Edit tour

Windows Analysis Report
FA-EDI-2409-0280.pdf

Overview

General Information

Sample name:	FA-EDI-2409-0280.pdf
Analysis ID:	1525475
MD5:	8d65098e335bdc5e3b5ab43f42e0c69b
SHA1:	03f1c56e1696a97edf59439dba262105c739554d
SHA256:	6a3208e585f53c1ada70aa5abaf89e6b6ebef375caa61217c187c8f79ffb969b
Infos:

Detection

Score:	25
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

HTML page contains obfuscated javascript

Connects to several IPs in different countries

Detected hidden input values containing email addresses (often used in phishing pages)

Detected suspicious crossdomain redirect

Found iframes

HTML body contains low number of good links

HTML page contains hidden javascript code

IP address seen in connection with other malware

Invalid T&C link found

JA3 SSL client fingerprint seen in connection with other malware

No HTML title found

PDF has an OpenAction (likely to launch a dropper script)

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 424 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\FA-EDI-2409-0280.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7040 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2996 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1740,i,4004120980904792418,12153791403947030670,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8084 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "http://www.tcpdf.org" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7116 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2212,i,18367372152763981669,441212640499137429,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST /el/AGSKWxVEbUKtG6EO-1z6hVlLyFBjoY6Q3qOn6xnbTKbfsUThUZc_fEi_i1LtIAukBDqFn3rRJOPdhMteh2TItUOHoophCKqkwOMTxtMiYOBGSJjuIMX_Bc9zOs_37csKF31TnOhYCpeRMg== HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-aliveContent-Length: 247sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plainAccept: */*Origin: https://tcpdf.orgX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://tecnick.com/	HTTP Parser: Iframe src: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html#aHR0cHM6Ly9kY2xrLW1hdGNoLmRvdG9taS5jb20vbWF0Y2gvYm91bmNlL2N1cnJlbnQ_bmV0d29ya0lkPTE0MDAwJnZlcnNpb249MSZnb29nbGVfZ2lkPUNBRVNFSzU0ZVlONUxQS1RQSW9iT2g2LUgtQSZnb29nbGVfY3Zlcj0xJmdvb2dsZV9wdXNoPUFYY29PbVQ2d0Y5Zkx6aml2eHRENFExYW8tSWtvZFpxdXVCN0xFOUpqU29wa3dOTW1XbHRWNVBoX0RTRjdkRkJlQnRQbmg0aE1DNVJ4andjRmRtOFptZ0IxeGp6WjJMMmxPRkVjUmM=,aHR0cHM6Ly9hLnRyaWJhbGZ1c2lvbi5jb20vaS5tYXRjaD9wPWI2JnU9Q0FFU0VDTlIwclJiTVBPajRwbUpPZWJSX2swJmdvb2dsZV9jdmVyPTEmZ29vZ2xlX3B1c2g9QVhjb09tUTQ1RF9OdmU1b0hFdm1MN0pGQ1EzejhQbDFOZ1RuWUZVazJMT21wcjBYblV3alJFWVNHd1RLTVZIVjZ5X0hJY3ByXzRkM0RpUzQzbWFqYWtKNjE1VnR4Ry1tcjRxakROMCZyZWRpcmVjdD1odHRwcyUzQS8vY20uZy5kb3VibGVjbGljay5uZXQvcGl4ZWwlM0Znb29nbGVfbmlkJTNEZXhwJTI2Z29vZ2xlX3B1c2glM0RBWGNvT21RNDVEX052ZTVvSEV2bUw3SkZDUTN6OFBsMU5nVG5ZRlVrMkxPbXByMFhuVXdqUkVZU0d3VEtNVkhWNnlfSEljcHJfNGQzRGlTNDNtYWpha0o2MTVWdHhHLW1yNHFqRE4wJTI2Z29vZ2xlX3VsYSUzRDI3ODY5NTQlMjZnb29nbGVfaG0lM0QlMjRURl9VU0VSX0lEX0VOQyUyNA==,aHR0cHM6Ly9kaXMuY3JpdGVvLmNvbS9kaXMvdXNlcnN5bmMuYXNweD9yPTQmcD0xNCZjcD1nb29nbGUmY3U9MSZ1cmw9aHR0cHMlM0ElMkYlMkZjbS5nLmRvdWJsZWNsaWNrLm5ldCUyRnBpeGVsJTNGZ29vZ2xlX25pZCUzRGNqcCUyNmdvb2dsZV9obSUzRCU0MCU0MENSSVRFT19VU0VSSUQlNDAlNDAlMjZnb29nbGVfcHVzaCUzREFYY29PbVNoWmhmQzQtTjNLSWIydERlcVJsZnNjMk9CaEdnYThPTVpHdXZDRk5GMVBTMEpLY3Z0Y2F6eEpWMEdvOG0xcUk0RFY4VnlSc1lXYU5razN6VUNzS0I1TjJDa0VDUzNxUSZnb29nbGVfZ2lkPUNBRVNFS0tVZlpvakEyUFdUUHNyeE4zN2hycyZnb29nbGVfY3Zlcj0x,aHR0cHM6Ly9jMS5hZGZvcm0ubmV0L3NlcnZpbmcvY29va2llL21hdGNoLz9wYXJ0eT0xJmdvb2dsZV9naWQ9Q0FFU0VKU255REthc0YzM1FodU5SY2d1bXBrJmdvb2dsZV9jdmVyPTEmZ29vZ2xlX3B1c2g9QVhjb09tVDJOZG1ISVdXd1JvUnhXMVZ1dzdreHYtWF80ZUc3UEV2UTdOelRIMTd2ZzhtZkUyei1EazJsXzZSQVZ6SGh6SUpDVFgwbnZqNlJzWE5LU05WdDl0UndnNWh3d1RaUmZB,aHR0cHM6Ly9vbmV0YWctc3lzLmNvbS9tYXRjaC8_aW50X2lkPTE5JnJlZGlyPTEmZ29vZ2xlX2dpZD1DQUVTRUdLSUUyZzBSWHhXRC1xc3ZINFBfS1UmZ29vZ2xlX2N2ZXI9MSZnb29nbGVfcHVzaD1BWGNvT21SRXlER1pyRjU4c05ZSmc0dEVXWmtiYXI2YS1DSXM2S0d2aEhwQjBYT3FkWVZ4bVRkQloyR01RWmhwSlU4WDR6VkZvamk2LUhWaVAtVjEwa1QySWExZ2N2YWpfNDhxR1Bn,aHR0cHM6Ly9zeW5jLWRtcC5hdXJhLWRzcC5jb20vbWF0Y2gvZ29vZ2xlP2dvb2dsZV9naWQ9Q0FFU0VHM1gzZ0lQeDFhMVllSUVtVkhlSDdNJmdvb2dsZV9jdmVyPTEmZ29vZ2xlX3B1c2g9QVhjb09tUkR1TGRyWXR2dkd6QU5QXzVnLXlUM0xvU2xVSVNCV3Bib1VDUzFYbHhNTjZMVEVpNVhvbWRXLVF1WWZla2cySkFVX1JUZlhPS1AwM0Nua3YzN1A4V3JKYUJvWk91Rk9mdVo=,aHR0cHM6Ly9ndy1pYWQtYmlkLnltbW9iaS5jb20vYWR4L3VzZXIvY29va2llX3N5bj9wdWJpZD1aMjl2WjJ4bFlXUjQmZ29vZ2xlX2dpZD1DQUVTRUdDRnY0LWJhTklwY0pzMzdpWHg1bTAmZ29vZ2xlX2N2ZXI9MSZnb29nbGVfcHVzaD1BWGNvT21RNzhwN3RPQUZvdmU3Z3FKZ21QZXh4LUV4dXZUY0dRbm9wOUVqNVV3Nk1ZR2hkdnJ2Vl9sd1NjbG9udDZ5bGZRZDlHU214cHVGLXlWRXo1cGRZdXhHQW5oYThLUW9Falh0SA==,aHR0cHM6Ly9jbS5nLmRvdWJsZWNsaWNrLm5ldC9waXhlbC9hdHRyP2Q9QUhORjEzTHRZUlBNVGc3NFVhN3dtdWx4cEhHX3gyRC04bEdlMkRSZlZkekoxdWtnVGZncHpwamlUWDNTNS1tOXBZaU43anVvWVFKRTZoNA==
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-NJ3VGL8
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: Iframe src: https://checkmk.com/cf-bc-handler.html
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-NJ3VGL8
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: Iframe src: https://checkmk.com/cf-bc-handler.html
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-NJ3VGL8
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: Iframe src: https://checkmk.com/cf-bc-handler.html
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-NJ3VGL8
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: Iframe src: https://checkmk.com/cf-bc-handler.html
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-NJ3VGL8
Source: https://tecnick.com/#google_vignette	HTTP Parser: Iframe src: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html#aHR0cHM6Ly9kY2xrLW1hdGNoLmRvdG9taS5jb20vbWF0Y2gvYm91bmNlL2N1cnJlbnQ_bmV0d29ya0lkPTE0MDAwJnZlcnNpb249MSZnb29nbGVfZ2lkPUNBRVNFSzU0ZVlONUxQS1RQSW9iT2g2LUgtQSZnb29nbGVfY3Zlcj0xJmdvb2dsZV9wdXNoPUFYY29PbVQ2d0Y5Zkx6aml2eHRENFExYW8tSWtvZFpxdXVCN0xFOUpqU29wa3dOTW1XbHRWNVBoX0RTRjdkRkJlQnRQbmg0aE1DNVJ4andjRmRtOFptZ0IxeGp6WjJMMmxPRkVjUmM=,aHR0cHM6Ly9hLnRyaWJhbGZ1c2lvbi5jb20vaS5tYXRjaD9wPWI2JnU9Q0FFU0VDTlIwclJiTVBPajRwbUpPZWJSX2swJmdvb2dsZV9jdmVyPTEmZ29vZ2xlX3B1c2g9QVhjb09tUTQ1RF9OdmU1b0hFdm1MN0pGQ1EzejhQbDFOZ1RuWUZVazJMT21wcjBYblV3alJFWVNHd1RLTVZIVjZ5X0hJY3ByXzRkM0RpUzQzbWFqYWtKNjE1VnR4Ry1tcjRxakROMCZyZWRpcmVjdD1odHRwcyUzQS8vY20uZy5kb3VibGVjbGljay5uZXQvcGl4ZWwlM0Znb29nbGVfbmlkJTNEZXhwJTI2Z29vZ2xlX3B1c2glM0RBWGNvT21RNDVEX052ZTVvSEV2bUw3SkZDUTN6OFBsMU5nVG5ZRlVrMkxPbXByMFhuVXdqUkVZU0d3VEtNVkhWNnlfSEljcHJfNGQzRGlTNDNtYWpha0o2MTVWdHhHLW1yNHFqRE4wJTI2Z29vZ2xlX3VsYSUzRDI3ODY5NTQlMjZnb29nbGVfaG0lM0QlMjRURl9VU0VSX0lEX0VOQyUyNA==,aHR0cHM6Ly9kaXMuY3JpdGVvLmNvbS9kaXMvdXNlcnN5bmMuYXNweD9yPTQmcD0xNCZjcD1nb29nbGUmY3U9MSZ1cmw9aHR0cHMlM0ElMkYlMkZjbS5nLmRvdWJsZWNsaWNrLm5ldCUyRnBpeGVsJTNGZ29vZ2xlX25pZCUzRGNqcCUyNmdvb2dsZV9obSUzRCU0MCU0MENSSVRFT19VU0VSSUQlNDAlNDAlMjZnb29nbGVfcHVzaCUzREFYY29PbVNoWmhmQzQtTjNLSWIydERlcVJsZnNjMk9CaEdnYThPTVpHdXZDRk5GMVBTMEpLY3Z0Y2F6eEpWMEdvOG0xcUk0RFY4VnlSc1lXYU5razN6VUNzS0I1TjJDa0VDUzNxUSZnb29nbGVfZ2lkPUNBRVNFS0tVZlpvakEyUFdUUHNyeE4zN2hycyZnb29nbGVfY3Zlcj0x,aHR0cHM6Ly9jMS5hZGZvcm0ubmV0L3NlcnZpbmcvY29va2llL21hdGNoLz9wYXJ0eT0xJmdvb2dsZV9naWQ9Q0FFU0VKU255REthc0YzM1FodU5SY2d1bXBrJmdvb2dsZV9jdmVyPTEmZ29vZ2xlX3B1c2g9QVhjb09tVDJOZG1ISVdXd1JvUnhXMVZ1dzdreHYtWF80ZUc3UEV2UTdOelRIMTd2ZzhtZkUyei1EazJsXzZSQVZ6SGh6SUpDVFgwbnZqNlJzWE5LU05WdDl0UndnNWh3d1RaUmZB,aHR0cHM6Ly9vbmV0YWctc3lzLmNvbS9tYXRjaC8_aW50X2lkPTE5JnJlZGlyPTEmZ29vZ2xlX2dpZD1DQUVTRUdLSUUyZzBSWHhXRC1xc3ZINFBfS1UmZ29vZ2xlX2N2ZXI9MSZnb29nbGVfcHVzaD1BWGNvT21SRXlER1pyRjU4c05ZSmc0dEVXWmtiYXI2YS1DSXM2S0d2aEhwQjBYT3FkWVZ4bVRkQloyR01RWmhwSlU4WDR6VkZvamk2LUhWaVAtVjEwa1QySWExZ2N2YWpfNDhxR1Bn,aHR0cHM6Ly9zeW5jLWRtcC5hdXJhLWRzcC5jb20vbWF0Y2gvZ29vZ2xlP2dvb2dsZV9naWQ9Q0FFU0VHM1gzZ0lQeDFhMVllSUVtVkhlSDdNJmdvb2dsZV9jdmVyPTEmZ29vZ2xlX3B1c2g9QVhjb09tUkR1TGRyWXR2dkd6QU5QXzVnLXlUM0xvU2xVSVNCV3Bib1VDUzFYbHhNTjZMVEVpNVhvbWRXLVF1WWZla2cySkFVX1JUZlhPS1AwM0Nua3YzN1A4V3JKYUJvWk91Rk9mdVo=,aHR0cHM6Ly9ndy1pYWQtYmlkLnltbW9iaS5jb20vYWR4L3VzZXIvY29va2llX3N5bj9wdWJpZD1aMjl2WjJ4bFlXUjQmZ29vZ2xlX2dpZD1DQUVTRUdDRnY0LWJhTklwY0pzMzdpWHg1bTAmZ29vZ2xlX2N2ZXI9MSZnb29nbGVfcHVzaD1BWGNvT21RNzhwN3RPQUZvdmU3Z3FKZ21QZXh4LUV4dXZUY0dRbm9wOUVqNVV3Nk1ZR2hkdnJ2Vl9sd1NjbG9udDZ5bGZRZDlHU214cHVGLXlWRXo1cGRZdXhHQW5oYThLUW9Falh0SA==,aHR0cHM6Ly9jbS5nLmRvdWJsZWNsaWNrLm5ldC9waXhlbC9hdHRyP2Q9QUhORjEzTHRZUlBNVGc3NFVhN3dtdWx4cEhHX3gyRC04bEdlMkRSZlZkekoxdWtnVGZncHpwamlUWDNTNS1tOXBZaU43anVvWVFKRTZoNA==
Source: https://tecnick.com/#google_vignette	HTTP Parser: Iframe src: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html#aHR0cHM6Ly9kY2xrLW1hdGNoLmRvdG9taS5jb20vbWF0Y2gvYm91bmNlL2N1cnJlbnQ_bmV0d29ya0lkPTE0MDAwJnZlcnNpb249MSZnb29nbGVfZ2lkPUNBRVNFSzU0ZVlONUxQS1RQSW9iT2g2LUgtQSZnb29nbGVfY3Zlcj0xJmdvb2dsZV9wdXNoPUFYY29PbVQ2d0Y5Zkx6aml2eHRENFExYW8tSWtvZFpxdXVCN0xFOUpqU29wa3dOTW1XbHRWNVBoX0RTRjdkRkJlQnRQbmg0aE1DNVJ4andjRmRtOFptZ0IxeGp6WjJMMmxPRkVjUmM=,aHR0cHM6Ly9hLnRyaWJhbGZ1c2lvbi5jb20vaS5tYXRjaD9wPWI2JnU9Q0FFU0VDTlIwclJiTVBPajRwbUpPZWJSX2swJmdvb2dsZV9jdmVyPTEmZ29vZ2xlX3B1c2g9QVhjb09tUTQ1RF9OdmU1b0hFdm1MN0pGQ1EzejhQbDFOZ1RuWUZVazJMT21wcjBYblV3alJFWVNHd1RLTVZIVjZ5X0hJY3ByXzRkM0RpUzQzbWFqYWtKNjE1VnR4Ry1tcjRxakROMCZyZWRpcmVjdD1odHRwcyUzQS8vY20uZy5kb3VibGVjbGljay5uZXQvcGl4ZWwlM0Znb29nbGVfbmlkJTNEZXhwJTI2Z29vZ2xlX3B1c2glM0RBWGNvT21RNDVEX052ZTVvSEV2bUw3SkZDUTN6OFBsMU5nVG5ZRlVrMkxPbXByMFhuVXdqUkVZU0d3VEtNVkhWNnlfSEljcHJfNGQzRGlTNDNtYWpha0o2MTVWdHhHLW1yNHFqRE4wJTI2Z29vZ2xlX3VsYSUzRDI3ODY5NTQlMjZnb29nbGVfaG0lM0QlMjRURl9VU0VSX0lEX0VOQyUyNA==,aHR0cHM6Ly9kaXMuY3JpdGVvLmNvbS9kaXMvdXNlcnN5bmMuYXNweD9yPTQmcD0xNCZjcD1nb29nbGUmY3U9MSZ1cmw9aHR0cHMlM0ElMkYlMkZjbS5nLmRvdWJsZWNsaWNrLm5ldCUyRnBpeGVsJTNGZ29vZ2xlX25pZCUzRGNqcCUyNmdvb2dsZV9obSUzRCU0MCU0MENSSVRFT19VU0VSSUQlNDAlNDAlMjZnb29nbGVfcHVzaCUzREFYY29PbVNoWmhmQzQtTjNLSWIydERlcVJsZnNjMk9CaEdnYThPTVpHdXZDRk5GMVBTMEpLY3Z0Y2F6eEpWMEdvOG0xcUk0RFY4VnlSc1lXYU5razN6VUNzS0I1TjJDa0VDUzNxUSZnb29nbGVfZ2lkPUNBRVNFS0tVZlpvakEyUFdUUHNyeE4zN2hycyZnb29nbGVfY3Zlcj0x,aHR0cHM6Ly9jMS5hZGZvcm0ubmV0L3NlcnZpbmcvY29va2llL21hdGNoLz9wYXJ0eT0xJmdvb2dsZV9naWQ9Q0FFU0VKU255REthc0YzM1FodU5SY2d1bXBrJmdvb2dsZV9jdmVyPTEmZ29vZ2xlX3B1c2g9QVhjb09tVDJOZG1ISVdXd1JvUnhXMVZ1dzdreHYtWF80ZUc3UEV2UTdOelRIMTd2ZzhtZkUyei1EazJsXzZSQVZ6SGh6SUpDVFgwbnZqNlJzWE5LU05WdDl0UndnNWh3d1RaUmZB,aHR0cHM6Ly9vbmV0YWctc3lzLmNvbS9tYXRjaC8_aW50X2lkPTE5JnJlZGlyPTEmZ29vZ2xlX2dpZD1DQUVTRUdLSUUyZzBSWHhXRC1xc3ZINFBfS1UmZ29vZ2xlX2N2ZXI9MSZnb29nbGVfcHVzaD1BWGNvT21SRXlER1pyRjU4c05ZSmc0dEVXWmtiYXI2YS1DSXM2S0d2aEhwQjBYT3FkWVZ4bVRkQloyR01RWmhwSlU4WDR6VkZvamk2LUhWaVAtVjEwa1QySWExZ2N2YWpfNDhxR1Bn,aHR0cHM6Ly9zeW5jLWRtcC5hdXJhLWRzcC5jb20vbWF0Y2gvZ29vZ2xlP2dvb2dsZV9naWQ9Q0FFU0VHM1gzZ0lQeDFhMVllSUVtVkhlSDdNJmdvb2dsZV9jdmVyPTEmZ29vZ2xlX3B1c2g9QVhjb09tUkR1TGRyWXR2dkd6QU5QXzVnLXlUM0xvU2xVSVNCV3Bib1VDUzFYbHhNTjZMVEVpNVhvbWRXLVF1WWZla2cySkFVX1JUZlhPS1AwM0Nua3YzN1A4V3JKYUJvWk91Rk9mdVo=,aHR0cHM6Ly9ndy1pYWQtYmlkLnltbW9iaS5jb20vYWR4L3VzZXIvY29va2llX3N5bj9wdWJpZD1aMjl2WjJ4bFlXUjQmZ29vZ2xlX2dpZD1DQUVTRUdDRnY0LWJhTklwY0pzMzdpWHg1bTAmZ29vZ2xlX2N2ZXI9MSZnb29nbGVfcHVzaD1BWGNvT21RNzhwN3RPQUZvdmU3Z3FKZ21QZXh4LUV4dXZUY0dRbm9wOUVqNVV3Nk1ZR2hkdnJ2Vl9sd1NjbG9udDZ5bGZRZDlHU214cHVGLXlWRXo1cGRZdXhHQW5oYThLUW9Falh0SA==,aHR0cHM6Ly9jbS5nLmRvdWJsZWNsaWNrLm5ldC9waXhlbC9hdHRyP2Q9QUhORjEzTHRZUlBNVGc3NFVhN3dtdWx4cEhHX3gyRC04bEdlMkRSZlZkekoxdWtnVGZncHpwamlUWDNTNS1tOXBZaU43anVvWVFKRTZoNA==

