:d1/AJnpb3gNlFfD1TnpsCDzqD1zt6/5GfG71CCLxvCs7o:d1/0pClFfZlPqzc0fk5VKs7o
TLSH:	86A4239B61FAD18ACC8608F3E558AF0F63E942470820556A6C1993CB7A80EFC654E57F
File Content Preview:	%PDF-1.5.%.....2 0 obj.<<./Type /Catalog./Pages 4 0 R./AcroForm 5 0 R./Metadata 6 0 R.>>.endobj.6 0 obj.<<./Type /Metadata./Subtype /XML./Filter /FlateDecode./Length 445.>>.stream..x....n.0.....@.e.. $..z.Tu.LUWm.....(.C...W.E.i..CR.%.V.$.....9.8...!7.:.~

General
Header:	%PDF-1.5
Total Entropy:	7.982911
Total Bytes:	486998
Stream Entropy:	7.983804
Stream Bytes:	479957
Entropy outside Streams:	5.081016
Bytes outside Streams:	7041
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	59
endobj	59
stream	56
endstream	56
xref	0
trailer	0
startxref	1
/Page	0
/Encrypt	0
/ObjStm	2
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	1
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

ID	DHASH	MD5
119	0c7a9c9c9d4dcc80	8a1cfcebd2c2eafb8e72a0411c17ed13
120	1636120e179b08c5	0d85b61c5813be9316c999232463017d
121	801188acb55c4a5a	9b0f809617ab4733ad1a40b1f11822ee
122	00202995939b8280	d85de87a9e34f8cb1471a2f28fa0e8a5
138	0000000000000000	ce7124bc31c71af0b7bf238eb2b2317f

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 20:22:07.159399986 CET	192.168.2.5	1.1.1.1	0xdc0b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:22:20.668999910 CET	192.168.2.5	1.1.1.1	0x981b	Standard query (0)	ghcmechanicala3794.referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:22:21.585161924 CET	192.168.2.5	1.1.1.1	0x35e1	Standard query (0)	ghcmechanicala3794.referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:22:21.585372925 CET	192.168.2.5	1.1.1.1	0x1dd5	Standard query (0)	ghcmechanicala3794.referralrock.com	65	IN (0x0001)	false
Nov 19, 2024 20:22:23.729948997 CET	192.168.2.5	1.1.1.1	0x86b9	Standard query (0)	ghcmechanicala3794.referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:22:23.730170965 CET	192.168.2.5	1.1.1.1	0x43b0	Standard query (0)	ghcmechanicala3794.referralrock.com	65	IN (0x0001)	false
Nov 19, 2024 20:22:24.395220041 CET	192.168.2.5	1.1.1.1	0x4e69	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:22:24.395373106 CET	192.168.2.5	1.1.1.1	0x2157	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 19, 2024 20:22:37.028423071 CET	192.168.2.5	1.1.1.1	0xaa98	Standard query (0)	ghcmechanicala3794.referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:22:54.047254086 CET	192.168.2.5	1.1.1.1	0x26c4	Standard query (0)	ghcmechanicala3794.referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:23:06.349394083 CET	192.168.2.5	1.1.1.1	0x2933	Standard query (0)	i.referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:23:06.349550962 CET	192.168.2.5	1.1.1.1	0x89bb	Standard query (0)	i.referralrock.com	65	IN (0x0001)	false
Nov 19, 2024 20:23:09.697510958 CET	192.168.2.5	1.1.1.1	0x6eeb	Standard query (0)	i.referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:23:09.697750092 CET	192.168.2.5	1.1.1.1	0x1492	Standard query (0)	i.referralrock.com	65	IN (0x0001)	false
Nov 19, 2024 20:23:13.202307940 CET	192.168.2.5	1.1.1.1	0x2fed	Standard query (0)	ghcmechanicala3794.referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:23:33.140026093 CET	192.168.2.5	1.1.1.1	0xa762	Standard query (0)	ghcmechanicala3794.referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:04.140036106 CET	192.168.2.5	1.1.1.1	0x622c	Standard query (0)	ghcmechanicala3794.referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:40.087385893 CET	192.168.2.5	1.1.1.1	0xdc13	Standard query (0)	referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:40.091804981 CET	192.168.2.5	1.1.1.1	0x5f8c	Standard query (0)	referralrock.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:40.569240093 CET	192.168.2.5	1.1.1.1	0x3d7	Standard query (0)	referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:40.569430113 CET	192.168.2.5	1.1.1.1	0x78db	Standard query (0)	referralrock.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:42.241637945 CET	192.168.2.5	1.1.1.1	0xa8d	Standard query (0)	referrals.referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:42.241796970 CET	192.168.2.5	1.1.1.1	0x6ab0	Standard query (0)	referrals.referralrock.