Edit tour

Windows Analysis Report
Electronic Receipt for Carolann Campbell.pdf

Overview

General Information

Sample name:	Electronic Receipt for Carolann Campbell.pdf
Analysis ID:	1520602
MD5:	677f99c2bfd3de62e11ac90c44254fc8
SHA1:	0544869264904f703f52dc79b507a8594cfe4c44
SHA256:	f728d07cf9ee8f30fadd0c9e389cb1a4c1d94c03ec68fd976e917146aea33873
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected HtmlPhish44

Yara detected obfuscated html page

Detected suspicious crossdomain redirect

HTML page contains hidden javascript code

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7352 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Electronic Receipt for Carolann Campbell.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7568 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7764 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1704,i,521793384372817421,16056266662366640805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 1252 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://equable-toothpaste.surge.sh/3p71OSuGgCok6FO7ZFUhEbb2gK9ZxuYZxdl2y8HSfVs0EX73KA1HgLgJ27HZhYYVRvyXf0wdADRdJRXB50aRUURx9Hm30U2w0fTUESK7HdbXMKiz1Lr9qbxMGWIab3H6h21Ta7aoVRUAo0LiDrfvUQsQM5QvPwbYFfyuMm64auSaaWLktuJtAYtcI5O7E95y0ss MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5916 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2368,i,14601715867905608088,3878911157350375743,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
dropped/chromecache_1080	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security
dropped/chromecache_1080	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security
dropped/chromecache_778	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security
dropped/chromecache_778	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security
dropped/chromecache_879	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security
dropped/chromecache_879	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security
Click to see the 1 entries

HTTP traffic detected: POST /gen_204?s=webhp&t=cap&atyp=csi&ei=CsT2Zo-iIaySxc8Pn72EmA8&rt=wsrt.1050,cbs.108,cbt.961,hst.49&opi=89978449&ts=199973 HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.134"Content-Type: text/plain;charset=UTF-8sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.google.comX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cpG1uBhioZlQAbG3rEAfSdzgk7zObM74vAXRuoASQnD8mXc1KCgWQY; NID=517=0pWICYgHMs0q-7BzPo6KFxjDxz-SJgCVgj7jFPfXVbH6EjrjxWQ3Rl4lRdRUpk2LNOL2fdjvF93g43vXkJfqEPVF-u3r96lMxeDIRyymdIz_6oVDBsgJDwWab4ew6-xR-owJ_8OPa0nCoUm8CYc_2r0T-OcCst6msaOsdOwe2x5KU1dMUWSBSxX6OPpRIVWNLRI

Source: Yara match	File source: dropped/chromecache_1080, type: DROPPED
Source: Yara match	File source: dropped/chromecache_778, type: DROPPED
Source: Yara match	File source: dropped/chromecache_879, type: DROPPED

Source: https://sharedfiles2.github.io/feel1/	HTTP Parser: No favicon
Source: https://sharedfiles2.github.io/feel1/	HTTP Parser: No favicon
Source: https://google.com/404/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/imghp?hl=en&ogbl	HTTP Parser: No favicon
Source: https://www.google.com/imghp?hl=en&ogbl	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.7:49761 version: TLS 1.2

Source:	Binary string: h);if(b)return U.yield(_.Yt(a.getRoot().el(),{Ve:l,KK:!0,eA:new _.Nt("homeport_promo_banner",{priority:"x"})}),5);if(e===String(Number(2))&&f){if(g!==Number(0)){U.Fb(5);break}m=a.getRoot().el();q=_.pDb((p=m.id)!=null?p:"");A=(z=(u=q)==null?void 0:u.ck)!=null?z:"middleslothpp";return U.yield(_.Yt(a.getRoot().el(),{Ve:l,KK:!0,eA:new _.Nt(A,{priority:"x"})}),5)}return U.yield(_.Yt(a.getRoot().el(),{Ve:l,KK:!0}),5);case 5:_.bR(a.oa,"hpbarr");a.Va("Nll0ne").isEmpty()\|\|_.jf(a.w2a.document,_.WRD);_.vg(U, source: chromecache_1068.12.dr
Source:	Binary string: _.nDb=_.J("VOy8xe");_.oDb=_.J("s2IYHc");_.pDb=_.J("ucVTnf");_.qDb=_.J("pU3PWb"); source: chromecache_947.12.dr
Source:	Binary string: _.KDb=function(){var a=_.Jv;if(a.ka!==null)return a.ka;if(document.body){var b=_.Ql.N7(document.body).top;return a.ka=b}return 0};_.Jv=new _.Iv;_.Kv=function(a){_.Jv.WZa(a)};_.LDb=function(){return _.Jv.getScrollTop()};_.Lv=function(a,b){_.Jv.fixedUiScrollTo(a,b)};NDb=navigator.userAgent.match(/ GSA\/([.\d]+)/);MDb=NDb?NDb[1]:"";_.ODb=_.Vb&&_.pa(MDb,"4")>=0;_.PDb=_.Vb&&_.pa(MDb,"5.2")>=0;_.QDb=_.Vb&&_.pa(MDb,"4.3")>=0&&!(_.pa(MDb,"4.5")>=0); source: chromecache_947.12.dr
Source:	Binary string: _.pDb=function(a){var b;return(b=mDb)==null?void 0:b[a]};sDb=function(){qDb(rDb)};tDb=function(a){a.md!=null&&VCb(a.md,a.astyp);if(a.cb!=null){var b=!1,c=function(){b\|\|(b=!0,a.cb())};(0,_.Bn)(c,400);(0,_.Bn)(function(){google.caft(c)},50)}};uDb=function(a){if(a.md)VCb(a.md,a.astyp);else if(a.dr){var b=!1,c=function(){b\|\|(b=!0,a.dr())};(0,_.Bn)(c,400);(0,_.Bn)(function(){google.caft(c)},50)}};vDb=function(a){_.CUa?(0,google.jd.ms)():a.counter++}; source: chromecache_1068.12.dr

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: artzoya.com to https://google.com/404/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.google.com to https://recovertogether.withgoogle.com/?utm_source=hpp&utm_medium=referral&utm_campaign=recovertogether

Source: Joe Sandbox View	IP Address: 188.166.132.94 188.166.132.94
Source: Joe Sandbox View	IP Address: 185.199.110.153 185.199.110.153
Source: Joe Sandbox View	IP Address: 185.199.110.153 185.199.110.153
Source: Joe Sandbox View	IP Address: 104.78.188.188 104.78.188.188

Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246
Source: unknown	TCP traffic detected without corresponding DNS query: 18.207.85.246

Source: chromecache_487.12.dr	String found in binary or memory: href="https://www.youtube.com/?utm_source=about&utm_medium=referral&utm_campaign=footer-link" equals www.youtube.com (Youtube)
Source: chromecache_487.12.dr	String found in binary or memory: href="https://www.facebook.com/Google" equals www.facebook.com (Facebook)
Source: chromecache_487.12.dr	String found in binary or memory: href="https://www.linkedin.com/company/google" equals www.linkedin.com (Linkedin)
Source: chromecache_487.12.dr	String found in binary or memory: href="https://www.youtube.com/user/Google" equals www.youtube.com (Youtube)
Source: chromecache_487.12.dr	String found in binary or memory: data-g-cta_url="https://www.youtube.com/musicpremium"> equals www.youtube.com (Youtube)
Source: chromecache_487.12.dr	String found in binary or memory: data-g-cta_url="https://www.youtube.com/yt/about/"> equals www.youtube.com (Youtube)
Source: chromecache_487.12.dr	String found in binary or memory: href="https://www.youtube.com/musicpremium" equals www.youtube.com (Youtube)
Source: chromecache_487.12.dr	String found in binary or memory: href="https://www.youtube.com/yt/about/" equals www.youtube.com (Youtube)
Source: chromecache_487.12.dr	String found in binary or memory: data-g-cta_url="https://www.youtube.com/playlist?list=PLioTR_jPKuQ5etOIcRO9334FnOF4JsMZC" equals www.youtube.com (Youtube)
Source: chromecache_487.12.dr	String found in binary or memory: href="https://www.youtube.com/playlist?list=PLioTR_jPKuQ5etOIcRO9334FnOF4JsMZC" equals www.youtube.com (Youtube)
Source: chromecache_1192.12.dr	String found in binary or memory: L.getElementsByTagName("iframe"),la=S.length,na=0;na<la;na++)if(!u&&c(S[na],H.Ge)){hJ("https://www.youtube.com/iframe_api");u=!0;break}})}}else F(v.vtp_gtmOnSuccess)}var q=["www.youtube.com","www.youtube-nocookie.com"],r={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},t,u=!1;Z.__ytl=n;Z.__ytl.o="ytl";Z.__ytl.isVendorTemplate=!0;Z.__ytl.priorityOverride=0;Z.__ytl.isInfrastructure=!1; equals www.youtube.com (Youtube)
Source: chromecache_493.12.dr, chromecache_849.12.dr, chromecache_1192.12.dr	String found in binary or memory: Math.round(q);v["gtm.videoElapsedTime"]=Math.round(f);v["gtm.videoPercent"]=r;v["gtm.videoVisible"]=t;return v},Yj:function(){e=zb()},nd:function(){d()}}};var gc=ja(["data-gtm-yt-inspected-"]),FC=["www.youtube.com","www.youtube-nocookie.com"],GC,HC=!1; equals www.youtube.com (Youtube)
Source: chromecache_1139.12.dr	String found in binary or memory: function X(a,b){this.v={};this.playerInfo={};this.videoTitle="";this.j=this.g=null;this.h=0;this.m=!1;this.l=[];this.i=null;this.A={};this.options=null;if(!a)throw Error("YouTube player element ID required.");this.id=ra(this);b=Object.assign({title:"video player",videoId:"",width:640,height:360},b\|\|{});var c=document;if(a=typeof a==="string"?c.getElementById(a):a){W.yt_embedsEnableRsaforFromIframeApi&&vb();c=a.tagName.toLowerCase()==="iframe";b.host\|\|(b.host=c?ob(a.src):"https://www.youtube.com");this.options= equals www.youtube.com (Youtube)
Source: chromecache_1139.12.dr	String found in binary or memory: function vb(){var a=new tb,b=["https://www.youtube.com"];b=b===void 0?sb:b;pa(function(c){switch(c.g){case 1:return C(c,ub(),2);case 2:if(!c.m){c.g=3;break}return C(c,Promise.all(b.map(function(d){var g;return pa(function(k){if(k.g==1)return k.l=2,C(k,navigator.permissions.query({name:"top-level-storage-access",requestedOrigin:d}),4);k.g!=2?(g=k.m,g.state==="prompt"&&a.g.push(d),k.g=0,k.l=0):(k.l=0,k.i=null,k.g=0)})})),4); equals www.youtube.com (Youtube)
Source: chromecache_919.12.dr, chromecache_745.12.dr	String found in binary or memory: return b}DC.H="internal.enableAutoEventOnTimer";var gc=ja(["data-gtm-yt-inspected-"]),FC=["www.youtube.com","www.youtube-nocookie.com"],GC,HC=!1; equals www.youtube.com (Youtube)
Source: chromecache_741.12.dr	String found in binary or memory: var Ci=".story-carousel__text-inner",Di="story-carousel__text-inner--active",Fi=".glue-pagination-page-list",Bi="StoriesCarouselCtrl.model.currentPage",Ei="gluepaginationtotalpages",Ki="(min-width: 1024px)",Gi="(min-width: 0) and (max-width: 599px)",Hi="(min-width: 600px) and (max-width: 1023px)",Ji=15,Li=35;var Mi=angular.module("glueYtVideoService",[A.module.name]),Ni=Ka("https://www.youtube.com/iframe_api");function V(a,b){this.EventType={lc:"glue.ng.ytVideo.service.IframeApiInitalized"};this.i=a;this.j=b;this.Events={Sb:"glue.ng.ytVideo.service.IframeApiInitalized"};this.scriptLoaded=this.apiInitialized=!1;this.f={};this.apiInitialized\|\|Oi(this)}function Oi(a){a.j.onYouTubeIframeAPIReady=angular.bind(a,function(){this.apiInitialized=!0;this.i.$broadcast(this.EventType.lc,this)})} equals www.youtube.com (Youtube)
Source: chromecache_493.12.dr	String found in binary or memory: var SB=function(a,b,c,d,e){var f=Jz("fsl",c?"nv.mwt":"mwt",0),g;g=c?Jz("fsl","nv.ids",[]):Jz("fsl","ids",[]);if(!g.length)return!0;var k=Oz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);N(121);if(m==="https://www.facebook.com/tr/")return N(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!wy(k,yy(b, equals www.facebook.com (Facebook)
Source: chromecache_677.12.dr	String found in binary or memory: var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/b0557ce3\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}var YT;if(!window["YT"])YT={loading:0,loaded:0};var YTConfig;if(!window["YTConfig"])YTConfig={"host":"https://www.youtube.com"}; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: equable-toothpaste.surge.sh
Source: global traffic	DNS traffic detected: DNS query: sharedfiles2.github.io
Source: global traffic	DNS traffic detected: DNS query: pbs.twimg.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: tasty-library.surge.sh
Source: global traffic	DNS traffic detected: DNS query: artzoya.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: recovertogether.withgoogle.com
Source: global traffic	DNS traffic detected: DNS query: lh3.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: sustainability.google
Source: global traffic	DNS traffic detected: DNS query: www.blog.google
Source: global traffic	DNS traffic detected: DNS query: blog.google
Source: global traffic	DNS traffic detected: DNS query: googletagmanager.com
Source: global traffic	DNS traffic detected: DNS query: csp.withgoogle.com
Source: global traffic	DNS traffic detected: DNS query: mail.google.com
Source: global traffic	DNS traffic detected: DNS query: smallbusiness.withgoogle.com
Source: global traffic	DNS traffic detected: DNS query: survey.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: about.google