Source: https://tecnick.com/	HTTP Parser: Number of links: 0
Source: https://tecnick.com/#google_vignette	HTTP Parser: Number of links: 0

Source: https://tecnick.com/	HTTP Parser: Invalid link: privacy policy
Source: https://tecnick.com/	HTTP Parser: Invalid link: privacy policy
Source: https://tecnick.com/#google_vignette	HTTP Parser: Invalid link: privacy policy
Source: https://tecnick.com/#google_vignette	HTTP Parser: Invalid link: privacy policy
Source: https://tecnick.com/#google_vignette	HTTP Parser: Invalid link: privacy policy
Source: https://tecnick.com/#google_vignette	HTTP Parser: Invalid link: privacy policy

Source: https://tecnick.com/	HTTP Parser: HTML title missing
Source: https://tecnick.com/#google_vignette	HTTP Parser: HTML title missing
Source: https://tecnick.com/#google_vignette	HTTP Parser: HTML title missing

Source: https://tcpdf.org/	HTTP Parser: No favicon
Source: https://tcpdf.org/	HTTP Parser: No favicon
Source: https://tcpdf.org/	HTTP Parser: No favicon
Source: https://tcpdf.org/	HTTP Parser: No favicon
Source: https://tcpdf.org/	HTTP Parser: No favicon
Source: https://tcpdf.org/examples/	HTTP Parser: No favicon
Source: https://tcpdf.org/examples/	HTTP Parser: No favicon
Source: https://tcpdf.org/examples/	HTTP Parser: No favicon
Source: https://tcpdf.org/examples/	HTTP Parser: No favicon
Source: https://tcpdf.org/examples/	HTTP Parser: No favicon
Source: https://tcpdf.org/examples/	HTTP Parser: No favicon
Source: https://tcpdf.org/#google_vignette	HTTP Parser: No favicon
Source: https://tcpdf.org/#google_vignette	HTTP Parser: No favicon
Source: https://www.paypal.com/donate/?cmd=_donations&currency_code=GBP&business=paypal@tecnick.com&item_name=donation%20for%20tc-lib-pdf%20project	HTTP Parser: No favicon
Source: https://www.paypal.com/donate/?cmd=_donations&currency_code=GBP&business=paypal@tecnick.com&item_name=donation%20for%20tc-lib-pdf%20project	HTTP Parser: No favicon
Source: https://www.paypal.com/donate/?cmd=_donations&currency_code=GBP&business=paypal@tecnick.com&item_name=donation%20for%20tc-lib-pdf%20project	HTTP Parser: No favicon
Source: https://www.paypal.com/donate/?cmd=_donations&currency_code=GBP&business=paypal@tecnick.com&item_name=donation%20for%20tc-lib-pdf%20project	HTTP Parser: No favicon
Source: https://tcpdf.org/about/	HTTP Parser: No favicon
Source: https://tcpdf.org/about/	HTTP Parser: No favicon
Source: https://tcpdf.org/about/	HTTP Parser: No favicon
Source: https://tcpdf.org/about/	HTTP Parser: No favicon
Source: https://tecnick.com/	HTTP Parser: No favicon
Source: https://tecnick.com/	HTTP Parser: No favicon
Source: https://tecnick.com/	HTTP Parser: No favicon
Source: https://tecnick.com/	HTTP Parser: No favicon
Source: https://tecnick.com/	HTTP Parser: No favicon
Source: https://tecnick.com/	HTTP Parser: No favicon
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: No favicon
Source: https://tecnick.com/#google_vignette	HTTP Parser: No favicon
Source: https://tecnick.com/#google_vignette	HTTP Parser: No favicon
Source: https://tecnick.com/#google_vignette	HTTP Parser: No favicon

Source: https://tecnick.com/	HTTP Parser: No <meta name="author".. found
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: No <meta name="author".. found
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: No <meta name="author".. found
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: No <meta name="author".. found
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: No <meta name="author".. found
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: No <meta name="author".. found
Source: https://tecnick.com/#google_vignette	HTTP Parser: No <meta name="author".. found
Source: https://tecnick.com/#google_vignette	HTTP Parser: No <meta name="author".. found

Source: https://tecnick.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: No <meta name="copyright".. found
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: No <meta name="copyright".. found
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: No <meta name="copyright".. found
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: No <meta name="copyright".. found
Source: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE	HTTP Parser: No <meta name="copyright".. found
Source: https://tecnick.com/#google_vignette	HTTP Parser: No <meta name="copyright".. found
Source: https://tecnick.com/#google_vignette	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49843 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: adclick.g.doubleclick.net to https://www.googleadservices.com/pagead/aclk?nis=4&sa=l&ai=cgaplnp3_zovifovy1pip-awekl2v2qn2_ynb5n4s29keeaegu4uakgdjbqab7brihapiaqmpavhhicydf7i-qambyaplbkoe0wfp0fmwuppyb5jvagmdhehuxo0rjqjipo1yiifk5juqzbymcaaofacdtvsqqodglygier5gw_kgip1qk9ahhuereuw2aohwwdzwqjldvoizbh8scyhjmnvz1v_c2tb5kwlkmlamc-hu1ghdg3srtukpmydjfnat38btqwcja2ona5ivk0clxb8iu90yxe6-mvvj0tfmq6inptveomw4pcwsv1ksbkyaw_d06ku5zi8z9paulve_kkvgdaunhdxdlechmzkq4zcp0xyu2gjcyiipvu4fwasfibqu5gsibehxjrbkoayugaf7xj17qafvyruob9m2sqkob6a-g6ghjs4bqaet2buob_dgg6gh7paxaqgh_p6xaqghr76xaqghmgaob_prg6ghltgbqaeqm7ecqaedrbecqafgvbecqaf_nrecqaffn7ecqafkqbecqafrpbecqafqsbecqaeztbecqae-t7ecqaf4wrecqaf7wrec2aca0ggmcibheaeyhzicigi6c4bagmcagicgqiacsl39wtpyp__65j30iaoactnodhrwczovl2nozwnrbwsuy29tl2wvys9zdgfydc1jagvja21rlwzyzwutdhjpywwtdxoxcxisimhf2noygaobigraawh0dhbzoi8vbw9uaxrvci5jbglja2nlyxnllmnvbs90cmfja2vylz9pzd1mznhhb05dmggwrtldsizhzhbvcz0mbg9jcghpc2ljyww9mjg0mczsb2npbnrlcmvzdd0mywrncna9mty0odyymjy0ndc5jmt3pszudz1kjnvybd17bhb1cmx9jmnwbj0xotk2nteynzy0oszkzxzpy2u9yyzjy3b0dxjspwnozwnrbwsuy29tjnbspxrjcgrmlm9yz5glacglaealayamadomeaokemcwgtir6zkkdxicaqoqdqjvu8gnabgt5apyew3qfqgyfgh4fggafwgyfwiyaboxajgbshgjeglhthguigea0bgb6bgb&ae=1&ase=2&gclid=eaiaiqobchmii7v75j30iamvczlvcb35kgcfeaeyasaaegku2pd_bwe&num=1&cid=caqstgdpaxnfr1vmjpo47aacbt_otohmkst3w1sjcw690o03vi9quq5eo2xhs-oglpu1fvy1iogfaf4dyfylqsp9atv43bxjzqt_r5bg2o2-chgb&client=ca-pub-2627887748647914&rf=1&nb=0&dblrd=1&sig=aod64_2wyz9rf58gbzkq3en9lvfdbrclaq&adurl=https://checkmk.com/l/a/start-checkmk-free-trial-us%3futm_source%3dgoogle%26utm_medium%3dcpc%26utm_campaign%3d%5bcampaigns%5dgdn-competitors-customers-us%26utm_adgroup%3dtopics-2024utm_content%3dfree-trial%26utm_term%3dtcpdf.org%26gad_source%3d5%26gclid%3deaiaiqobchmii7v75j30iamvczlvcb35kgcfeaeyasaaegku2pd_bwe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.googleadservices.com to https://monitor.clickcease.com/tracker/?id=ffxaonc0h0e9cj&adpos=&locphisical=2840&locinterest=&adgrp=164862264479&kw=&nw=d&url=https://checkmk.com/l/a/start-checkmk-free-trial-us%3futm_source%3dgoogle%26utm_medium%3dcpc%26utm_campaign%3d%5bcampaigns%5dgdn-competitors-customers-us%26utm_adgroup%3dtopics-2024utm_content%3dfree-trial%26utm_term%3dtcpdf.org%26gad_source%3d5%26gclid%3deaiaiqobchmii7v75j30iamvczlvcb35kgcfeaeyasaaegku2pd_bwe&cpn=19965127649&device=c&ccpturl=checkmk.com&pl=tcpdf.org&gclid=eaiaiqobchmii7v75j30iamvczlvcb35kgcfeaeyasaaegku2pd_bwe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: monitor.clickcease.com to https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[campaigns]gdn-competitors-customers-us&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=eaiaiqobchmii7v75j30iamvczlvcb35kgcfeaeyasaaegku2pd_bwe&gclid=eaiaiqobchmii7v75j30iamvczlvcb35kgcfeaeyasaaegku2pd_bwe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: adclick.g.doubleclick.net to https://www.googleadservices.com/pagead/aclk?nis=4&sa=l&ai=cgaplnp3_zovifovy1pip-awekl2v2qn2_ynb5n4s29keeaegu4uakgdjbqab7brihapiaqmpavhhicydf7i-qambyaplbkoe0wfp0fmwuppyb5jvagmdhehuxo0rjqjipo1yiifk5juqzbymcaaofacdtvsqqodglygier5gw_kgip1qk9ahhuereuw2aohwwdzwqjldvoizbh8scyhjmnvz1v_c2tb5kwlkmlamc-hu1ghdg3srtukpmydjfnat38btqwcja2ona5ivk0clxb8iu90yxe6-mvvj0tfmq6inptveomw4pcwsv1ksbkyaw_d06ku5zi8z9paulve_kkvgdaunhdxdlechmzkq4zcp0xyu2gjcyiipvu4fwasfibqu5gsibehxjrbkoayugaf7xj17qafvyruob9m2sqkob6a-g6ghjs4bqaet2buob_dgg6gh7paxaqgh_p6xaqghr76xaqghmgaob_prg6ghltgbqaeqm7ecqaedrbecqafgvbecqaf_nrecqaffn7ecqafkqbecqafrpbecqafqsbecqaeztbecqae-t7ecqaf4wrecqaf7wrec2aca0ggmcibheaeyhzicigi6c4bagmcagicgqiacsl39wtpyp__65j30iaoactnodhrwczovl2nozwnrbwsuy29tl2wvys9zdgfydc1jagvja21rlwzyzwutdhjpywwtdxoxcxisimhf2noygaobigraawh0dhbzoi8vbw9uaxrvci5jbglja2nlyxnllmnvbs90cmfja2vylz9pzd1mznhhb05dmggwrtldsizhzhbvcz0mbg9jcghpc2ljyww9mjg0mczsb2npbnrlcmvzdd0mywrncna9mty0odyymjy0ndc5jmt3pszudz1kjnvybd17bhb1cmx9jmnwbj0xotk2nteynzy0oszkzxzpy2u9yyzjy3b0dxjspwnozwnrbwsuy29tjnbspxrjcgrmlm9yz5glacglaealayamadomeaokemcwgtir6zkkdxicaqoqdqjvu8gnabgt5apyew3qfqgyfgh4fggafwgyfwiyaboxajgbshgjeglhthguigea0bgb6bgb&ae=1&ase=2&gclid=eaiaiqobchmii7v75j30iamvczlvcb35kgcfeaeyasaaegku2pd_bwe&num=1&cid=caqstgdpaxnfr1vmjpo47aacbt_otohmkst3w1sjcw690o03vi9quq5eo2xhs-oglpu1fvy1iogfaf4dyfylqsp9atv43bxjzqt_r5bg2o2-chgb&client=ca-pub-2627887748647914&rf=1&nb=9&dblrd=1&sig=aod64_2wyz9rf58gbzkq3en9lvfdbrclaq&adurl=https://checkmk.com/l/a/start-checkmk-free-trial-us%3futm_source%3dgoogle%26utm_medium%3dcpc%26utm_campaign%3d%5bcampaigns%5dgdn-competitors-customers-us%26utm_adgroup%3dtopics-2024utm_content%3dfree-trial%26utm_term%3dtcpdf.org%26gad_source%3d5%26gclid%3deaiaiqobchmii7v75j30iamvczlvcb35kgcfeaeyasaaegku2pd_bwe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.googleadservices.com to https://monitor.clickcease.com/tracker/?id=ffxaonc0h0e9cj&adpos=&locphisical=2840&locinterest=&adgrp=164862264479&kw=&nw=d&url=https://checkmk.com/l/a/start-checkmk-free-trial-us%3futm_source%3dgoogle%26utm_medium%3dcpc%26utm_campaign%3d%5bcampaigns%5dgdn-competitors-customers-us%26utm_adgroup%3dtopics-2024utm_content%3dfree-trial%26utm_term%3dtcpdf.org%26gad_source%3d5%26gclid%3deaiaiqobchmii7v75j30iamvczlvcb35kgcfeaeyasaaegku2pd_bwe&cpn=19965127649&device=c&ccpturl=checkmk.com&pl=tcpdf.org&gclid=eaiaiqobchmii7v75j30iamvczlvcb35kgcfeaeyasaaegku2pd_bwe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: monitor.clickcease.com to https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[campaigns]gdn-competitors-customers-us&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=eaiaiqobchmii7v75j30iamvczlvcb35kgcfeaeyasaaegku2pd_bwe&gclid=eaiaiqobchmii7v75j30iamvczlvcb35kgcfeaeyasaaegku2pd_bwe