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:43.133821011 CET	192.168.2.5	1.1.1.1	0x537c	Standard query (0)	referrals.referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:43.134004116 CET	192.168.2.5	1.1.1.1	0x89b4	Standard query (0)	referrals.referralrock.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:43.891324997 CET	192.168.2.5	1.1.1.1	0x49df	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:43.891478062 CET	192.168.2.5	1.1.1.1	0x3e47	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:43.911576986 CET	192.168.2.5	1.1.1.1	0x5c6a	Standard query (0)	snap.licdn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:43.911722898 CET	192.168.2.5	1.1.1.1	0xb37a	Standard query (0)	snap.licdn.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:44.964009047 CET	192.168.2.5	1.1.1.1	0xd13	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:44.964143991 CET	192.168.2.5	1.1.1.1	0x691c	Standard query (0)	px.ads.linkedin.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:46.429677010 CET	192.168.2.5	1.1.1.1	0xb83d	Standard query (0)	js.hs-scripts.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:46.430026054 CET	192.168.2.5	1.1.1.1	0x8b9	Standard query (0)	js.hs-scripts.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:47.305452108 CET	192.168.2.5	1.1.1.1	0xf761	Standard query (0)	www.linkedin.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:47.305452108 CET	192.168.2.5	1.1.1.1	0x1af2	Standard query (0)	www.linkedin.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:47.374643087 CET	192.168.2.5	1.1.1.1	0xaae4	Standard query (0)	js.hubspot.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:47.375499010 CET	192.168.2.5	1.1.1.1	0x5433	Standard query (0)	js.hubspot.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:47.377821922 CET	192.168.2.5	1.1.1.1	0x5e77	Standard query (0)	js.hs-analytics.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:47.378469944 CET	192.168.2.5	1.1.1.1	0xf92	Standard query (0)	js.hs-analytics.net	65	IN (0x0001)	false
Nov 19, 2024 20:24:47.379823923 CET	192.168.2.5	1.1.1.1	0x954b	Standard query (0)	js.hsadspixel.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:47.380728960 CET	192.168.2.5	1.1.1.1	0x4724	Standard query (0)	js.hsadspixel.net	65	IN (0x0001)	false
Nov 19, 2024 20:24:47.381999969 CET	192.168.2.5	1.1.1.1	0x187a	Standard query (0)	js.hs-banner.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:47.382827997 CET	192.168.2.5	1.1.1.1	0xe8ba	Standard query (0)	js.hs-banner.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:47.683341026 CET	192.168.2.5	1.1.1.1	0xafdc	Standard query (0)	snap.licdn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:47.683543921 CET	192.168.2.5	1.1.1.1	0xced6	Standard query (0)	snap.licdn.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:47.744925976 CET	192.168.2.5	1.1.1.1	0x43ef	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:47.745213032 CET	192.168.2.5	1.1.1.1	0x57e9	Standard query (0)	px.ads.linkedin.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:47.746892929 CET	192.168.2.5	1.1.1.1	0x75f9	Standard query (0)	referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:47.747241974 CET	192.168.2.5	1.1.1.1	0xbb51	Standard query (0)	referralrock.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:47.792720079 CET	192.168.2.5	1.1.1.1	0xfb46	Standard query (0)	js.hs-scripts.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:47.792943001 CET	192.168.2.5	1.1.1.1	0xb0c0	Standard query (0)	js.hs-scripts.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:48.820147038 CET	192.168.2.5	1.1.1.1	0x1830	Standard query (0)	js.hs-scripts.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:48.820317984 CET	192.168.2.5	1.1.1.1	0xaeab	Standard query (0)	js.hs-scripts.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:49.018069983 CET	192.168.2.5	1.1.1.1	0xd644	Standard query (0)	js.hsadspixel.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:49.018208027 CET	192.168.2.5	1.1.1.1	0xd4a1	Standard query (0)	js.hsadspixel.net	65	IN (0x0001)	false