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Length: 9115Server: GitHub.comContent-Type: text/html; charset=utf-8permissions-policy: interest-cohort=()ETag: "66f42b03-239b"Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; img-src data:; connect-src 'self'X-GitHub-Request-Id: F6F5:1E472F:CAADD4:DCC49C:66F6C3F5Accept-Ranges: bytesAge: 0Date: Fri, 27 Sep 2024 14:40:53 GMTVia: 1.1 varnishX-Served-By: cache-ewr-kewr1740038-EWRX-Cache: MISSX-Cache-Hits: 0X-Timer: S1727448053.484068,VS0,VE16Vary: Accept-EncodingX-Fastly-Request-ID: 00e16721d9332e96212759a007ba433bbf6e0107
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1565Date: Fri, 27 Sep 2024 14:41:09 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cacheX-Frame-Options: SAMEORIGINX-XSS-Protection: 1; mode=blockX-Cloud-Trace-Context: 687cc8ea3c893752bef8e52ce6fdf324Date: Fri, 27 Sep 2024 14:43:02 GMTServer: Google FrontendContent-Length: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: Electronic Receipt for Carolann Campbell.pdf	Initial sample: PDF keyword /JS count = 0
Source: Electronic Receipt for Carolann Campbell.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source: Electronic Receipt for Carolann Campbell.pdf	Initial sample: \040\150\164\164\160\163\072\057\057\167\167\167\056\144\157\143\165\163\151\147\156\056\143\157\155\057\040\000
Source: Electronic Receipt for Carolann Campbell.pdf	Initial sample: \040\150\164\164\160\163\072\057\057\167\167\167\056\144\157\143\165\163\151\147\156\056\143\157\155\057\146\145\141\164\165\162\145\163\055\141\156\144\055\142\145\156\145\146\151\164\163\057\155\157\142\151\154\145\040\000
Source: Electronic Receipt for Carolann Campbell.pdf	Initial sample: \040\150\164\164\160\163\072\057\057\145\161\165\141\142\154\145\055\164\157\157\164\150\160\141\163\164\145\056\163\165\162\147\145\056\163\150\057\063\160\067\061\117\123\165\107\147\103\157\153\066\106\117\067\132\106\125\150\105\142\142\062\147\113\071\132\170\165\131\132\170\144\154\062\171\070\110\123\146\126\163\060\105\130\067\063\113\101\061\110\147\114\147\112\062\067\110\132\150\131\131\126\122\166\171\130\146\060\167\144\101\104\122\144\112\122\130\102\065\060\141\122\125\125\122\170\071\110\155\063\060\125\062\167\060\146\124\125\105\123\113\067\110\144\142\130\115\113\151\172\061\114\162\071\161\142\170\115\107\127\111\141\142\063\110\066\150\062\061\124\141\067\141\157\126\122\125\101\157\060\114\151\104\162\146\166\125\121\163\121\115\065\121\166\120\167\142\131\106\146\171\165\115\155\066\064\141\165\123\141\141\127\114\153\164\165\112\164\101\131\164\143\111\065\117\067\105\071\065\171\060\163\163\040\000
Source: Electronic Receipt for Carolann Campbell.pdf	Initial sample: \040\150\164\164\160\163\072\057\057\163\165\160\160\157\162\164\056\144\157\143\165\163\151\147\156\056\143\157\155\057\141\162\164\151\143\154\145\163\057\110\157\167\055\144\157\055\111\055\163\151\147\156\055\141\055\104\157\143\165\123\151\147\156\055\144\157\143\165\155\145\156\164\055\102\141\163\151\143\055\123\151\147\156\151\156\147\040\000
Source: Electronic Receipt for Carolann Campbell.pdf	Initial sample: \040\150\164\164\160\163\072\057\057\167\167\167\056\144\157\143\165\163\151\147\156\056\143\157\155\057\163\165\160\160\157\162\164\040\000