Source: Joe Sandbox View	IP Address: 91.228.74.166 91.228.74.166
Source: Joe Sandbox View	IP Address: 169.150.247.39 169.150.247.39
Source: Joe Sandbox View	IP Address: 51.89.9.252 51.89.9.252
Source: Joe Sandbox View	IP Address: 169.150.247.37 169.150.247.37
Source: Joe Sandbox View	IP Address: 169.150.247.37 169.150.247.37

Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: chromecache_1096.11.dr	String found in binary or memory: "https://www.facebook.com/tribe29.software", equals www.facebook.com (Facebook)
Source: chromecache_1096.11.dr	String found in binary or memory: "https://www.linkedin.com/company/tribe29", equals www.linkedin.com (Linkedin)
Source: chromecache_1096.11.dr	String found in binary or memory: "https://www.facebook.com/checkmk", equals www.facebook.com (Facebook)
Source: chromecache_1096.11.dr	String found in binary or memory: "https://www.linkedin.com/showcase/checkmk/", equals www.linkedin.com (Linkedin)
Source: chromecache_1096.11.dr	String found in binary or memory: "https://www.youtube.com/c/checkmk-channel", equals www.youtube.com (Youtube)
Source: chromecache_1053.11.dr	String found in binary or memory: L.getElementsByTagName("iframe"),ka=P.length,na=0;na<ka;na++)if(!v&&c(P[na],H.He)){oJ("https://www.youtube.com/iframe_api");v=!0;break}})}}else F(u.vtp_gtmOnSuccess)}var q=["www.youtube.com","www.youtube-nocookie.com"],r={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},t,v=!1;Z.__ytl=n;Z.__ytl.o="ytl";Z.__ytl.isVendorTemplate=!0;Z.__ytl.priorityOverride=0;Z.__ytl.isInfrastructure=!1; equals www.youtube.com (Youtube)
Source: chromecache_1288.11.dr, chromecache_1053.11.dr	String found in binary or memory: Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},bk:function(){e=zb()},nd:function(){d()}}};var gc=la(["data-gtm-yt-inspected-"]),LC=["www.youtube.com","www.youtube-nocookie.com"],MC,NC=!1; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: www.tcpdf.org
Source: global traffic	DNS traffic detected: DNS query: tcpdf.org
Source: global traffic	DNS traffic detected: DNS query: www.paypal.com
Source: global traffic	DNS traffic detected: DNS query: www.paypalobjects.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cse.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeAccept-Ch: Sec-CH-UA-FullCache-Control: max-age=0, no-cache, no-store, must-revalidateContent-Security-Policy: default-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; style-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com; img-src 'self' https: data:; object-src 'none'; font-src 'self' https://.paypal.com https://.paypalobjects.com data:; frame-src 'self' https://.paypalobjects.com https://.paypal.com https://.qualtrics.com; connect-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/cspContent-Type: text/html; charset=utf-8Origin-Trial: AmF3SS0NWoXo3HaojgmIVVXavukRnZH597u+xZNXRCiKWzSKzfNPHw9NC32GmblY12+HXpkCEYeYGyvRBNkkJg0AAABbeyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlRwY2QiLCJleHBpcnkiOjE3MzUzNDM5OTksImlzU3ViZG9tYWluIjp0cnVlfQ==Paypal-Debug-Id: f99605143ffc5Set-Cookie: LANG=en_US%3BUS; Max-Age=31556; Domain=.paypal.com; Path=/; Expires=Fri, 04 Oct 2024 16:32:50 GMT; HttpOnly; Secure
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeAccept-Ch: Sec-CH-UA-FullCache-Control: max-age=0, no-cache, no-store, must-revalidateContent-Security-Policy: default-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; style-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com; img-src 'self' https: data:; object-src 'none'; font-src 'self' https://.paypal.com https://.paypalobjects.com data:; frame-src 'self' https://.paypalobjects.com https://.paypal.com https://.qualtrics.com; connect-src 'self' 'unsafe-inline' https://.paypal.com https://.paypalobjects.com https://.qualtrics.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/cspContent-Type: text/html; charset=utf-8Origin-Trial: AmF3SS0NWoXo3HaojgmIVVXavukRnZH597u+xZNXRCiKWzSKzfNPHw9NC32GmblY12+HXpkCEYeYGyvRBNkkJg0AAABbeyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlRwY2QiLCJleHBpcnkiOjE3MzUzNDM5OTksImlzU3ViZG9tYWluIjp0cnVlfQ==Paypal-Debug-Id: f17993973e377Set-Cookie: LANG=en_US%3BUS; Max-Age=31556; Domain=.paypal.com; Path=/; Expires=Fri, 04 Oct 2024 16:33:15 GMT; HttpOnly; Secure
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 04 Oct 2024 07:47:24 GMTServer: ApacheContent-Location: 404.html.brVary: negotiate,accept-encodingTCN: choiceStrict-Transport-Security: max-age=31536000 ; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffCache-Control: no-store, max-age=0Content-Security-Policy: default-src 'self' .doubleclick.net .google.com .googleapis.com .googlesyndication.com .paypal.com .paypalobjects.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' .doubleclick.net .google.com .googleapis.com .googlesyndication.com .paypal.com .paypalobjects.com; img-src 'self' data: .doubleclick.net .google.com .googleapis.com .googlesyndication.com .paypal.com .paypalobjects.com; style-src 'self' 'unsafe-inline' .doubleclick.net .google.com .googleapis.com .googlesyndication.com .paypal.com .paypalobjects.com; font-src 'self' .doubleclick.net .google.com .googleapis.com .googlesyndication.com .paypal.com .paypalobjects.com; object-src 'self' frame-ancestors 'self'; upgrade-insecure-requests; block-all-mixed-contentCross-Origin-Opener-Policy: same-siteCross-Origin-Resource-Policy: same-sitePermissions-Policy: accelerometer=(),ambient-light-sensor=(),autoplay=(),battery=(),camera=(),display-capture=(),document-domain=(),encrypted-media=(),fullscreen=(),gamepad=(),geolocation=(),gyroscope=(),layout-animations=(self),legacy-image-formats=(self),magnetometer=(),microphone=(),midi=(),oversized-images=(self),payment=(),picture-in-picture=(),publickey-credentials-get=(),speaker-selection=(),sync-xhr=(self),unoptimized-images=(self),unsized-media=(self),usb=(),screen-wake-lock=(),web-share=(),xr-spatial-tracking=()Pragma: no-cacheReferrer-Policy: no-referrerX-Permitted-Cross-Domain-Policies: noneLast-Modified: Sat, 24 Aug 2024 15:01:22 GMTETag: "479-6206f2a377480;6206f2a58dc63;6206f2a3b8adAccept-Ranges: bytesContent-Length: 1145X-Precompressed-Version-Served: .html was requested, .html.br found and servedConnection: closeContent-Type: text/html; charset=UTF-8Content-Encoding: br