Nov 19, 2024 20:24:49.206686974 CET	192.168.2.5	1.1.1.1	0xc7aa	Standard query (0)	js.hs-banner.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:49.206829071 CET	192.168.2.5	1.1.1.1	0xa3a9	Standard query (0)	js.hs-banner.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:49.208199978 CET	192.168.2.5	1.1.1.1	0x2c4b	Standard query (0)	js.hubspot.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:49.208645105 CET	192.168.2.5	1.1.1.1	0x3cd1	Standard query (0)	js.hubspot.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:49.210946083 CET	192.168.2.5	1.1.1.1	0xf812	Standard query (0)	js.hs-analytics.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:49.211291075 CET	192.168.2.5	1.1.1.1	0x477c	Standard query (0)	js.hs-analytics.net	65	IN (0x0001)	false
Nov 19, 2024 20:24:51.001827002 CET	192.168.2.5	1.1.1.1	0xf9c3	Standard query (0)	ghcmechanicala3794.referralrock.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:51.663132906 CET	192.168.2.5	1.1.1.1	0xd7d2	Standard query (0)	cta-service-cms2.hubspot.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:51.663280010 CET	192.168.2.5	1.1.1.1	0xd2ac	Standard query (0)	cta-service-cms2.hubspot.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:51.668034077 CET	192.168.2.5	1.1.1.1	0xf989	Standard query (0)	api.hubapi.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:51.668293953 CET	192.168.2.5	1.1.1.1	0x57ce	Standard query (0)	api.hubapi.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:51.742594004 CET	192.168.2.5	1.1.1.1	0xbe56	Standard query (0)	widget.intercom.io	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:51.742769003 CET	192.168.2.5	1.1.1.1	0x25cb	Standard query (0)	widget.intercom.io	65	IN (0x0001)	false
Nov 19, 2024 20:24:51.757062912 CET	192.168.2.5	1.1.1.1	0xedf	Standard query (0)	track.hubspot.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:51.757230043 CET	192.168.2.5	1.1.1.1	0x338c	Standard query (0)	track.hubspot.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:51.769356966 CET	192.168.2.5	1.1.1.1	0x560c	Standard query (0)	a.optmstr.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:51.769613028 CET	192.168.2.5	1.1.1.1	0xf5f	Standard query (0)	a.optmstr.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:52.325359106 CET	192.168.2.5	1.1.1.1	0xd91d	Standard query (0)	cta-service-cms2.hubspot.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:52.325545073 CET	192.168.2.5	1.1.1.1	0x5208	Standard query (0)	cta-service-cms2.hubspot.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:52.325934887 CET	192.168.2.5	1.1.1.1	0xa09b	Standard query (0)	perf-na1.hsforms.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:52.326232910 CET	192.168.2.5	1.1.1.1	0x95cc	Standard query (0)	perf-na1.hsforms.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:52.337125063 CET	192.168.2.5	1.1.1.1	0xa89b	Standard query (0)	api.hubapi.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:52.337312937 CET	192.168.2.5	1.1.1.1	0xf085	Standard query (0)	api.hubapi.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:52.466561079 CET	192.168.2.5	1.1.1.1	0x6059	Standard query (0)	track.hubspot.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:52.466705084 CET	192.168.2.5	1.1.1.1	0x1ef7	Standard query (0)	track.hubspot.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:53.125890017 CET	192.168.2.5	1.1.1.1	0x15c2	Standard query (0)	a.omappapi.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:53.125890017 CET	192.168.2.5	1.1.1.1	0xe0d6	Standard query (0)	a.omappapi.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:53.126544952 CET	192.168.2.5	1.1.1.1	0x57dc	Standard query (0)	api.omappapi.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:53.129453897 CET	192.168.2.5	1.1.1.1	0x6f82	Standard query (0)	api.omappapi.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:53.129805088 CET	192.168.2.5	1.1.1.1	0x86d5	Standard query (0)	a.optmstr.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:53.130987883 CET	192.168.2.5	1.1.1.1	0xe48d	Standard query (0)	a.optmstr.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:53.197956085 CET	192.168.2.5	1.1.1.1	0x7eb4	Standard query (0)	perf-na1.hsforms.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:53.198642969 CET	192.168.2.5	1.1.1.1	0xecb	Standard query (0)	perf-na1.hsforms.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:53.635792971 CET	192.168.2.5	1.1.1.1	0x1300	Standard query (0)	js.intercomcdn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:53.635977030 CET	192.168.2.5	1.1.1.1	0xcbb3	Standard query (0)	js.intercomcdn.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:53.677860022 CET	192.168.2.5	1.1.1.1	0x582b	Standard query (0)	widget.intercom.io	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:53.678138971 CET	192.168.2.5	1.1.1.1	0x1558	Standard query (0)	widget.intercom.io	65	IN (0x0001)	false