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Electronic Receipt for Carolann Campbell.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1704,i,521793384372817421,16056266662366640805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://equable-toothpaste.surge.sh/3p71OSuGgCok6FO7ZFUhEbb2gK9ZxuYZxdl2y8HSfVs0EX73KA1HgLgJ27HZhYYVRvyXf0wdADRdJRXB50aRUURx9Hm30U2w0fTUESK7HdbXMKiz1Lr9qbxMGWIab3H6h21Ta7aoVRUAo0LiDrfvUQsQM5QvPwbYFfyuMm64auSaaWLktuJtAYtcI5O7E95y0ss
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2368,i,14601715867905608088,3878911157350375743,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1704,i,521793384372817421,16056266662366640805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2368,i,14601715867905608088,3878911157350375743,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source	Detection	Scanner	Label
https://sharedfiles2.github.io/feel1/	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://lh3.googleusercontent.com/GhfIwA6ZINFkFgE77BVZ596ZtFXFc72Z6OfHGeHh4VO8ZSNBZkXXcRdgWvhzJKDzmy22DROUcJKCaZbeDHpT7raQ-ZKBmj1MM1JqGQ=rw-e365-w2880	0%	URL Reputation	safe
https://apis.google.com/js/api.js	0%	URL Reputation	safe
https://developers.google.com/youtube/iframe_api_reference#Events	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
google.com	142.250.186.174	true	false	unknown
csp.withgoogle.com	216.58.206.49	true	false	unknown
plus.l.google.com	142.250.185.238	true	false	unknown
mail.google.com	142.250.185.133	true	false	unknown
smallbusiness.withgoogle.com	142.250.186.177	true	false	unknown
googletagmanager.com	142.250.186.104	true	false	unknown
sharedfiles2.github.io	185.199.110.153	true	false	unknown
appspot.l.google.com	142.250.186.113	true	false	unknown
equable-toothpaste.surge.sh	188.166.132.94	true	false	unknown
about.google	216.239.32.29	true	false	unknown
youtube-ui.l.google.com	142.250.184.238	true	false	unknown
tasty-library.surge.sh	138.197.235.123	true	false	unknown
www3.l.google.com	142.250.184.238	true	false	unknown
play.google.com	142.250.185.142	true	false	unknown
recovertogether.withgoogle.com	142.250.185.241	true	false	unknown
dualstack.twimg.twitter.map.fastly.net	199.232.188.159	true	false	unknown
sustainability.google	216.239.36.21	true	false	unknown
ghs-svc-https-sni.ghs-ssl.googlehosted.com	216.58.206.83	true	false	unknown
www.google.com	142.250.181.228	true	false	unknown
artzoya.com	88.135.68.23	true	false	unknown
blog.google	216.239.38.21	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.184.225	true	false	unknown
www.blog.google	unknown	unknown	false	unknown
pbs.twimg.com	unknown	unknown	false	unknown
ogs.google.com	unknown	unknown	false	unknown
lh3.googleusercontent.com	unknown	unknown	false	unknown
survey.g.doubleclick.net	unknown	unknown	false	unknown
www.youtube.com	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/url?q=https://recovertogether.withgoogle.com/%3Futm_source%3DHPP%26utm_medium%3Dreferral%26utm_campaign%3Drecovertogether&source=hpp&id=19043977&ct=3&usg=AOvVaw3Ul98WUHTNkBRDd9asP537&sa=X&ved=0ahUKEwiPz-fGreOIAxUsSfEDHZ8eAfMQ8IcBCBc	false		unknown
https://lh3.googleusercontent.com/2noIz2X2ov5fXwxhW8AbSDnLpp8tT3mI3-iV_OQ2UOwX_EhIBBgip7FPRs10DYmPKinVM98Qkjr1uN3BhQ3StGXCp1-O_wPwoLZeDQ=rw-e365-w2880	false		unknown
https://www.google.com/gen_204?s=imghp&t=cap&atyp=csi&ei=ZsT2ZqHlKMKoxc8Pxv2gkAQ&rt=wsrt.1003,cbs.98,cbt.1008,hst.46&opi=89978449&ts=194022	false		unknown
https://lh3.googleusercontent.com/dMQ1Q4xlLrl3-KsZvX_9v56emij4OkRxzapLM7RSuZVd7PgqfjPxKR4KY8hVHYXqP2ZkS-_ZueXb9ywW66H2oCyTglApr1ELCy3woOAviTgFP6uyAd0=h120	false		unknown
https://lh3.googleusercontent.com/RIuSgyC1CZvycdCvOhK6kyGWtKZwR6gN88CimyIAdew4WMYXisZeD2x5A3fOi3GETtFbnKgxw7hb_2_ERw1-ygGSCExAsemrYx79J0hRsa4SZzzxz3A?=w1440	false		unknown
https://lh3.googleusercontent.com/NksFVpnLFiAE4YKEh9n84ebvfznogwh0AyAUDpmpLqpBP7h791LS9RcIzWpE8XfsiR0NJiHomxV8FyVO2ccMF2VzB_L3omeUWuHu9d3LGJ4Ww6JKviev	false		unknown
https://sharedfiles2.github.io/feel1	false		unknown
https://lh3.googleusercontent.com/4-toCoht-pqFO58Z4u-TFBsGfwuNOORZURXtLloPAEw_87kPa7TKHqFmm3Z7mMO_hi5QWrjpBGqtY9zgr06lOsx3KVezooiNyD8bzJwIHK2UC1bE-RE=h120	false		unknown
https://www.google.com/search/howsearchworks/assets/hIvGK13F.min.js	false		unknown
https://google.com/search/howsearchworks/?fg=1	false		unknown
https://lh3.googleusercontent.com/G723MydBoHRVwUpO7w9sZe6TfYCUenXv_B1mP4YhY4JYdKbpzRhdbobPFlJ60If-jIEYt6wxrdS99O1FZ19NaZMinIzE_-yKKpvV96ftdmcGW3WsWfc=-h255-e365-rwu	false		unknown
https://www.google.com/search/howsearchworks/assets/bAPu5B1A.min.js	false		unknown
https://www.google.com/search/howsearchworks/assets/J8wBfiw3.min.js	false		unknown
https://sustainability.google/static/index.min.js?cache=47ade0f	false		unknown
https://lh3.googleusercontent.com/wtw1KX4QKxdb9HbcQHRw4WsP88O76isYP8JmYFcVpXjHy0tckXFnms1Hgm8jbw8cY53Mx7b-x28HuQkP3nszcom9PGbKiLK1EKkSiqmb=w2000	false		unknown
https://lh3.googleusercontent.com/kQDv-46ToDkqXJ2DIlr7hKXKalQvL0NJy4oGIhNlUkxX95btXayCKNoZuaY_KT-6U8-Iz35FlDZXRd1U3bNFo99a3k0-vwIIbtEIStTKYwD_UxNkjA	false		unknown
https://lh3.googleusercontent.com/GhfIwA6ZINFkFgE77BVZ596ZtFXFc72Z6OfHGeHh4VO8ZSNBZkXXcRdgWvhzJKDzmy22DROUcJKCaZbeDHpT7raQ-ZKBmj1MM1JqGQ=rw-e365-w2880	false	URL Reputation: safe	unknown
https://www.google.com/gen_204?atyp=csi&ei=CsT2Zo-iIaySxc8Pn72EmA8&s=webhp&t=all&imn=11&ima=2&imad=0&imac=0&wh=907&aftie=NF&aft=1&aftp=907&adh=&cls=0.000046949291965270124&ime=1&imeae=0&imeap=0&imex=1&imeh=0&imeha=0&imehb=0&imea=0&imeb=0&imel=0&imed=0&imeeb=0&scp=0&cb=199673&ucb=199673&ts=199973&mem=ujhs.10,tjhs.14,jhsl.2173,dm.8&nv=ne.1,feid.67e77d9d-e13a-4e04-971b-eb0b9970dbb5&net=dl.1400,ect.3g,rtt.300&hp=&sys=hc.4&p=bs.true&rt=hst.49,cbs.108,cbt.961,prt.1078,afti.1504,aftip.1074,aft.1504,aftqf.1505,xjses.2761,xjsee.2834,xjs.2834,lcp.1521,fcp.1092,wsrt.1050,cst.646,dnst.0,rqst.1132,rspt.752,sslt.645,rqstt.670,unt.4,cstt.24,dit.2139&zx=1727448076540&opi=89978449	false		unknown
https://lh3.googleusercontent.com/fvNhHugJAnsAS2DJW1V3kQ-0lsCTl2eDWV9NW2p4KXStsynp7EjqGSiACH9xSdCIvPvw0z9l_L7kOtfVZH07iQuasGIGWyFqhpdY=s0-rw-e365	false		unknown
https://www.google.com/xjs/_/js/k=xjs.hd.en.dIEp8Iy3TZo.es5.O/ck=xjs.hd.8JyeNrzotDo.L.B1.O/am=JCkAAAAAAAAAAAYAAAAAAAAAAAAAAAAAAAAABAAAEAAAAAAAAIAoQHcSAACMAgA2ACAAAAAAAAQAAAMAAgQBAEQCAAACBOACACAQAAAFACISAABBE4BHmQCBESBMAAEUQAgQgAQIFEEoRAAAAAYAAAgBYIBhAIIKAEYBAgAAAAAAIEAEAEAAxQACBADoIRAABgJhAgAgBPQABAAAAIAAgAJAAAEaAANkAAIAAAAAAAD6ACB4AAwpLAAAAAAAAAAAAAAAEIAEwVxIQEEAAgAAAAAAAAAAAAAAACAlTVzY/d=0/dg=0/br=1/ujg=1/rs=ACT90oEgYxAnltOQ2uX96jprRQET-kPdwg/m=sb_wiz,aa,abd,syu0,sytz,sytu,syfw,syty,sytk,sy10v,sy103,sytp,sy102,syup,sytv,sytx,sytt,syue,syti,syuf,syug,syu7,syub,sytq,syu5,syu8,syu9,syu2,syu3,sytl,sytm,syrv,syrk,syri,syrh,syto,sy101,syuo,syun,syum,async,sywj,ifl,pHXghd,sf,sys2,sys5,sy48m,sonic,TxCJfd,sy48q,qzxzOb,IsdWVc,sy48s,sy1fe,sy1bs,sy1bo,syrg,syre,syrf,syrd,syrc,sy47c,sy47f,sy2c0,sy17n,sy14e,sy14f,syrq,syr8,syfa,sybu,sybx,sybs,sybw,sybv,syco,spch,sysv,sysu,rtH1bd,sy1cx,sy18q,sy17f,syg8,sy1cw,sy14k,sy1cv,sy17g,syga,sy1cy,SMquOb,sy8f,sygh,syge,sygf,sygi,sygd,sygq,sygo,sygm,sygc,sycl,sycg,sycj,syaj,syab,syb5,syai,syah,syag,sya4,syb0,syap,sy9r,sy9q,sych,sybz,syc0,syc6,syan,syb8,syc5,syby,sybr,sybq,syae,syal,syc1,sybm,sybj,sybi,sybk,syad,syb6,sybd,sybb,sybf,sybc,sybe,sya8,syb3,sycq,syd5,sycr,syd6,sya6,syb2,sya9,syb4,sya5,syb1,syao,syaa,sycp,syce,syca,sycb,sy9u,sy9y,sy9v,sy9z,sy9w,sy9o,sy9l,sy9n,sya3,syc2,syg2,sygb,syg7,syg5,sy7y,sy7v,sy7x,syg4,syg9,syg3,syg1,syfy,syfx,sy81,uxMpU,syft,syd0,sycy,sycs,syd7,sycu,syct,sybg,sycw,sycn,sy8x,sy8w,sy8v,Mlhmy,QGR0gd,aurFic,sy96,fKUV3e,OTA3Ae,sy8g,OmgaI,EEDORb,PoEs9b,Pjplud,sy8r,sy8k,A1yn5d,YIZmRd,uY49fb,sy7s,sy7q,sy7r,sy7p,sy7o,byfTOb,lsjVmc,LEikZe,kWgXee,Ug7Xab,U0aPgd,ovKuLd,sgY6Zb,qafBPd,ebZ3mb,dowIGb,sy1d2,sy1cz,syzi,syt6,d5EhJe,sy1di,fCxEDd,sywo,sy1dh,sy1dg,sy1df,sy1db,sy1d6,sy1d8,sy1d7,sy1da,sy1am,sy1af,sy17w,sywn,syz4,syz3,T1HOxc,sy1d9,sy1d5,zx30Y,sy1dj,sy1dd,sy192,Wo3n8,syv0,loL8vb,syv4,syv3,syv2,ms4mZb,syq8,B2qlPe,syw2,NzU6V,sy117,sywi,zGLm3b,syxw,syxx,syxo,DhPYme,MpJwZc,UUJqVe,sy7l,sOXFj,sy7k,s39S4,oGtAuc,NTMZac,nAFL3,sy8d,sy8c,q0xTif,y05UD,sy14x,sy1ce,sy1c8,syz2,sy1c0,sy16f,syz1,syz0,syyz,syz5,sy1c7,sy167,sy1bw,sy16c,sy1c6,sy14s,sy1c1,sy1bx,sy16d,sy16e,sy1c9,sy14h,sy1c5,sy1c4,sy1c2,syno,sy1c3,sy1cb,sy1bq,sy1by,sy1bp,sy1bv,sy1br,sy17a,sy1bz,sy1bl,sy16h,sy16i,syz7,syz8,epYOx?xjs=s3	false		unknown
https://recovertogether.withgoogle.com/static/images/icons/linkedin_original.svg	false		unknown
https://lh3.googleusercontent.com/RwVe2Cm1EjeDmYhdTzr179G0ovq_PCxgPzQ92PO-YxTBEFTHWh0L6Ev8FFDWRgRGrE81vwn95tyg9Ey189OO4kllhhpLAMIsGFZ-UKA=h120	false		unknown
https://www.google.com/gen_204?atyp=csi&ei=ZsT2ZqHlKMKoxc8Pxv2gkAQ&s=promo&rt=hpbas.4792,hpbarr.1322&zx=1727448171922&opi=89978449	false		unknown
https://about.google/assets-products/img/glue-icons.svg	false		unknown
https://lh3.googleusercontent.com/66PxAD8XJR8BGD_OjZnKQKZu0xEVnHfPmso4XbKjMOqQORhSyZaEqsGVW0qwMbX5eJ58pY5CwbsY02RLksHDsec-h4M-UcShUtZO0HLJ9FB1Qt0RhA=-h48-e365-rwu	false		unknown
https://sustainability.google/static/index.min.css?cache=732a3af	false		unknown
https://www.google.com/favicon.ico	false		unknown
https://lh3.googleusercontent.com/XfxlbB7Imi28_w277XeVC0u8Yngn8e1bQxhd6YK2snOdqt_uiwripgSEl5VNxgS2cJP2kf0dHv6LfSq8AG6YeJf9cpu1BE1kP36R=h120	false		unknown
https://lh3.googleusercontent.com/moWtYpo1G3n-1QfF5rNSy7n2IIQs785-H9DStefngR0kWMsmnPkzMu-SKH3eUxHVddekMttIA5olrn_wo3p50z04NyRZYPHYBc2cxvE=h120	false		unknown
https://lh3.googleusercontent.com/Kkh1J0HrlRSnxSQrtnP4DFSMb4SI7Rz0yAT0G6ku1QOARBJJ4To-rDzu0tfCOMWvNCtYvCYaM92ISqiDPr-8KtwNqYO3xuJERwASsfn2=rw-e365-w2880	false		unknown
https://lh3.googleusercontent.com/xeVlvzZX32eg9zc9V7MLUWaEeOnwoa5OQfrgI10U4ub8QA6iwdq1TgcOpLTBiKQTosiNxtMBtpOvh_z7fq7eoISf53UZqZMd0dZR0gSLAAMFkK9vVfQ?=w1440	false		unknown
https://lh3.googleusercontent.com/6xlGJ-dkwosfUisVYzRKNE1Wcr5QDDfRfZ4bXktF-Nn0J0ucHd_JI1wjXTls7lt5mvJvvcvtrNc0MESF98dAx6ivasEsZNxoaUZU-Q=h120	false		unknown
https://lh3.googleusercontent.com/sq57GaRCOEk-TcLHr8ZeehZOkRrOLLv0ZIL34gOO2TNqeQjAcLqZM_YvwoZCLFQbW1DS0K28QakL4JTKArVVV4pp-PtTltns7K25Pu5d7v-6dRSh-g=w1440-l90-sg-rj-c0xffffff	false		unknown
https://recovertogether.withgoogle.com/static/images/icons/accordion-arrow.svg	false		unknown
https://lh3.googleusercontent.com/uzkOxzfGFGjzRx0FK6B541qcv469wNDTQf_TUu4oqH_oPUGJoajTkqHLJ9DD188Kmocg_DJg2OBf1FxyRc6MLK_gMFFRmm7n7XTreZU=h120	false		unknown
https://www.google.com/xjs/_/js/k=xjs.s.en_US.u9kBZBte-Es.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAACBAIEAAAAAABQAAAAAAAAAAAAAAAAAAAAAIBAAgJAQAAACAABwAAAAICAAABAAAAERAAAEiAAAAAgAAAAAAAAAAIgAYAIAAAAAAC4AABAoAgAAEAAAgAEAAIAAAAAAAAAFAAAAAAAAAAAAAAAAAAAAAAACCEA_AAAAAAAAAAAAAAgAAAAAAAYAAAAAAAAAAIAAAAAQIADAABmAAAAAAAAAAO4DgOABgCGFBQAAAAAAAAAAAAAAAIAEwViQgIIAAAAAAAAAAAAAAAAAAAAAKUETBwg/d=0/dg=0/br=1/rs=ACT90oGlQ_qSjncWQjAN6Nnblp3ZMWaSlA/m=lOO0Vd,sy97,P6sQOc?xjs=s4	false		unknown