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\FA-EDI-2409-0280.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1740,i,4004120980904792418,12153791403947030670,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "http://www.tcpdf.org"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2212,i,18367372152763981669,441212640499137429,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1740,i,4004120980904792418,12153791403947030670,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2212,i,18367372152763981669,441212640499137429,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: FA-EDI-2409-0280.pdf	Initial sample: PDF keyword /JS count = 0
Source: FA-EDI-2409-0280.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	1 Drive-by Compromise	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://support.google.com/recaptcha/#6175971	0%	URL Reputation	safe
http://mathiasbynens.be/	0%	URL Reputation	safe
https://cloud.google.com/contact	0%	URL Reputation	safe
http://polymer.github.io/CONTRIBUTORS.txt	0%	URL Reputation	safe
http://x1.i.lencr.org/	0%	URL Reputation	safe
https://static.hotjar.com/c/hotjar-	0%	URL Reputation	safe
https://getbootstrap.com/)	0%	URL Reputation	safe
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
tcpdf.org	69.164.210.100	true	false	unknown
www.tcpdf.org	69.164.210.100	true	false	unknown
cs1150.wpc.betacdn.net	192.229.221.25	true	false	unknown
googleads.g.doubleclick.net	142.250.184.226	true	false	unknown
paypal-dynamic.map.fastly.net	151.101.1.21	true	false	unknown
cse.google.com	142.250.184.238	true	false	unknown
www.google.com	142.250.185.100	true	false	unknown
x1.i.lencr.org	unknown	unknown	false	unknown
www.paypalobjects.com	unknown	unknown	false	unknown
www.paypal.com	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://github.githubassets.com/assets/ui_packages_code-view-shared_components_SharedMarkdownContent_tsx-ui_packages_copy-to-clipboa-b2118b-b4842033cb44.js	false	unknown
https://www.paypal.com/auth/createchallenge/3a869b42ba0a1ff4/recaptchav3.js?_sessionID=iFqzQFFdcmLfwTx6rDoFtO0kv5hDi8ND	true	unknown
https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESECBHgfwy-MCSvbluS7ozM0k&google_cver=1&google_push=AXcoOmR8PqpLHhRrgSN4TfI5rtxRa26g8FFRx-ot3zEG1tZsb3XduOTyK63_OCGgUqsPOR9p598IsoHKhMZN7JrAbAxUYjI5T3nLNbg	false	unknown
https://www.paypalobjects.com/web/res/ec0/f4c900712161f04047a226200a2c1/js/apps/donate/649.e64dd235532b91208bac.js	false	unknown
https://camo.githubusercontent.com/298ac5866fdfa1f2eb955eb06a567d00c9402ddd40045c90335caf4c56637b64/68747470733a2f2f706f7365722e707567782e6f72672f7465636e69636b636f6d2f74632d6c69622d7064662f76657273696f6e	false	unknown
https://www.paypalobjects.com/web/res/ec0/f4c900712161f04047a226200a2c1/js/apps/donate/45.98aa5c7ae691353d1b6f.css	false	unknown
https://tecnick.com/img/manifest.json	false	unknown
https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEGKIE2g0RXxWD-qsvH4P_KU&google_cver=1&google_push=AXcoOmRpmtUm0s9qsTHDMIGjPjm9RnAqWCwgQtTlbpwkVbXTrbcnXgtmTMsmx42kZKuaGD8k0A5dIvzGuLTkOAQWy_WVWEUp0PhDyak6	false	unknown
https://checkmk.com/manifest.json	false	unknown
https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEGKIE2g0RXxWD-qsvH4P_KU&google_cver=1&google_push=AXcoOmSnXNBI4kgmZSAEUa5HzuMnaEBi999MKK9h__OEmp8bhKNLEdt6SQtMKPI-yIokdR-5FRjl-rlHQJTpmvJyHtLQl2-0JlnDZw	false	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-893f9f-6cf3320416b8.js	false	unknown
https://googleads.g.doubleclick.net/pagead/interaction/?ai=C7TieNp3_ZvzDGNHM1PIPoJzTmAa6g9vQesL9wKaWE8uH_tWXDhABILuLmihgyQagAcH5ofEoyAEBqAMByANIqgTGAU_Qyrjtz0fBpJllMoqeX7-q0xwH-ccBVyay3V7Tf2DYEysilDNERHCbTen4_zckX7yrGSWKR4utmidOrr_UjmNlxWpXRCdOq5HGs4sOFJ8FXh_FEaCI2r1UfXDJFVJBIxVJWdH5bJ4kXeuCxRqEK6fdhY4W1iynIEOGAvX-j0hzDmJy6cg_HcN6GNjUjGwiML5CVzIp_C3-LMTEXG6tg6bRRoD2YuK4dwOd2tAIoustUstbvVgz6sctdK12RVnhl0yqvai_UcAE4bqNr_8EiAWAsa-GUaAGLoAHwbHy0AOoB9XJG6gH2baxAqgHpr4bqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQKoB8qpsQKoB-ulsQKoB-qxsQKoB5m1sQKoB763sQKoB_jCsQKoB_vCsQLYBwHSCCYIgGEQARgfMgKKAjoLgECAwICAgKCogAJIvf3BOliBwPzknfSIA7EJaq6FW45acQ6ACgGKCiRodHRwczovL21zZWFyY2hpLmNvbS90L3Q_dXJsPXtscHVybH2YCwHICwHgCwHaDBAKChDw4qOBy4jS3SQSAgEDqg0CVVPIDQHYEwzQFQH4FgGAFwGyFwIYAboXAjgBshgJEgL2ahguIgEA0BgB6BgB&sigh=2YnpHkZSnjY&cid=CAQSTwDpaXnfwraMbEJJjcdFqfh5TShXbhsuljVRc5cb-5Nnsi_34Keb0dLt7lVNsLKcNs-dgxy6w315_kvvMzA6gajmKvGBEQbR0xy9QWgCeIE&label=window_focus&gqid=Np3_ZsuFF8Pix_APlZ-6kAI&qqid=CPy2_eSd9IgDFVEmVQgdIM4UYw&fg=1	false	unknown
https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEKa_YSz9zWs5OpKjKK0b0xs&google_cver=1&google_push=AXcoOmQQdJmuA_6zXfkuQIf3wKQEAD2aGL4tffnNCQF8NdRrNBRJvnEAqMQzwzwNvpW3BI7Gq1kT8QM_JwkPQTKBRa0xD2l0zjrcf7U	false	unknown
https://www.temu.com/api/adx/cm/pixel?google_gid=CAESEH2LKz6SA_ujFrj4Qmfaz_4&google_cver=1&google_push=AXcoOmTfHdcdIuyd-Py-lLIVGL3ncXCKbzUo1PdSw6Hdt3cuewfnxh1xeUeJ7Uw3rkTBryvbT9Y1Sn8m9Nsgm3atUWkiJHCnBUs9DTwE	false	unknown
https://github.githubassets.com/assets/vendors-node_modules_virtualized-list_es_index_js-node_modules_github_template-parts_lib_index_js-96453a51f920.js	false	unknown
https://github.githubassets.com/assets/ui_packages_failbot_failbot_ts-aabfa4ec15fe.js	false	unknown
https://github.githubassets.com/assets/ui_packages_analytics-provider_analytics-provider_ts-ui_packages_aria-live_aria-live_ts-ui_pa-34342e-61e6c34c9419.js	false	unknown
https://checkmk.com/application/files/cache/js/4746e57df6e9968397710bb96c20c1ef749773d8.js?ccm_nocache=a41fa37a62a868f0da0b9c454306bf72127905e0	false	unknown
https://widget.us.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmRAsqsqI7eqlX2kviRLGvx0sZZzmCQ3SplnhdGs0jqwsDlV2fVlOmf84NmDnhKz3z21P3BISPC8JwxfEG6gPLZFVcY9dFimu_k&google_gid=CAESEKKUfZojA2PWTPsrxN37hrs&google_cver=1	false	unknown
https://www.paypal.com/it_IT/i/scr/pixel.gif	false	unknown
https://checkmk.com/concrete/js/vue.js?ccm_nocache=a41fa37a62a868f0da0b9c454306bf72127905e0	false	unknown
https://github.githubassets.com/assets/app_assets_modules_github_behaviors_task-list_ts-app_assets_modules_github_sso_ts-ui_packages-900dde-ab87c1d6c5c8.js	false	unknown
https://nicola.asuni.xyz/img/manifest.json	false	unknown
https://www.paypal.com/myaccount/privacy/cookieprefs/cookies?eventSource=pageLoad&page=main:donate:wps::landing:web::&component=donatenodeweb&eventSourceUrl=https://www.paypal.com/donate/	false	unknown
https://github.githubassets.com/assets/primer-react.a38d782b719dc67594c9.module.css	false	unknown
https://avatars.githubusercontent.com/u/1186996?s=64&v=4	false	unknown
https://fundingchoicesmessages.google.com/i/ca-pub-2627887748647914?href=https%3A%2F%2Ftcpdf.org&ers=2	false	unknown
https://github.githubassets.com/assets/ui_packages_ui-commands_ui-commands_ts-4c141348476c.js	false	unknown
https://www.paypalobjects.com/web/res/ec0/f4c900712161f04047a226200a2c1/js/apps/donate/donate.0731280f50427384978e.js	false	unknown
https://www.google.com/cse/static/images/1x/en/branding.png	false	unknown
https://github.githubassets.com/assets/vendors-node_modules_emotion_is-prop-valid_dist_emotion-is-prop-valid_esm_js-node_modules_emo-41da55-1851acd376ff.js	false	unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2627887748647914&output=html&h=280&adk=2380828106&adf=1003747024&w=1081&abgtt=1&fwrn=4&fwrnh=100&lmt=1724511650&rafmt=1&format=1081x280&url=https%3A%2F%2Ftcpdf.org%2Fexamples%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1728028037398&bpp=7&bdt=1118&idt=37&shv=r20241001&mjsv=m202409260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D74748a2114bcd6f8%3AT%3D1728027958%3ART%3D1728027958%3AS%3DALNI_Mar1KmreopR1YR0LuEj6YjN1CiwtQ&gpic=UID%3D00000f21a449d160%3AT%3D1728027958%3ART%3D1728027958%3AS%3DALNI_MbeZ5RStNrFx1VgIOfQjr19_H2y1w&eo_id_str=ID%3D602bc46dfc4ceee3%3AT%3D1728027958%3ART%3D1728027958%3AS%3DAA-AfjZJ7pwMWsfMd676OPLIU7FI&correlator=6207797285538&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=166&ady=229&biw=1263&bih=907&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C42532524%2C44795921%2C95331689%2C95341936%2C95335246%2C95339678&oid=2&pvsid=4381103064551193&tmod=824621570&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C907&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=89	false	unknown
https://creativecdn.com/cm-notify?pi=adxab&google_nid=rtb_house&google_gid=CAESEIFtXtqEgnFRZijhSqRasU4&google_cver=1&google_push=AXcoOmSxZ8b44lhEMSx6qZOwzmw4ZbxbEtSBGf1cmFFWKt_nA1lnBaN7yO12FpsqcpVrRM1W0UqJwxKMBHoFqW6lC0Annqxs6usM0NE	false	unknown
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IOtP9VmQhamvHueibuaBeu9KwHT8UDUYp9Q5QNG-mTOUwKHNbf72goGRruhbA1CBbl0OuVYi0	false	unknown
https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEAXFMUYedSfAtGN__rjEcEc&google_cver=1&google_push=AXcoOmRD3X_TEucpWbN6iSfaISWjjlnLCbIazBlT0xiwVcDx_sOAzEmo_ftbDdgI5KSio249ahp5cprJRH5XSnxyQ0d62RSiNBVKOg	false	unknown