Nov 19, 2024 20:24:53.880927086 CET	192.168.2.5	1.1.1.1	0xf945	Standard query (0)	api.omappapi.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:53.881268024 CET	192.168.2.5	1.1.1.1	0xd6fc	Standard query (0)	api.omappapi.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:53.940212011 CET	192.168.2.5	1.1.1.1	0x2837	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:53.940804958 CET	192.168.2.5	1.1.1.1	0xcb77	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Nov 19, 2024 20:24:53.953463078 CET	192.168.2.5	1.1.1.1	0x4a57	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:53.953602076 CET	192.168.2.5	1.1.1.1	0xff4a	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Nov 19, 2024 20:24:55.010978937 CET	192.168.2.5	1.1.1.1	0x6f19	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:55.011169910 CET	192.168.2.5	1.1.1.1	0x3a1f	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Nov 19, 2024 20:24:55.518913031 CET	192.168.2.5	1.1.1.1	0xdc33	Standard query (0)	js.intercomcdn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:55.519303083 CET	192.168.2.5	1.1.1.1	0x3102	Standard query (0)	js.intercomcdn.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:56.263674974 CET	192.168.2.5	1.1.1.1	0x69f8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:56.264071941 CET	192.168.2.5	1.1.1.1	0xa00b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 19, 2024 20:24:56.686824083 CET	192.168.2.5	1.1.1.1	0xc48d	Standard query (0)	api-iam.intercom.io	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:56.686979055 CET	192.168.2.5	1.1.1.1	0xab74	Standard query (0)	api-iam.intercom.io	65	IN (0x0001)	false
Nov 19, 2024 20:24:57.673290968 CET	192.168.2.5	1.1.1.1	0xc4f1	Standard query (0)	nexus-websocket-a.intercom.io	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:57.673702955 CET	192.168.2.5	1.1.1.1	0x1481	Standard query (0)	nexus-websocket-a.intercom.io	65	IN (0x0001)	false
Nov 19, 2024 20:24:57.735104084 CET	192.168.2.5	1.1.1.1	0x8f39	Standard query (0)	api-iam.intercom.io	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:24:57.735316992 CET	192.168.2.5	1.1.1.1	0x50f3	Standard query (0)	api-iam.intercom.io	65	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 20:24:40.117120028 CET	558	OUT	GET / HTTP/1.1 Host: referralrock.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _gid=GA1.2.192559957.1732044145; _ga=GA1.2.150044278.1732044142; _ga_WH1CQRV69D=GS1.1.1732044141.1.1.1732044187.0.0.0
Nov 19, 2024 20:24:40.565319061 CET	621	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 19 Nov 2024 19:24:40 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 408 Connection: keep-alive Location: https://referralrock.com/ Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 6d 61 72 67 69 6e 3a 20 32 30 70 78 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 68 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 6d 61 78 2d 77 69 64 74 68 3a 20 38 30 30 70 78 3b 7d 0a 20 20 20 20 2e 65 72 72 6f 72 20 7b 63 6f 6c 6f 72 3a 20 23 65 30 30 3b 7d 0a 20 20 20 20 70 72 65 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 7d 0a 20 20 20 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 38 70 78 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title><style> body {margin: 20px; font-family: helvetica, sans-serif; max-width: 800px;} .error {color: #e00;} pre {font-size: 16px;} h1 {font-size: 28px;}</style></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://referralrock.com/">here</a>.</p></body></html>

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:22:02 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-19 19:22:03 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=77002 Date: Tue, 19 Nov 2024 19:22:02 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:22:03 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-19 19:22:04 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=76961 Date: Tue, 19 Nov 2024 19:22:04 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-19 19:22:04 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}