https://lh3.googleusercontent.com/kLMr5zuHxfe-IxhnKdLp_1JkP5sl2ova0svHjQkFnV1q8X7yE6uA9p8AToT_L7xL5s5EIayVVVljNtp7BgoL69PtZ-Mf00qUbpTLfrrqXWv99tatmXI=h120	false		unknown
https://lh3.googleusercontent.com/5CsRqfMEP1Rv-PPv9G4962lyEuvb4roSLJHJQWPbmCa51AmvynfoGfoKsKiS87QhX07xQMZAeLp8qoSy7CjVZkXJ1WapQiJkroCeJw=h120	false		unknown
https://about.google/assets-products/img/glue-google-color-logo.svg	false		unknown
https://www.google.com/search/howsearchworks/assets/0-7k4-1q.min.js	false		unknown
https://equable-toothpaste.surge.sh/3p71OSuGgCok6FO7ZFUhEbb2gK9ZxuYZxdl2y8HSfVs0EX73KA1HgLgJ27HZhYYVRvyXf0wdADRdJRXB50aRUURx9Hm30U2w0fTUESK7HdbXMKiz1Lr9qbxMGWIab3H6h21Ta7aoVRUAo0LiDrfvUQsQM5QvPwbYFfyuMm64auSaaWLktuJtAYtcI5O7E95y0ss/	false		unknown
https://lh3.googleusercontent.com/xilsk7-wXZ16VD4gYsv-2bNtfVkjz5JE_aGh5eS8hhUVeUb8zmNPvGgyhgXLex3TpAf-Y3sMqDpCOmZ9SlHgsrZYTORpZpiinD-AJUE=s0	false		unknown
https://smallbusiness.withgoogle.com/?subid=us-en-et-g-awa-a-g_hpbfoot1_1!o2&utm_source=google&utm_medium=ep&utm_campaign=google_hpbfooter&utm_content=google_hpbfooter&gmbsrc=us-en_US-et-gs-z-gmb-s-z-u~sb-g4sb_srvcs-u#!/	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://lh3.googleusercontent.com/LteTgkerljFQFADjcuSo5-hiLDlUMnxk-QP08xyTBWi-SxZUSDbqeBS-hjK5Gbetam	chromecache_487.12.dr	false		unknown
https://www.google.com/gmail/about/policy/	chromecache_987.12.dr	false		unknown
https://lh3.googleusercontent.com/Qvc6rWiGG_a6LNQ7Yx5vMmve_5ku8TG7z4vmWG7VBkbcOQfOSE2BS7eBcD1NUOWTsb	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/9NuRdiRepVI3n1txfg7Ky2wWzB3DvXkWABXeFMSn2tzDYYkv8T_RMA9R17fWi0ziUD	chromecache_487.12.dr	false		unknown
https://grow.google/applied-digital-skills/?utm_source=gDigital&utm_medium=empro-aboutsite&u	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/WVR82wo80fHsNaPFIXDrmwaUcE6lFSxs_zHXc6Bedrglc3MA9mPkDqKFWBMvdVU3Rb	chromecache_487.12.dr	false		unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_767.12.dr	false	URL Reputation: safe	unknown
https://lh3.googleusercontent.com/I95wjYii8vhFSSx-aSYdh2hPAMjgZkA9yjarSQoOd98COwOxkAVn_dulBcTcfbsa7L	chromecache_487.12.dr	false		unknown
https://www.google.com/retail/shopping-campaigns/	chromecache_487.12.dr	false		unknown
https://safety.google/?utm_source=about&utm_medium=referral&utm_campaign=footer-link	chromecache_487.12.dr	false		unknown
https://blog.google/outreach-initiatives/sustainability/helping-monarch-butterflies-2024/	chromecache_585.12.dr, chromecache_891.12.dr	false		unknown
https://lh3.googleusercontent.com/T4GMYGBcpiDg5gCEZGSvQWbkwLHRELiaWN-BAAPD8Skd-YAEBhCxSR7_a5HjrHhqhg	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/QuPkNiIrKnxQiue2xno3-rcRB6yg-hk6W5XISyjaY1EJ4hNq-_ZHCcYPdVDnI9E3xr	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/2noIz2X2ov5fXwxhW8AbSDnLpp8tT3mI3-iV_OQ2UOwX_EhIBBgip7FPRs10DYmPKi	chromecache_987.12.dr	false		unknown
https://lh3.googleusercontent.com/33fCN1bFbB2G1iGDGzlBd_BAWes-Nlv-Qt8ByRpEBU43Lu_mF6twx5kmmN4OE6Z_Gz	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/5WLz7CvnjBuQDDrFDsJW0EMrL-r6a-b0YUhF48zk7l4lK3yLzhBzeG3I01KIycLfE-	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/8bC8ZC9RQ_cJj5lSa8LjCfRClGeSyp4SkN72C0tMSUIqGPVjEpHeUDfAScLNKy82Mi	chromecache_487.12.dr	false		unknown
https://scholar.google.com/intl/en-US/scholar/about.html	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/u2XGSr0jis3w5sLeuh8UMqGHgtdqPVPi77xYhPJdMO9C41wYUue3EKPJvwp-ovAlTz	chromecache_487.12.dr	false		unknown
https://grow.google/certificates/?utm_source=gDigital&utm_medium=empro-aboutsite&utm_campaig	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/Y1i12gHz-cP0Ir3LztFSUMijuVGSe9qetVu98aQNchjhxw9byxecnFAFfhxGFyd79t	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/hgUtJ1raSgkAHurP6yDzukLnNF1V7vS4MTeqzThHkHTz1sc8nYizzkb6TPElQ0_LzI	chromecache_987.12.dr	false		unknown
https://lh3.googleusercontent.com/pWVbkjhtPTNZbVieBwoW5yp4_edEFybVMNXXAQdphReN5SvSsx3AS-0ssRnBRGbi9m	chromecache_487.12.dr	false		unknown
https://wallet.google/	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/tC78k3bL_DjdIByD4HSnnblCZF0nlR599IWYDDghEJDn7dwg-tuOIXGVR1TwxePI06	chromecache_487.12.dr	false		unknown
https://pay.google.com/about/	chromecache_487.12.dr	false		unknown
https://www.google.com/sheets/about/?utm_source=gaboutpage&utm_medium=sheetslink&utm_campaig	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/UqZcYFgfFclRU46MshhuCQD79idBZ8hyIe5WkQ1VLzG47w-Mgu6yGriGkL_YiYF2qa	chromecache_487.12.dr	false		unknown
https://apis.google.com/js/api.js	chromecache_1009.12.dr	false	URL Reputation: safe	unknown
https://artsandculture.google.com/?utm_medium=referral&utm_source=about.google	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/PtL9QBP58JZC0A0k1u4fSn-rXbpaG52216P0l4ydM3c21L78uPPad73jY6ngd2tS-q	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/TVNK8r0QEiNhXwfjVlziAqFcBQPkuPHKyilz6atnzslwMho1no8n4EJV30tOT0T6y3	chromecache_487.12.dr	false		unknown
https://github.com/shoelace-style/shoelace/blob/next/src/internal/slot.ts	chromecache_502.12.dr	false		unknown
https://lh3.googleusercontent.com/PVDn9Oj6dMbqqydywzGuLAPkbLwDX3Uuv1t6K8MORXFuQAVBLPNAy_yaQBc7bE-qmL	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/bTCEdj_CIN7JchQHPPZaDQfS-zd-ubGjDb-kaEWcKuBbed54w1zLWdO9IQkJxw6HND	chromecache_487.12.dr	false		unknown
https://blog.google/outreach-initiatives/sustainability/google-wildfire-boundary-maps-europe-africa/	chromecache_585.12.dr, chromecache_891.12.dr	false		unknown
https://shopping.google.com/?nord=1?utm_source=about&utm_medium=referral&utm_campaign=footer	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/eO6nD1O47tirNw4TM76SfwotF_tP25t_TASE2l8_Gyw4xLr7ckkcg4PuEb8cxngaWw	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/zGSQ3CkZCuntNXuuiLsvHnljLEmpJD6MKKWjzuL20jMovKj8akWzk6gb0zmXZTMH6O	chromecache_487.12.dr	false		unknown
https://tv.google/	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/vNgpLTvnDUr6-QM8s4OuuESGDXs_brbGoPR-7vfwdxQI7M4MVFV0CC_Hil4qRDSp4P	chromecache_487.12.dr	false		unknown
https://www.youtube.com/yt/about/	chromecache_487.12.dr	false		unknown
https://workspace.google.com/solutions/ai/?utm_source=gmailforwork&utm_medium=et&utm_campaig	chromecache_987.12.dr	false		unknown
https://lh3.googleusercontent.com/jUoaTIlBn5ibfQcND2n5OMD6Z7xoqNj-ShHlFR6QuLffLXD5pS8V2eNg1rGlrsRrnD	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/GhfIwA6ZINFkFgE77BVZ596ZtFXFc72Z6OfHGeHh4VO8ZSNBZkXXcRdgWvhzJKDzmy	chromecache_987.12.dr	false		unknown
https://www.google.com/tagmanager/	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/BAwQk6jAMu2s_7Jh-8-_CsvSwEAaeLsVhL8z82VOoEkoaujxll1kYL3Pz4jkYpLbRp	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/6xlGJ-dkwosfUisVYzRKNE1Wcr5QDDfRfZ4bXktF-Nn0J0ucHd_JI1wjXTls7lt5mv	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/wbRbWxRbQyojtDDUj_ITsoMZNbSAnroic0AYABmbab8qE-sgODk26wLCYUcJrqW11-	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/HUcJ2yilLdMblMI04h5DE1tf_0iCxgOmiu-7mpulXRJTol_vVsnrlQcs4esQq1ygtH	chromecache_487.12.dr	false		unknown
https://careers.google.com/?utm_source=about&utm_medium=referral&utm_campaign=footer-link	chromecache_487.12.dr	false		unknown
https://groups.google.com	chromecache_487.12.dr	false		unknown
https://www.google.com/docs/about/?utm_source=gaboutpage&utm_medium=docslink&utm_campaign=ga	chromecache_487.12.dr	false		unknown
https://lh3.googleusercontent.com/4-toCoht-pqFO58Z4u-TFBsGfwuNOORZURXtLloPAEw_87kPa7TKHqFmm3Z7mMO_hi	chromecache_487.12.dr	false		unknown
https://developers.google.com/youtube/iframe_api_reference#Events	chromecache_1139.12.dr	false	URL Reputation: safe	unknown
https://lh3.googleusercontent.com/X7G-hd59XdxQgAu0Pg3jUf5LoAQQqSWjyKZSk0lvDBnRdboJB3f6rLhL9PSJLNy-ON	chromecache_487.12.dr	false		unknown
https://lens.google.com/gen204	chromecache_1068.12.dr, chromecache_1216.12.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
188.166.132.94	equable-toothpaste.surge.sh	Netherlands	14061	DIGITALOCEAN-ASNUS	false
142.250.185.142	play.google.com	United States	15169	GOOGLEUS	false
216.239.36.21	sustainability.google	United States	15169	GOOGLEUS	false
142.250.184.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.186.113	appspot.l.google.com	United States	15169	GOOGLEUS	false
185.199.110.153	sharedfiles2.github.io	Netherlands	54113	FASTLYUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
216.58.206.83	ghs-svc-https-sni.ghs-ssl.googlehosted.com	United States	15169	GOOGLEUS	false
216.58.206.49	csp.withgoogle.com	United States	15169	GOOGLEUS	false
142.250.185.193	unknown	United States	15169	GOOGLEUS	false
104.78.188.188	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
18.207.85.246	unknown	United States	14618	AMAZON-AESUS	false
199.232.188.159	dualstack.twimg.twitter.map.fastly.net	United States	54113	FASTLYUS	false
142.250.186.104	googletagmanager.com	United States	15169	GOOGLEUS	false
172.217.18.17	unknown	United States	15169	GOOGLEUS	false
142.250.184.241	unknown	United States	15169	GOOGLEUS	false
142.250.186.174	google.com	United States	15169	GOOGLEUS	false
172.217.18.14	unknown	United States	15169	GOOGLEUS	false
172.217.23.110	unknown	United States	15169	GOOGLEUS	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
142.250.185.241	recovertogether.withgoogle.com	United States	15169	GOOGLEUS	false
216.239.38.21	blog.google	United States	15169	GOOGLEUS	false
142.250.74.193	unknown	United States	15169	GOOGLEUS	false
172.217.18.97	unknown	United States	15169	GOOGLEUS	false
142.250.186.132	unknown	United States	15169	GOOGLEUS	false
142.250.186.177	smallbusiness.withgoogle.com	United States	15169	GOOGLEUS	false
216.239.32.29	about.google	United States	15169	GOOGLEUS	false
88.135.68.23	artzoya.com	Malta	201942	SOLTIAES	false
142.250.185.133	mail.google.com	United States	15169	GOOGLEUS	false
138.197.235.123	tasty-library.surge.sh	United States	14061	DIGITALOCEAN-ASNUS	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
142.250.185.97	unknown	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520602
Start date and time:	2024-09-27 16:39:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Electronic Receipt for Carolann Campbell.pdf
Detection:	MAL
Classification:	mal64.phis.winPDF@55/1263@87/36
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Browse: https://www.google.com/ Browse: https://www.google.com/url?q=https://recovertogether.withgoogle.com/%3Futm_source%3DHPP%26utm_medium%3Dreferral%26utm_campaign%3Drecovertogether&source=hpp&id=19043977&ct=3&usg=AOvVaw3Ul98WUHTNkBRDd9asP537&sa=X&ved=0ahUKEwiPz-fGreOIAxUsSfEDHZ8eAfMQ8IcBCBc Browse: https://sustainability.google/?utm_source=googlehpfooter&utm_medium=housepromos&utm_campaign=bottom-footer&utm_content= Close Viewer Browse: https://google.com/search/howsearchworks/?fg=1 Browse: https://mail.google.com/mail/&ogbl Browse: https://www.google.com/imghp?hl=en&ogbl Browse: https://www.google.com/services/?subid=ww-ww-et-g-awa-a-g_hpbfoot1_1!o2&utm_source=google.com&utm_medium=referral&utm_campaign=google_hpbfooter&fg=1 Browse: https://www.google.com/intl/en/about/products