https://googleads.g.doubleclick.net/pagead/adview?ai=CoOj4eJ3_ZrGCI5bDjuwPzqyY6Q-BjMuSd7iGiaXRCmQQASC7i5ooYMkGoAGDwOz9A8gBCagDAcgDywSqBM4BT9D2wzaZ0YZTDu3lBZ_Fg0zzBl0vhZQxMt8jCSURn0YZ16bnezgXh1f3ATq-DwFyjHYP7FIo4uq4ZEr0E0LOc_NDfS19bRuEE3VzI2NNQj3yiyHFlMbE_P3jgAAx0YHHXBFDdqyEsDywOauzpIJUr-c7-_-hxOCWaFPZPyjZju3FIXxAu3jTcXUSjACyEQSYJixeIj36MxHRM5lww_rLJDF3tOtEmZSJaiisBt6tA-Ss9FXso8ZyzYJSI9t6necW0KQbBt7ekVD3BwFXBvHABNyw_bKRAYgFv5664QKSBQQIBBgBkgUECAUYBKAGLoAH5b-TAqgH2baxAqgHpr4bqAeOzhuoB5PYG6gH8OAbqAfulrECqAf-nrECqAevvrECqAf3wrEC2AcA8gcEEKaNE9IIJgiAYRABGB8yAooCOguAQIDAgICAoKiAAki9_cE6WOnqw4Se9IgDmgknaHR0cHM6Ly93d3cuZHJpcGRlcG90LmNvbS8_Z2FkX3NvdXJjZT01gAoByAsB2gwRCgsQ4OW9vpvz_cHZARICAQPYEwKIFALQFQGAFwGyFx4KGggAEhRwdWItMjYyNzg4Nzc0ODY0NzkxNBgAGAG6FwI4AbIYCRIC2moYLiIBANAYAQ&sigh=mAwZkQHLNY8&cmd=ChdjYS1wdWItMjYyNzg4Nzc0ODY0NzkxNBDuAxgB&uach_m=%5BUACH%5D&ase=2&cid=CAQSOwDpaXnfAwsGzdUbzf__lQztHV-ddcK23HI9ngFAwEHsfTapYtYlOuBR691K6Tw8rSix3RiosX1Oke_fGAE&template_id=494&nis=6	false	unknown
https://www.paypalobjects.com/pa/mi/paypal/latmconf.js	false	unknown
https://checkmk.com/packages/tribe29_core/css/features/fontawesome/css/core.css?ccm_nocache=a41fa37a62a868f0da0b9c454306bf72127905e0	false	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_combobox-nav_dist_index_js-node_modules_github_g-emoji-element_di-6ce195-53781cbc550f.js	false	unknown
https://fundingchoicesmessages.google.com/f/AGSKWxUE3XC3dE7JlOr8jIDsNtNdMLrHx1qp2MXbe2TJwsuYlF3NiQ-kFrUb_RHG65cKe2xTmyWBQ-uelKs8Ry_gxVZeeZ2f2tUR5VDwwyfohgMzvg0XgC8QLXkCV3iqA62GFZ-NZJsxFQ==?fccs=W1siQUtzUm9sOHp3bVpiRVBGZEQ0MTFwU3I2bmFLRUFEd2lJakppZWRaZWx6UEpTdHoxNGZtVE1xdXBKTF9lSGd2MjlDem0xeW9HS2lrLWxDbGVwV2tISkhoV2poRWlONVVZY2JYcGw0dlpKc3BBTWl1VlM2cV9uOEpKMURCY3FDVzRFcVk5ZEdhbERGRnFEQ3dhLW1VMEFoNWtNNk92WDk3Mk9nPT0iXSxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsWzE3MjgwMjc5ODEsMTYwMDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbNyw2LDEwLDldLG51bGwsMixudWxsLCJlbiIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLDFdLCJodHRwczovL3RjcGRmLm9yZy9leGFtcGxlcy8iLG51bGwsW1s4LCJlc2tXWFNGSHNRZyJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbMF1dXSJdLFsyMCwiW251bGwsbnVsbCxbMzEwODIyNTRdLDE4LDFdIl0sWzE5LCIyIl1dXQ	false	unknown
https://github.githubassets.com/assets/vendors-node_modules_tanstack_query-core_build_modern_queryObserver_js-node_modules_tanstack_-defd52-7aa5ebad499a.js	false	unknown
https://www.paypalobjects.com/webstatic/logo/logo_paypal_106x27.png	false	unknown
https://github.githubassets.com/favicons/favicon.svg	false	unknown
https://checkmk.com/application/files/6617/1654/6896/graph_2024_onwhite.svg	false	unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2627887748647914&output=html&h=280&adk=2380828106&adf=1003747024&w=1081&abgtt=1&fwrn=4&fwrnh=100&lmt=1724511682&rafmt=1&format=1081x280&url=https%3A%2F%2Ftcpdf.org%2Fabout%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1728028022388&bpp=15&bdt=1111&idt=65&shv=r20241001&mjsv=m202409260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D74748a2114bcd6f8%3AT%3D1728027958%3ART%3D1728027958%3AS%3DALNI_Mar1KmreopR1YR0LuEj6YjN1CiwtQ&gpic=UID%3D00000f21a449d160%3AT%3D1728027958%3ART%3D1728027958%3AS%3DALNI_MbeZ5RStNrFx1VgIOfQjr19_H2y1w&eo_id_str=ID%3D602bc46dfc4ceee3%3AT%3D1728027958%3ART%3D1728027958%3AS%3DAA-AfjZJ7pwMWsfMd676OPLIU7FI&correlator=5973480552048&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=166&ady=229&biw=1263&bih=907&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44798934%2C95341936%2C95343454%2C95344188&oid=2&pvsid=4345362532085388&tmod=824621570&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C907&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=87	false	unknown
https://github.githubassets.com/assets/ui_packages_paths_index_ts-6d26e38db34f.js	false	unknown
https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_modules_github_behaviors_include-d0d0a6-6faacedf87fe.js	false	unknown
https://t.paypal.com/ts?v=1.9.1&t=1728028008063&g=240&pgrp=main%3Aprivacy%3Apolicy&page=main%3Aprivacy%3Apolicy%3Accpa&pgst=1728028004301&calc=f411015dcb21b&nsid=iFqzQFFdcmLfwTx6rDoFtO0kv5hDi8ND&rsta=en_US&pgtf=Nodejs&env=live&s=ci&ccpg=US&csci=cd94b9f137374a3d879eb19fdc85ec75&comp=donatenodeweb&tsrce=donatenodeweb&cu=0&ef_policy=ccpa&context_id=evpoeG6180dVX58iC-TNM8SYPNPff4F6LmNseITVW2Z_xAcyVHrsjYDnBrEHi4JHeXQMGPA0CtBx-w3V&token=evpoeG6180dVX58iC-TNM8SYPNPff4F6LmNseITVW2Z_xAcyVHrsjYDnBrEHi4JHeXQMGPA0CtBx-w3V&xe=110041%2C109128%2C105410%2C105409%2C104759%2C109059%2C104406%2C104407&xt=148500%2C143659%2C123956%2C123954%2C120842%2C143369%2C119037%2C119038&ccd=US&button_id=undefined&hosted_button_id=undefined&action=LOAD_WPS_LANDING_PAGE&product=cookieBanner&sender_account_type=guest&flow=WPS_DONATION&tmpl=main%3Adonate%3Awps%3A%3Alanding&charitylogo=false&ckusr=false&amttyp=any&autord=false&rdtyp=GET&gstalwd=true&mrid=78UYQEEELK7DC&pp_flow=Donate&one_touch_enabled=false&pglk=null&api_name=cookieBanner&displaypage=main%3Adonate%3Awps%3A%3Alanding&ppage=privacy_banner&bannertype=cookiebanner&flag=ccpa&bannerversion=v4&bannersource=ConsentNodeServ&eligibility_reason=true&is_native=false&cookie_disabled=false&userstate=NY&usercountry=US&stateaccuracy=1&countryaccuracy=99&loggedin=false&event_name=cookie_banner_shown&e=ac	false	unknown
https://github.com/tecnickcom/TCPDF/funding_links?fragment=1	false	unknown
https://tcpdf.org/fonts/fa-brands-400.woff2	false	unknown
https://github.githubassets.com/assets/vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-d1a841-8f251a0656e7.js	false	unknown
https://github.com/tecnickcom/tc-lib-pdf/security/overall-count	false	unknown
https://tcpdf.org/examples/	false	unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2627887748647914&output=html&h=280&adk=2380828106&adf=1003747024&w=1081&abgtt=1&fwrn=4&fwrnh=100&lmt=1724511650&rafmt=1&format=1081x280&url=https%3A%2F%2Ftcpdf.org%2Fexamples%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0.&dt=1728027971211&bpp=8&bdt=1014&idt=59&shv=r20241001&mjsv=m202409260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D74748a2114bcd6f8%3AT%3D1728027958%3ART%3D1728027958%3AS%3DALNI_Mar1KmreopR1YR0LuEj6YjN1CiwtQ&gpic=UID%3D00000f21a449d160%3AT%3D1728027958%3ART%3D1728027958%3AS%3DALNI_MbeZ5RStNrFx1VgIOfQjr19_H2y1w&eo_id_str=ID%3D602bc46dfc4ceee3%3AT%3D1728027958%3ART%3D1728027958%3AS%3DAA-AfjZJ7pwMWsfMd676OPLIU7FI&correlator=598970542174&frm=20&pv=2&u_tz=-240&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&dmc=8&adx=166&ady=229&biw=1263&bih=907&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31087424%2C31087796%2C95343328%2C95335247&oid=2&pvsid=4358598373628446&tmod=824621570&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C984%2C1280%2C907&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&td=1&tdf=0&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=103	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_mo	chromecache_1246.11.dr, chromecache_814.11.dr	false		unknown
https://github.com/rvanginneken	chromecache_1246.11.dr	false		unknown
https://github.com/features/code-review	chromecache_1246.11.dr, chromecache_814.11.dr	false		unknown
https://github.com/features	chromecache_1246.11.dr, chromecache_814.11.dr	false		unknown
https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_	chromecache_1246.11.dr, chromecache_814.11.dr	false		unknown
https://github.com/solutions/industries/manufacturing	chromecache_1246.11.dr, chromecache_814.11.dr	false		unknown
https://github.com/mvorisek	chromecache_1246.11.dr	false		unknown
https://support.google.com/recaptcha/#6175971	chromecache_595.11.dr, chromecache_626.11.dr, chromecache_672.11.dr	false	URL Reputation: safe	unknown
https://www.paypalobjects.com/webstatic/mktg/2014design/font/headlinedark/festivo1.ttf	chromecache_1235.11.dr	false		unknown
https://developer.paypal.com/studio/checkout/standard/getstarted	chromecache_775.11.dr	false		unknown
http://ogp.me/ns/website#	chromecache_1096.11.dr	false		unknown
https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Medium.eot	chromecache_1235.11.dr	false		unknown
https://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax	chromecache_1246.11.dr, chromecache_814.11.dr	false		unknown
https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar2&v=231	chromecache_1166.11.dr, chromecache_621.11.dr	false		unknown
https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar2&v=232	chromecache_960.11.dr, chromecache_1253.11.dr, chromecache_791.11.dr	false		unknown
https://docs.github.com/get-started/accessibility/keyboard-shortcuts	chromecache_1246.11.dr, chromecache_814.11.dr	false		unknown
https://packages.debian.org/source/stable/icc-profiles-free	chromecache_1246.11.dr, chromecache_814.11.dr	false		unknown
https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modu	chromecache_1246.11.dr, chromecache_814.11.dr	false		unknown
http://mathiasbynens.be/	chromecache_945.11.dr, chromecache_601.11.dr, chromecache_854.11.dr, chromecache_1252.11.dr	false	URL Reputation: safe	unknown
https://developer.paypal.com/docs/3rd-party/	chromecache_775.11.dr	false		unknown