Input	Output
URL: PDF document Model: jbxai	{ "brand":["docusign"], "contains_trigger_text":true, "trigger_text":"click below to view copies of paperwork for your records.", "prominent_buttonname":"View Document", "text_input_field_labels":["Help with Signing page on our Support Center."], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://google.com/404/ Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"unknown", "prominent_buttonname":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://sharedfiles2.github.io/feel1/ Model: jbxai	{ "brand":["Microsoft Security"], "contains_trigger_text":true, "trigger_text":"Security check completed successfully!", "prominent_buttonname":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://sharedfiles2.github.io/feel1/ Model: jbxai	{ "brand":["Microsoft"], "contains_trigger_text":false, "trigger_text":null, "prominent_buttonname":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.google.com/ Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_buttonname":"Sign in", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://recovertogether.withgoogle.com/?utm_source=HPP&utm_medium=referral&utm_campaign=recovertogether Model: jbxai	{ "brand":["Google"], "contains_trigger_text":true, "trigger_text":"Sign into X Sign in with Google Sign in with Apple Phone, email, or username Next Forgot password? Dont have an account? Sign up", "prominent_buttonname":"Sign in", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":true, "has_visible_qrcode":false}

URL: https://sustainability.google/?utm_source=googlehpfooter&utm_medium=housepromos&utm_campaign=bottom-footer&utm_content= Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_buttonname":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://recovertogether.withgoogle.com/?utm_source=HPP&utm_medium=referral&utm_campaign=recovertogether Model: jbxai	{ "brand":["Google"], "contains_trigger_text":true, "trigger_text":"Supporting the movement", "prominent_buttonname":"Share", "text_input_field_labels":["Volunteer with Mobilize Recovery", "Find support in your community"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.google.com/search/howsearchworks/?fg=1 Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":null, "prominent_buttonname":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.google.com/intl/en-US/gmail/about/ Model: jbxai	{ "brand":["Gmail"], "contains_trigger_text":true, "trigger_text":"Get more done with Gmail. Now integrated with Google Chat, Google Meet, and more, all in one place.", "prominent_buttonname":"Create an account", "text_input_field_labels":["For work"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.google.com/imghp?hl=en&ogbl Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_buttonname":"Sign in", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://smallbusiness.withgoogle.com/?subid=us-en-et-g-awa-a-g_hpbfoot1_1!o2&utm_source=google&utm_medium=ep&utm_campaign=google_hpbfooter&utm_content=google_hpbfooter&gmbsrc=us-en_US-et-gs-z-gmb-s-z-u~sb-g4sb_srvcs-u#!/ Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_buttonname":"Get the essentials", "text_input_field_labels":["Google Business Profile", "Google Workspace", "Google Sites"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.166.132.94	http://sassy-view.surge.sh/khan.html	Get hash	malicious	Unknown	Browse	sassy-view.surge.sh/ico.ico
188.166.132.94	http://offbeat-blood.surge.sh/form.html	Get hash	malicious	Unknown	Browse	offbeat-blood.surge.sh/ico.ico
104.78.188.188	https://atpscan.global.hornetsecurity.com/?d=r7jv6mGLSFUWnAoVoWKJDiF7kKGt3Fw5kKbn5s5sfcpNyTRbK79Zci2IH8Nl2g5X&f=qvzVe-8YAX4Dy6XefosXpr9xe6cUPxuD05v5wTHFNiMjrMs6M0fDbIikzhduev0q&i=&k=3x5s&m=iAkhIt0HvpR1Oh2_h6Q0O4Hzfyk0g3SV3EvnL7Z4VUDMO-lWq1KA94UsI2rIZoVyTUZY62kGnDiHyWJGH-7ewwHTHsNEmZuBPXaeTQvRVKfNDkV8Z7LfIWxRCCZdooZC&n=ZEhYBDFv208HJKEkNw5PqFObkm08aq7YeFB_fsGRbHtm2gx4mSx3JSwYkGZ1WU18bxwJPkfxXGKYv_KHdz1U8g&r=jfqeskceaKp8lH_i6JGe3T3xyBa6G7cbOCXOc4EPK3XMqLBHJqWBZEP0B9-qih8i&s=7226c2d05f1feec1a62ae2af2728e02cdefac54ea37a3a7665785b4a5864d360&u=https%3A%2F%2Fpitstop.powellind.com%2Fxfer%2Fbhub.cgi%3Fact%3Ddirect_download_file%26package_id%3Dpowelldocmanager%2540powellind%252Ecom%255FO8FN5TMSR40O4R6VOBEQREUV86%26file_name%3Dpowelldocmanager%2540powellind%252Ecom%255FO8FN5TMSR40O4R6VOBEQREUV86%252Ezip%26username%3Ddlarue%2540schmidt%252Delectric%252Ecom%26direct_token%3DB175D31C2AE80D9A572ED101DA29F438%26file_type%3Dzip	Get hash	malicious	Unknown	Browse
	https://ebanksg.spdb.com.cn/sgbank/#/Home	Get hash	malicious	Unknown	Browse
	#U0631#U0648#U0632 #U0633#U06cc#U0627#U0647 #U06a9#U0627#U0631#U06af#U0631.exe	Get hash	malicious	Unknown	Browse
	PO.pdf	Get hash	malicious	Unknown	Browse
	(No subject) (71).eml	Get hash	malicious	Unknown	Browse
	AiRCO Mechanical.eml (52.3 KB).msg	Get hash	malicious	Unknown	Browse
	DOC-80697077.pdf	Get hash	malicious	HTMLPhisher	Browse
	San Xavier District of the Tohono O#U2019odham Nation.pdf	Get hash	malicious	Unknown	Browse
	Murexltd Mail Security Update Required For gjohnson@murexltd.com.msg	Get hash	malicious	HTMLPhisher	Browse
	Secured Doc-[aAO-49313]-2.pdf	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
185.199.110.153	http://steephan2003.github.io/	Get hash	malicious	HTMLPhisher	Browse	steephan2003.github.io/
	http://facebook-web-cloud.github.io/	Get hash	malicious	HTMLPhisher	Browse	facebook-web-cloud.github.io/
	http://unusualmanagementaccount.github.io/	Get hash	malicious	HTMLPhisher	Browse	unusualmanagementaccount.github.io/
	http://document001.github.io/	Get hash	malicious	HTMLPhisher	Browse	document001.github.io/
	http://vamsirednam.github.io/Netflix	Get hash	malicious	HTMLPhisher	Browse	vamsirednam.github.io/Netflix
	http://sreekanthv1995.github.io/netflix_clone	Get hash	malicious	HTMLPhisher	Browse	sreekanthv1995.github.io/netflix_clone
	http://steveidiot.github.io/BharatIntern-WebDevelopment-HomepageOfNetflix	Get hash	malicious	HTMLPhisher	Browse	steveidiot.github.io/BharatIntern-WebDevelopment-HomepageOfNetflix
	http://protons0010.github.io/facebook	Get hash	malicious	HTMLPhisher	Browse	protons0010.github.io/facebook
	http://varun180201.github.io/Netflix-clone	Get hash	malicious	HTMLPhisher	Browse	varun180201.github.io/Netflix-clone
	http://harshayerneni.github.io/Netflix-clone	Get hash	malicious	Unknown	Browse	harshayerneni.github.io/Netflix-clone

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Electronic Receipt for Carolann Campbell.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5ca2e05b-8782-4e1e-b65b-7b889d400e80.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6d24db.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a799329a-4404-404e-a67d-41e780226089.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240927144027Z-208.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Windows Analysis Report
Electronic Receipt for Carolann Campbell.pdf

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
plus.l.google.com	http://paypalloginin-usa.blogspot.is/	Get hash	malicious	PayPal Phisher	Browse	216.58.206.78
	https://metamaskinc.blogspot.in/	Get hash	malicious	Unknown	Browse	142.250.186.174
	http://dhl-express-group.blogspot.co.il/	Get hash	malicious	Unknown	Browse	216.58.206.78
	http://sallybracco7.wixsite.com/my-site/home-1	Get hash	malicious	HTMLPhisher	Browse	142.250.184.238
	https://swisscome.blogspot.co.at/	Get hash	malicious	Unknown	Browse	142.250.185.78
	http://comptabilitesasgac.wixsite.com/my-note-p/	Get hash	malicious	Unknown	Browse	142.250.186.110
	http://celinelerest01.wixsite.com/my-site-1/	Get hash	malicious	Unknown	Browse	142.250.181.238
	https://sites.google.com/view/loigfedrty/accueil	Get hash	malicious	Unknown	Browse	142.250.186.110
	http://dhl-express-group.blogspot.ba/	Get hash	malicious	Unknown	Browse	142.250.184.238
	http://identifiez-vous797.godaddysites.com/	Get hash	malicious	Unknown	Browse	142.250.184.206
www3.l.google.com	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	216.58.206.78
	file.exe	Get hash	malicious	Unknown	Browse	142.250.186.110
	file.exe	Get hash	malicious	Unknown	Browse	142.250.186.142
	file.exe	Get hash	malicious	Unknown	Browse	216.58.206.46
	file.exe	Get hash	malicious	Unknown	Browse	216.58.206.46
	file.exe	Get hash	malicious	Unknown	Browse	142.250.185.206
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	172.217.16.206
	file.exe	Get hash	malicious	Unknown	Browse	142.250.184.238
	file.exe	Get hash	malicious	Unknown	Browse	172.217.16.206
	http://www.tinu.be/WOwwytwpD/	Get hash	malicious	Unknown	Browse	142.250.186.46
youtube-ui.l.google.com	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	142.250.181.238
	file.exe	Get hash	malicious	Unknown	Browse	142.250.186.110
	file.exe	Get hash	malicious	Unknown	Browse	216.58.206.46
	file.exe	Get hash	malicious	Unknown	Browse	142.250.181.238
	file.exe	Get hash	malicious	Unknown	Browse	142.250.184.206
	file.exe	Get hash	malicious	Unknown	Browse	142.250.181.238
	file.exe	Get hash	malicious	Unknown	Browse	142.250.185.110
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	172.217.16.206
	file.exe	Get hash	malicious	Unknown	Browse	142.250.181.238
	file.exe	Get hash	malicious	Unknown	Browse	142.250.181.238