https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Thin.svg	chromecache_1235.11.dr	false		unknown
https://api.github.com/_private/browser/errors	chromecache_1246.11.dr, chromecache_814.11.dr	false		unknown
https://ep2.adtrafficquality.google/sodar/$	chromecache_945.11.dr, chromecache_601.11.dr, chromecache_854.11.dr, chromecache_1252.11.dr	false		unknown
https://github.com/features/discussions	chromecache_1246.11.dr, chromecache_814.11.dr	false		unknown
https://github.githubassets.com/assets/app-icon-192-bcc967ab9829.png	chromecache_916.11.dr	false		unknown
https://developer.paypal.com/dashboard	chromecache_775.11.dr	false		unknown
https://www.gartner.com/reviews/market/it-infrastructure-monitoring-tools/vendor/tribe29/product/che	chromecache_1096.11.dr	false		unknown
https://cloud.google.com/contact	chromecache_595.11.dr, chromecache_626.11.dr, chromecache_672.11.dr	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_tanstack_query-core_build_modern_query_j	chromecache_1246.11.dr, chromecache_814.11.dr	false		unknown
https://checkmk.com/packages/tribe29_core/themes/checkmk/images/share_image.png	chromecache_1096.11.dr	false		unknown
https://github.githubassets.com/assets/ui_packages_use-alive_use-alive_ts-ui_packages_code-dropdown-	chromecache_1246.11.dr, chromecache_814.11.dr	false		unknown
https://github.githubassets.com/assets/light_tritanopia-31d17ba3e139.css	chromecache_1246.11.dr, chromecache_814.11.dr	false		unknown
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_930.11.dr, chromecache_870.11.dr	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.2.dr	false	URL Reputation: safe	unknown
https://cse.google.com/cse.js	chromecache_945.11.dr, chromecache_601.11.dr, chromecache_854.11.dr, chromecache_1252.11.dr	false		unknown
https://github.githubassets.com/assets/apple-touch-icon-114x114-09ce42d3ca4b.png	chromecache_916.11.dr	false		unknown
https://cdn.ampproject.org/rtv/$	chromecache_945.11.dr, chromecache_601.11.dr, chromecache_854.11.dr, chromecache_1252.11.dr	false		unknown
https://static.hotjar.com/c/hotjar-	chromecache_1288.11.dr, chromecache_1053.11.dr	false	URL Reputation: safe	unknown
https://www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Medium.eot?#iefix	chromecache_1235.11.dr	false		unknown
https://getbootstrap.com/)	chromecache_974.11.dr, chromecache_1164.11.dr	false	URL Reputation: safe	unknown
https://www.paypalobjects.com/images/shared/monogram	chromecache_1235.11.dr, chromecache_1167.11.dr	false		unknown
https://opengraph.githubassets.com/85082fb84e859a95981417fd95e208e77ae727e55674f4894ad00a215ecea921/	chromecache_1246.11.dr	false		unknown
https://www.recaptcha.net/recaptcha/enterprise/	chromecache_891.11.dr, chromecache_1176.11.dr	false		unknown
https://www.paypal.com/cgi-bin/webscr?cmd=_donations&currency_code=GBP&business=paypal	chromecache_1011.11.dr, chromecache_814.11.dr, chromecache_768.11.dr	false		unknown
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_595.11.dr, chromecache_626.11.dr, chromecache_672.11.dr	false	URL Reputation: safe	unknown
https://github.githubassets.com/assets/vendors-node_modules_emotion_is-prop-valid_dist_emotion-is-pr	chromecache_1246.11.dr, chromecache_814.11.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.99	unknown	United States	15169	GOOGLEUS	false
142.250.186.68	unknown	United States	15169	GOOGLEUS	false
172.217.16.136	unknown	United States	15169	GOOGLEUS	false
91.228.74.166	unknown	United Kingdom	27281	QUANTCASTUS	false
216.58.212.142	unknown	United States	15169	GOOGLEUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.227	unknown	United States	15169	GOOGLEUS	false
169.150.247.39	unknown	United States	2711	SPIRITTEL-ASUS	false
51.89.9.252	unknown	France	16276	OVHFR	false
169.150.247.37	unknown	United States	2711	SPIRITTEL-ASUS	false
46.137.57.71	unknown	Ireland	16509	AMAZON-02US	false
185.199.109.133	unknown	Netherlands	54113	FASTLYUS	false
20.157.217.65	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
54.209.225.147	unknown	United States	14618	AMAZON-AESUS	false
3.77.232.241	unknown	United States	16509	AMAZON-02US	false
142.250.186.74	unknown	United States	15169	GOOGLEUS	false
172.217.16.142	unknown	United States	15169	GOOGLEUS	false
37.157.2.229	unknown	Denmark	198622	ADFORMDK	false
93.158.134.90	unknown	Russian Federation	13238	YANDEXRU	false
142.250.185.234	unknown	United States	15169	GOOGLEUS	false
172.217.18.3	unknown	United States	15169	GOOGLEUS	false
77.88.21.90	unknown	Russian Federation	13238	YANDEXRU	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
142.250.185.193	unknown	United States	15169	GOOGLEUS	false
169.150.236.104	unknown	United States	2711	SPIRITTEL-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
193.0.160.130	unknown	Netherlands	54312	ROCKETFUELUS	false
172.217.23.100	unknown	United States	15169	GOOGLEUS	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
47.253.61.56	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
140.82.112.22	unknown	United States	36459	GITHUBUS	false
151.101.67.1	unknown	United States	54113	FASTLYUS	false
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
142.250.185.78	unknown	United States	15169	GOOGLEUS	false
142.250.185.206	unknown	United States	15169	GOOGLEUS	false
172.217.18.14	unknown	United States	15169	GOOGLEUS	false
216.58.206.34	unknown	United States	15169	GOOGLEUS	false
142.250.181.234	unknown	United States	15169	GOOGLEUS	false
142.250.185.202	unknown	United States	15169	GOOGLEUS	false
216.58.206.36	unknown	United States	15169	GOOGLEUS	false
46.228.164.11	unknown	United Kingdom	56396	TURNGB	false
188.166.17.21	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
142.250.185.162	unknown	United States	15169	GOOGLEUS	false
172.217.18.99	unknown	United States	15169	GOOGLEUS	false
172.217.18.10	unknown	United States	15169	GOOGLEUS	false
216.58.212.174	unknown	United States	15169	GOOGLEUS	false
185.199.110.133	unknown	Netherlands	54113	FASTLYUS	false
142.250.186.138	unknown	United States	15169	GOOGLEUS	false
178.250.1.9	unknown	France	44788	ASN-CRITEO-EUROPEFR	false
140.82.121.3	unknown	United States	36459	GITHUBUS	false
140.82.121.4	unknown	United States	36459	GITHUBUS	false
140.82.121.6	unknown	United States	36459	GITHUBUS	false
142.250.185.170	unknown	United States	15169	GOOGLEUS	false
142.250.186.129	unknown	United States	15169	GOOGLEUS	false
142.250.181.227	unknown	United States	15169	GOOGLEUS	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
151.101.65.21	unknown	United States	54113	FASTLYUS	false
45.133.11.28	unknown	Germany	31400	ACCELERATED-ITDE	false
185.199.108.133	unknown	Netherlands	54113	FASTLYUS	false
172.217.16.130	unknown	United States	15169	GOOGLEUS	false
64.202.112.63	unknown	United States	22075	AS-OUTBRAINUS	false
104.77.220.172	unknown	United States	16625	AKAMAI-ASUS	false
142.250.186.66	unknown	United States	15169	GOOGLEUS	false
142.250.185.98	unknown	United States	15169	GOOGLEUS	false
34.198.52.31	unknown	United States	14618	AMAZON-AESUS	false
104.18.37.193	unknown	United States	13335	CLOUDFLARENETUS	false
20.234.104.33	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.199.111.154	unknown	Netherlands	54113	FASTLYUS	false
192.229.221.25	cs1150.wpc.betacdn.net	United States	15133	EDGECASTUS	false
37.157.5.132	unknown	Denmark	198622	ADFORMDK	false
151.101.3.1	unknown	United States	54113	FASTLYUS	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
34.147.177.40	unknown	United States	2686	ATGS-MMD-ASUS	false
142.250.184.228	unknown	United States	15169	GOOGLEUS	false
142.250.185.65	unknown	United States	15169	GOOGLEUS	false
151.101.193.21	unknown	United States	54113	FASTLYUS	false
142.250.185.66	unknown	United States	15169	GOOGLEUS	false
174.137.133.49	unknown	United States	27257	WEBAIR-INTERNETUS	false
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
142.250.184.196	unknown	United States	15169	GOOGLEUS	false
142.250.186.34	unknown	United States	15169	GOOGLEUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
142.250.184.193	unknown	United States	15169	GOOGLEUS	false
172.64.150.63	unknown	United States	13335	CLOUDFLARENETUS	false
185.184.8.90	unknown	Poland	204995	RTB-HOUSE-AMSNL	false
151.101.129.21	unknown	United States	54113	FASTLYUS	false
185.199.108.154	unknown	Netherlands	54113	FASTLYUS	false
69.164.210.100	tcpdf.org	United States	63949	LINODE-APLinodeLLCUS	false
142.250.184.238	cse.google.com	United States	15169	GOOGLEUS	false
172.104.64.149	unknown	United States	63949	LINODE-APLinodeLLCUS	false
23.210.92.139	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.16.194	unknown	United States	15169	GOOGLEUS	false
52.223.40.198	unknown	United States	8987	AMAZONEXPANSIONGB	false
142.250.184.234	unknown	United States	15169	GOOGLEUS	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FA-EDI-2409-0280.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2b540862-659c-4bbd-bef5-1d8084c4629e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241004074529Z-167.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6332

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Windows Analysis Report
FA-EDI-2409-0280.pdf

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525475
Start date and time:	2024-10-04 09:44:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FA-EDI-2409-0280.pdf
Detection:	SUS
Classification:	sus25.phis.winPDF@62/1161@19/100
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Browse: https://tcpdf.org/examples Browse: https://github.com/tecnickcom/tc-lib-pdf Browse: https://www.paypal.com/cgi-bin/webscr?cmd=_donations&currency_code=GBP&business=paypal@tecnick.com&item_name=donation%20for%20tc-lib-pdf%20project Browse: https://github.com/tecnickcom/tcpdf Browse: https://tcpdf.org/about/ Close Viewer Browse: https://tcpdf.org/examples/ Browse: https://tcpdf.org/docs/ Browse: https://tcpdf.org/docs Browse: https://nicola.asuni.xyz/ Browse: https://tecnick.com/ Browse: https://adclick.g.doubleclick.net/aclk?nis=4&sa=l&ai=CHD_aNp3_ZovIFovy1PIP-aWeKL2v2qN2_YnB5N4S29keEAEgu4uaKGDJBqAB7brihAPIAQmpAvhHicydf7I-qAMByAPLBKoE0wFP0FmwUpPyb5JVagMdhEHUXO0RJQJipO1YiIfK5jUqZbYMCAAOFACdtVSqQOdGlYgIER5Gw_KGip1qK9ahHUEreuw2AOhWwdZwQJldvOiZbh8scYHJmnvZ1v_c2TB5KWLkmlamc-HU1gHdG3SrtukpmydJfNat38BTqWcJA2ONA5iVk0cLxb8iU90YXE6-MvVj0TfmQ6INpTvEoMw4PCWSV1kSbkyaW_D06Ku5zi8Z9pAUlVe_kkvGDaUNHdxdleChMzkq4zCP0XYU2gJCyIiPvu4FwASfibqU5gSIBeHXjrBKoAYugAf7xJ17qAfVyRuoB9m2sQKoB6a-G6gHjs4bqAeT2BuoB_DgG6gH7paxAqgH_p6xAqgHr76xAqgHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAfgvbECqAf_nrECqAffn7ECqAfKqbECqAfrpbECqAfqsbECqAeZtbECqAe-t7ECqAf4wrECqAf7wrEC2AcA0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpYp__65J30iAOxCXiSimhF2noygAoBigrAAWh0dHBzOi8vbW9uaXRvci5jbGlja2NlYXNlLmNvbS90cmFja2VyLz9pZD1mZnhhb05DMGgwRTlDSiZhZHBvcz0mbG9jcGhpc2ljYWw9Mjg0MCZsb2NpbnRlcmVzdD0mYWRncnA9MTY0ODYyMjY0NDc5Jmt3PSZudz1kJnVybD17bHB1cmx9JmNwbj0xOTk2NTEyNzY0OSZkZXZpY2U9YyZjY3B0dXJsPWNoZWNrbWsuY29tJnBsPXRjcGRmLm9yZ5gLAcgLAeALAYAMAdoMEAoKEMCWgtir6ZKkdxICAQOqDQJVU8gNAbgT5APYEw3QFQGYFgH4FgGAFwGyFwIYAboXAjgBshgJEgLHThguIgEA0BgB6BgB&ae=1&ase=2&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&num=1&cid=CAQSTgDpaXnfr1vmJpo47AAcBt_oTOHMkst3w1sJcW690O03vI9qUQ5EO2xhS-OGlpU1FvY1ioGFAf4dyfYLqsp9aTv43bXJZQT_r5bg2o2-ChgB&sig=AOD64_0CNlIbcpYPgD36zlEOk1S4f0vDUg&client=ca-pub-2627887748647914&rf=1&nb=0&adurl=https://checkmk.com/l/a/start-checkmk-free-trial-us%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3D%5BCampaigns%5DGDN-Competitors-Customers-US%26utm_adgroup%3Dtopics-2024utm_content%3Dfree-trial%26utm_term%3Dtcpdf.org%26gad_source%3D5%26gclid%3DEAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE Browse: https://adclick.g.doubleclick.net/aclk?nis=4&sa=l&ai=CHD_aNp3_ZovIFovy1PIP-aWeKL2v2qN2_YnB5N4S29keEAEgu4uaKGDJBqAB7brihAPIAQmpAvhHicydf7I-qAMByAPLBKoE0wFP0FmwUpPyb5JVagMdhEHUXO0RJQJipO1YiIfK5jUqZbYMCAAOFACdtVSqQOdGlYgIER5Gw_KGip1qK9ahHUEreuw2AOhWwdZwQJldvOiZbh8scYHJmnvZ1v_c2TB5KWLkmlamc-HU1gHdG3SrtukpmydJfNat38BTqWcJA2ONA5iVk0cLxb8iU90YXE6-MvVj0TfmQ6INpTvEoMw4PCWSV1kSbkyaW_D06Ku5zi8Z9pAUlVe_kkvGDaUNHdxdleChMzkq4zCP0XYU2gJCyIiPvu4FwASfibqU5gSIBeHXjrBKoAYugAf7xJ17qAfVyRuoB9m2sQKoB6a-G6gHjs4bqAeT2BuoB_DgG6gH7paxAqgH_p6xAqgHr76xAqgHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAfgvbECqAf_nrECqAffn7ECqAfKqbECqAfrpbECqAfqsbECqAeZtbECqAe-t7ECqAf4wrECqAf7wrEC2AcA0ggmCIBhEAEYHzICigI6C4BAgMCAgICgqIACSL39wTpYp__65J30iAOxCXiSimhF2noygAoBigrAAWh0dHBzOi8vbW9uaXRvci5jbGlja2NlYXNlLmNvbS90cmFja2VyLz9pZD1mZnhhb05DMGgwRTlDSiZhZHBvcz0mbG9jcGhpc2ljYWw9Mjg0MCZsb2NpbnRlcmVzdD0mYWRncnA9MTY0ODYyMjY0NDc5Jmt3PSZudz1kJnVybD17bHB1cmx9JmNwbj0xOTk2NTEyNzY0OSZkZXZpY2U9YyZjY3B0dXJsPWNoZWNrbWsuY29tJnBsPXRjcGRmLm9yZ5gLAcgLAeALAYAMAdoMEAoKEMCWgtir6ZKkdxICAQOqDQJVU8gNAbgT5APYEw3QFQGYFgH4FgGAFwGyFwIYAboXAjgBshgJEgLHThguIgEA0BgB6BgB&ae=1&ase=2&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE&num=1&cid=CAQSTgDpaXnfr1vmJpo47AAcBt_oTOHMkst3w1sJcW690O03vI9qUQ5EO2xhS-OGlpU1FvY1ioGFAf4dyfYLqsp9aTv43bXJZQT_r5bg2o2-ChgB&sig=AOD64_0CNlIbcpYPgD36zlEOk1S4f0vDUg&client=ca-pub-2627887748647914&rf=1&nb=9&adurl=https://checkmk.com/l/a/start-checkmk-free-trial-us%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3D%5BCampaigns%5DGDN-Competitors-Customers-US%26utm_adgroup%3Dtopics-2024utm_content%3Dfree-trial%26utm_term%3Dtcpdf.org%26gad_source%3D5%26gclid%3DEAIaIQobChMIi7v75J30iAMVCzlVCB35kgcFEAEYASAAEgKu2PD_BwE