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	https://www.google.fr/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Fcasaderestauraciononline.com%2Fholy%2Findexsyn1.html%23cmltYS5hbWV1ckBjYXRhbGluYW1hcmtldGluZy5mcg==	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://changeofscene.ladesk.com/605425-Secure-Business-Documen	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://clicktracking.yellowbook.com/trackingenginewebapp/tracking.html?MB_ID=256862&SE_ID=9&AG_ID=2952701&AD_ID=6851395&kw=restaurants%20near%20me&kw_type=p&C_ID=874339&SE_AD_ID=73873744870314&se_clk_id=0651300f23401ca1b2e355991fb49377&hibu_site=0&redirect_url=https://femalewhowork.sa.com/rUswT/	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://sci-hub.tw/	Get hash	malicious	Unknown	Browse	151.101.2.217
	https://lkk6m.conownsup.com/tpgbE/	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	PO.xls	Get hash	malicious	Remcos	Browse	185.199.108.133
	ATT71725.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-3.3.5-1/rubyinstaller-devkit-3.3.5-1-x64.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	Aisha C. Yetman shared you a document..msg	Get hash	malicious	Unknown	Browse	151.101.66.137
AKAMAI-ASUS	https://kulodayplastomer-my.sharepoint.com/:f:/g/personal/exim_kpplindia_com/EpT6drgdzgdPk3kwQBUf2ZAB7JXXdY25CyMiKP-z5XBGWQ?e=8byFZY	Get hash	malicious	HTMLPhisher	Browse	23.38.98.68
	ATT71725.html	Get hash	malicious	HTMLPhisher	Browse	173.223.116.167
	Aisha C. Yetman shared you a document..msg	Get hash	malicious	Unknown	Browse	104.102.55.235
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjsulL2bcqZSGb5TVbFOhW-BzJJtb8_QJJBgbE1zqe78Ie8BMxsNyhIFwdKd0pdA90RMhgTdSzkU9EZ9vbhoKh9hWuvNOpIawTAXoH5R0ak3U5rG_o-sZZz3gEiDRvTxtIDu5LY0qOySZABWrjrj9OfeDXHmC1qe7sBrjM2U90kovZKuuD34ZvXQ_OD2Hq--rkZwnu_VhQVAySwVh2ojndP52NUX9X40zwPfUt6TCc4F2rNspoMzray6vSBsFLXUX7nVDHqqILMYBWJr9fSc6AC0-g4meRNvX0rdEgcGztZ5SXk2Zbb1UlFLMFg&sai=AMfl-YQ851Qqa8i013PHKiB6TgTZ-QzfEpO1vcyiniBLSOaNAv3siIC9L9LV3aRq_nbn81w6wFB7OvNqhOdGvo-t7Q&sig=Cg0ArKJSzNuc_g1R_f21EAE&fbs_aeid=&urlfix=1&adurl=https://t.events.caixabank.com/r/?id=h665ab089,6dc7f7ae,f89fd96&p1=d70r46aqireop.cloudfront.net%23QZ~MamRpYXpAZXZlcnNoZWRzLXN1dGhlcmxhbmQuZXM=	Get hash	malicious	HTMLPhisher	Browse	23.220.112.201
	kewyIO69TI.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	gZzI6gTYn4.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	U6b3tLFqN5.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	zlsXub68El.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	0UB3FIL25c.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
DIGITALOCEAN-ASNUS	file.exe	Get hash	malicious	LummaC	Browse	178.62.201.34
	nBjauMrrmC.exe	Get hash	malicious	FormBook	Browse	167.172.228.26
	https://madresbancolombia.mpache.co/	Get hash	malicious	Unknown	Browse	104.131.25.167
	https://bafybeidqje3fyzla6ot5zhmvxwb5ow3jropcax5pzesf3jh2tqryi6rxma.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	142.93.100.104
	http://ecometanexus.unids.com/	Get hash	malicious	Unknown	Browse	142.93.100.104
	http://aprackspace.serveusers.com/	Get hash	malicious	Unknown	Browse	157.230.23.237
	http://login-ourtime.members-datings.workers.dev/v3/aboutonlinedating	Get hash	malicious	HTMLPhisher	Browse	138.197.235.123
	https://uhcdenal.com/	Get hash	malicious	Unknown	Browse	206.189.225.178
	https://content.app-us1.com/kd4oo8/2024/09/26/7d3453ba-0845-4df1-80a7-42d15e30f736.pdf	Get hash	malicious	HTMLPhisher	Browse	165.227.251.217
	https://google.be/amp/enjin-io.net/	Get hash	malicious	Unknown	Browse	159.89.115.175
AMAZON-AESUS	https://changeofscene.ladesk.com/605425-Secure-Business-Documen	Get hash	malicious	HTMLPhisher	Browse	18.234.10.85
	https://smallpdf.com/sign-pdf/document#data=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2VzaWduLnNtYWxscGRmLXN0YWdpbmcuY29tIiwic3ViIjoiNjE3MmQyMzMtODcyNy00M2NhLWI1NjQtYjgwZDUyZjYxYmVjIiwiYXVkIjpbImVzaWduIl0sImV4cCI6MTcyODYzODEyMCwibmJmIjoxNzI3NDI4NTIwLCJpYXQiOjE3Mjc0Mjg1MjAsImp0aSI6IjYxNzJkMjMzLTg3MjctNDNjYS1iNTY0LWI4MGQ1MmY2MWJlYyIsInBheWxvYWQiOnsiZW52ZWxvcGVfaWQiOiI2ZWRlMzFjZS00Mzc2LTQwYzItYjJjNy1jMDc2Y2M3MjY4NjIiLCJzaWduX3JlcXVlc3RfaWQiOiI2MTcyZDIzMy04NzI3LTQzY2EtYjU2NC1iODBkNTJmNjFiZWMiLCJ0b2tlbl90eXBlIjoibm90aWZpY2F0aW9uIiwidXNlcl9lbWFpbCI6ImNoYW8ud3VAd3JpLm9yZyIsInVzZXJfZmlyc3RuYW1lIjoiY2hhby53dUB3cmkub3JnIiwidXNlcl9sYXN0bmFtZSI6ImNoYW8ud3VAd3JpLm9yZyJ9fQ.UX67GiHBKgjV8XyH-SFTt_KgB2I_q2j9cbGTSqbzRvY&eid=6ede31ce-4376-40c2-b2c7-c076cc726862&esrt=6172d233-8727-43ca-b564-b80d52f61bec	Get hash	malicious	Unknown	Browse	3.5.66.42
	https://www.vossloh-events.com/EMOS/Login.aspx?ReturnUrl=%2femos	Get hash	malicious	Unknown	Browse	3.220.53.221
	https://jbrizuelablplegal.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	34.195.119.102
	http://home-103607.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	50.19.89.137
	https://d2y5b082yylhnc.cloudfront.net/	Get hash	malicious	Unknown	Browse	3.5.28.155
	https://tiktok8.biz/	Get hash	malicious	Unknown	Browse	3.5.27.214
	http://bao.usdt888.net/	Get hash	malicious	Unknown	Browse	35.171.58.3
	http://home-101829.weeblysite.com/	Get hash	malicious	Unknown	Browse	50.19.89.137
	http://sky-102142.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	50.19.89.137

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	https://www.google.fr/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Fcasaderestauraciononline.com%2Fholy%2Findexsyn1.html%23cmltYS5hbWV1ckBjYXRhbGluYW1hcmtldGluZy5mcg==	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.114.59.183
	https://changeofscene.ladesk.com/605425-Secure-Business-Documen	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.114.59.183
	https://careeligibility.vercel.app/chubedan	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.114.59.183
	file.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	https://sci-hub.tw/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	file.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	http://webmail-7ba16a93.elod.com.br/?id=voiceofdesign.fr	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	http://specsavers.definition-ai.com	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	file.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.207657596053192
Encrypted:	false
SSDEEP:	6:PE0ELcBBUVq2PcNwi2nKuAl9OmbnIFUt82E0ELcT0gZmw+2E0ELcfYH0IkwOcNwM:PEvcBevLZHAahFUt82Evc5/+2EvcQv5h
MD5:	B6043CBB7ED6BAAA74594A67B1E112D8
SHA1:	940D63AF0E52809DCFDD3751D93CCC8110C47044
SHA-256:	0E47AF93A3BA508703D8B9D64D1B9B51570FDAC04501516FD15F9AB375F49C14
SHA-512:	10B0EA0F9CFB9072383BAA6F01DD49404B45604456A42A893828477BF6E2DEEFD113DDCE03B8D7BDF5BB7F56F150096FD3491E61DE21A14CFB7ECC9102271239
Malicious:	false
Reputation:	low
Preview:	2024/09/27-10:40:21.987 1db4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/09/27-10:40:21.990 1db4 Recovering log #3.2024/09/27-10:40:21.991 1db4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4657
Entropy (8bit):	7.917223420242452
Encrypted:	false
SSDEEP:	96:f+tcvjYJuBvnUAXd1XpD62cq2fDlFyANmVlL9MdpU9wo7:ac0WvXpG2BcflgGDKwo7
MD5:	167A8D64D846EDC2B009636D17582BDD
SHA1:	7ECCA71578241BE5F51C3AF478F5D60F95E6E191
SHA-256:	576A0A869E77E5A405BA34854CA7D3F290D5FBD9973E58B11B9B548DE850E172
SHA-512:	2C7A0C317ACCC779DA4F284E648746A2C2F41FF722DF0B7887D805404DAEB122A1446DA94BB1AE324EA37827FC3F16FDB2739281EEAC4BDB0CAE772BCA768D3F
Malicious:	false
Preview:	.PNG........IHDR...`...`......w8....IDATx..{PTW..[k...<v3.......[....d..DFE$F.FD......1..b#...J4`DEEC"....AA.A..#.."..v..8[....7{i.}.^NG...o54M..\|....M..M..6.&.D.h.J..Z.z}{zz....r.c...@..b.4......G...=..M.R.u.K.$I...9..l.h.......5.......!1...[[[.............^....8...AY_X.........-...O.'-~..I%.\|~. ...8...%..0ASS..wO......Gp.8.r..IdB~.DB..I.y}.Y.a=.,.kX...G...{.....PVV&Khoo.{.+G..t.01....o...>6..8d....)...Df.Aaa!...Css3tvvr{...m.q+.......O.^.8d..bW.d.s..................h,.&..zC....O..j..L.W.+'.^..,C...^.......e,C..D.P....z..r.vZ..;0.G.OQ../C...............K..!WIx.zC.....u.W....L..E{.p....5.X......klVT.uuu...."...e.J.......>...?}...S.%..Cy.@e....n...o.......7.b.w\...1{/M..7......kC...r..q..........0.'.K...l.NA.\|.z..C8..2t..-y}...."W....k.q3.n.b..#.........).,.K.;w...8.rtn\..[.J1.........].r........,E..@.H.'..'..5...^.z.....2.....Z..............s...@.2C.LY.P..W.(...0V.5.;../.......Q..Y.f.K8......&...@.h.w...90.!..n..2d2......H...7.b..3..

File type:	PDF document, version 1.4, 1 pages
Entropy (8bit):	7.897601185843962
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Electronic Receipt for Carolann Campbell.pdf
File size:	71'811 bytes
MD5:	677f99c2bfd3de62e11ac90c44254fc8
SHA1:	0544869264904f703f52dc79b507a8594cfe4c44
SHA256:	f728d07cf9ee8f30fadd0c9e389cb1a4c1d94c03ec68fd976e917146aea33873
SHA512:	ebbf1e2d8ca7447e9344dce955c475e89265d141d8e3fd694a876b5e0b85161937f437b76854af8731f34fd773eed0e35a390932a58fd9f338b126bf00260cc0
SSDEEP:	1536:YfJ4eW93c4KC6JUm9ovshIUywWv8QUoZV61/cYf9:YWeW98C679hIUywWv8Q3b2f9
TLSH:	5B63DF7BE80837ACC795C7D2EE233687697D70E90F8696CB1E2C8991280C504DBBF561
File Content Preview:	%PDF-1.4.............. ! . ..... . . . . . . ........ . O Hk KLL 9 2 OH X E # e -=K %g d Q P j` G` { 9( C3 _ 1ZTkrf 7 _)J> U0 ] o d {E BYn ......................................

General
Header:	%PDF-1.4Ãƒ\x90
Total Entropy:	7.897601
Total Bytes:	71811
Stream Entropy:	7.995244
Stream Bytes:	61519
Entropy outside Streams:	5.135359
Bytes outside Streams:	10292
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	31
endobj	31
stream	10
endstream	10
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	14
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

ID	DHASH	MD5	Preview
6	0000000000000000	fdda827b0288c9be4e93817da3e71081
8	0404062a6c525e06	0d3ea7540d369c250d3397855404bb59

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 16:40:49.472121954 CEST	192.168.2.7	1.1.1.1	0x57d0	Standard query (0)	equable-toothpaste.surge.sh	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:40:49.472439051 CEST	192.168.2.7	1.1.1.1	0x37d4	Standard query (0)	equable-toothpaste.surge.sh	65	IN (0x0001)	false
Sep 27, 2024 16:40:50.793917894 CEST	192.168.2.7	1.1.1.1	0x1ff1	Standard query (0)	sharedfiles2.github.io	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:40:50.794096947 CEST	192.168.2.7	1.1.1.1	0x41e1	Standard query (0)	sharedfiles2.github.io	65	IN (0x0001)	false
Sep 27, 2024 16:40:51.638699055 CEST	192.168.2.7	1.1.1.1	0x860e	Standard query (0)	pbs.twimg.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:40:51.638772964 CEST	192.168.2.7	1.1.1.1	0xf1be	Standard query (0)	pbs.twimg.com	65	IN (0x0001)	false
Sep 27, 2024 16:40:52.827011108 CEST	192.168.2.7	1.1.1.1	0xdb06	Standard query (0)	pbs.twimg.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:40:52.827167988 CEST	192.168.2.7	1.1.1.1	0x5f12	Standard query (0)	pbs.twimg.com	65	IN (0x0001)	false
Sep 27, 2024 16:40:52.913157940 CEST	192.168.2.7	1.1.1.1	0xf0ac	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:40:52.913415909 CEST	192.168.2.7	1.1.1.1	0xa32c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:00.868562937 CEST	192.168.2.7	1.1.1.1	0xd2b0	Standard query (0)	tasty-library.surge.sh	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:00.868741989 CEST	192.168.2.7	1.1.1.1	0x72ba	Standard query (0)	tasty-library.surge.sh	65	IN (0x0001)	false
Sep 27, 2024 16:41:01.913028955 CEST	192.168.2.7	1.1.1.1	0xf796	Standard query (0)	artzoya.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:01.913233042 CEST	192.168.2.7	1.1.1.1	0xaa00	Standard query (0)	artzoya.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:08.565288067 CEST	192.168.2.7	1.1.1.1	0x8c4	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:08.565479040 CEST	192.168.2.7	1.1.1.1	0x958d	Standard query (0)	google.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:10.611036062 CEST	192.168.2.7	1.1.1.1	0x4c91	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:10.611238003 CEST	192.168.2.7	1.1.1.1	0x8dbb	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:17.119574070 CEST	192.168.2.7	1.1.1.1	0xd957	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:17.119776964 CEST	192.168.2.7	1.1.1.1	0xf5d1	Standard query (0)	ogs.google.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:17.130150080 CEST	192.168.2.7	1.1.1.1	0xefe4	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:17.130595922 CEST	192.168.2.7	1.1.1.1	0xdb5b	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:18.102649927 CEST	192.168.2.7	1.1.1.1	0x486e	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:18.102859020 CEST	192.168.2.7	1.1.1.1	0xb6e1	Standard query (0)	play.google.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:18.351227999 CEST	192.168.2.7	1.1.1.1	0xebc9	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:18.351398945 CEST	192.168.2.7	1.1.1.1	0x6b45	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:19.108112097 CEST	192.168.2.7	1.1.1.1	0x9fc3	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:19.108309031 CEST	192.168.2.7	1.1.1.1	0x83d6	Standard query (0)	play.google.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:32.583745956 CEST	192.168.2.7	1.1.1.1	0x411a	Standard query (0)	recovertogether.withgoogle.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:32.585057020 CEST	192.168.2.7	1.1.1.1	0x8a61	Standard query (0)	recovertogether.withgoogle.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:35.705112934 CEST	192.168.2.7	1.1.1.1	0xe64e	Standard query (0)	recovertogether.withgoogle.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:35.705306053 CEST	192.168.2.7	1.1.1.1	0x3836	Standard query (0)	recovertogether.withgoogle.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:35.845535040 CEST	192.168.2.7	1.1.1.1	0xb127	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:35.845805883 CEST	192.168.2.7	1.1.1.1	0x9697	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:37.312314034 CEST	192.168.2.7	1.1.1.1	0xce41	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:37.312469959 CEST	192.168.2.7	1.1.1.1	0x1d0f	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:40.365004063 CEST	192.168.2.7	1.1.1.1	0x99a8	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:40.365305901 CEST	192.168.2.7	1.1.1.1	0xaaf1	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:42.309793949 CEST	192.168.2.7	1.1.1.1	0x8c82	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:42.309963942 CEST	192.168.2.7	1.1.1.1	0x17c6	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:44.618680000 CEST	192.168.2.7	1.1.1.1	0x19d0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:44.618840933 CEST	192.168.2.7	1.1.1.1	0x8560	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 27, 2024 16:41:47.710767984 CEST	192.168.2.7	1.1.1.1	0x5d69	Standard query (0)	sustainability.google	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:47.710920095 CEST	192.168.2.7	1.1.1.1	0xedca	Standard query (0)	sustainability.google	65	IN (0x0001)	false
Sep 27, 2024 16:41:51.660588026 CEST	192.168.2.7	1.1.1.1	0xbb0b	Standard query (0)	sustainability.google	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:51.660780907 CEST	192.168.2.7	1.1.1.1	0x8be	Standard query (0)	sustainability.google	65	IN (0x0001)	false
Sep 27, 2024 16:41:54.248897076 CEST	192.168.2.7	1.1.1.1	0xedcd	Standard query (0)	www.blog.google	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:54.249064922 CEST	192.168.2.7	1.1.1.1	0x1c1c	Standard query (0)	www.blog.google	65	IN (0x0001)	false
Sep 27, 2024 16:41:55.594158888 CEST	192.168.2.7	1.1.1.1	0x6680	Standard query (0)	blog.google	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:55.594284058 CEST	192.168.2.7	1.1.1.1	0x1f93	Standard query (0)	blog.google	65	IN (0x0001)	false
Sep 27, 2024 16:41:56.417792082 CEST	192.168.2.7	1.1.1.1	0x2bda	Standard query (0)	blog.google	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:41:56.418091059 CEST	192.168.2.7	1.1.1.1	0x504b	Standard query (0)	blog.google	65	IN (0x0001)	false
Sep 27, 2024 16:42:21.495608091 CEST	192.168.2.7	1.1.1.1	0xbf33	Standard query (0)	googletagmanager.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:42:21.495810986 CEST	192.168.2.7	1.1.1.1	0x7309	Standard query (0)	googletagmanager.com	65	IN (0x0001)	false
Sep 27, 2024 16:42:21.653539896 CEST	192.168.2.7	1.1.1.1	0xac0e	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:42:21.653670073 CEST	192.168.2.7	1.1.1.1	0xa9ae	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Sep 27, 2024 16:42:29.952378035 CEST	192.168.2.7	1.1.1.1	0x2b04	Standard query (0)	csp.withgoogle.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:42:29.952528954 CEST	192.168.2.7	1.1.1.1	0x8956	Standard query (0)	csp.withgoogle.com	65	IN (0x0001)	false
Sep 27, 2024 16:42:33.699254990 CEST	192.168.2.7	1.1.1.1	0xef67	Standard query (0)	mail.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:42:33.699390888 CEST	192.168.2.7	1.1.1.1	0x27fe	Standard query (0)	mail.google.com	65	IN (0x0001)	false
Sep 27, 2024 16:42:38.646554947 CEST	192.168.2.7	1.1.1.1	0x5c1d	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:42:38.646719933 CEST	192.168.2.7	1.1.1.1	0xe611	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Sep 27, 2024 16:42:38.733695984 CEST	192.168.2.7	1.1.1.1	0x6f99	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:42:38.734062910 CEST	192.168.2.7	1.1.1.1	0xac5d	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Sep 27, 2024 16:42:38.890635014 CEST	192.168.2.7	1.1.1.1	0x80d7	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:42:50.277615070 CEST	192.168.2.7	1.1.1.1	0xb5e6	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:42:50.277786016 CEST	192.168.2.7	1.1.1.1	0xa595	Standard query (0)	play.google.com	65	IN (0x0001)	false
Sep 27, 2024 16:42:51.262656927 CEST	192.168.2.7	1.1.1.1	0x5778	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:42:51.262928009 CEST	192.168.2.7	1.1.1.1	0xc353	Standard query (0)	play.google.com	65	IN (0x0001)	false
Sep 27, 2024 16:42:54.346112013 CEST	192.168.2.7	1.1.1.1	0xa994	Standard query (0)	smallbusiness.withgoogle.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:42:54.346388102 CEST	192.168.2.7	1.1.1.1	0xdc71	Standard query (0)	smallbusiness.withgoogle.com	65	IN (0x0001)	false
Sep 27, 2024 16:42:55.551691055 CEST	192.168.2.7	1.1.1.1	0xa80c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:42:55.551896095 CEST	192.168.2.7	1.1.1.1	0xf016	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 27, 2024 16:42:55.560535908 CEST	192.168.2.7	1.1.1.1	0x2b8c	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:42:55.560736895 CEST	192.168.2.7	1.1.1.1	0x543c	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Sep 27, 2024 16:42:56.619210005 CEST	192.168.2.7	1.1.1.1	0x3efa	Standard query (0)	smallbusiness.withgoogle.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:42:56.619590044 CEST	192.168.2.7	1.1.1.1	0xec3	Standard query (0)	smallbusiness.withgoogle.com	65	IN (0x0001)	false
Sep 27, 2024 16:43:01.594855070 CEST	192.168.2.7	1.1.1.1	0x245e	Standard query (0)	survey.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:43:01.595099926 CEST	192.168.2.7	1.1.1.1	0x2f9f	Standard query (0)	survey.g.doubleclick.net	65	IN (0x0001)	false
Sep 27, 2024 16:43:03.099467039 CEST	192.168.2.7	1.1.1.1	0xbe5e	Standard query (0)	about.google	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:43:03.099467039 CEST	192.168.2.7	1.1.1.1	0x4bcc	Standard query (0)	about.google	65	IN (0x0001)	false
Sep 27, 2024 16:43:06.171075106 CEST	192.168.2.7	1.1.1.1	0xe291	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:43:06.171327114 CEST	192.168.2.7	1.1.1.1	0xe580	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Sep 27, 2024 16:43:06.912398100 CEST	192.168.2.7	1.1.1.1	0xc36f	Standard query (0)	about.google	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:43:06.913223028 CEST	192.168.2.7	1.1.1.1	0xd6e5	Standard query (0)	about.google	65	IN (0x0001)	false
Sep 27, 2024 16:43:13.945504904 CEST	192.168.2.7	1.1.1.1	0x1c96	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:43:44.661566973 CEST	192.168.2.7	1.1.1.1	0x41c2	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false