Input	Output
URL: https://tcpdf.org/ Model: jbxai	{ "brand":["TCPDF"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tcpdf.org/ Model: jbxai	{ "brand":["TCPDF"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Download", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tcpdf.org/ Model: jbxai	{ "brand":["TCPDF"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Download", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tcpdf.org/ Model: jbxai	{ "brand":["TCPDF"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Download", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tcpdf.org/examples/ Model: jbxai	{ "brand":["TCPDF"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Download", "text_input_field_labels":["Example 001", "Example 002", "Example 003", "Example 004", "Example 005", "Example 006", "Example 007", "Example 008", "Example 009", "Example 010", "Example 011", "Example 012"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tcpdf.org/examples/ Model: jbxai	{ "brand":["TCPDF"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Download", "text_input_field_labels":["Example 001", "Example 002", "Example 003", "Example 004", "Example 005", "Example 006", "Example 007", "Example 008", "Example 009", "Example 010", "Example 011", "Example 012"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tcpdf.org/examples/ Model: jbxai	{ "brand":["TCPDF"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Download", "text_input_field_labels":["Example 001", "Example 002", "Example 003", "Example 004", "Example 005", "Example 006", "Example 007", "Example 008", "Example 009", "Example 010", "Example 011", "Example 012", "Example 013"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tcpdf.org/examples/ Model: jbxai	{ "brand":["TCPDF"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Download", "text_input_field_labels":["Example 001", "Example 002", "Example 003", "Example 004", "Example 005", "Example 006", "Example 007", "Example 008", "Example 009", "Example 010", "Example 011", "Example 012", "Example 013"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tcpdf.org/examples/ Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tcpdf.org/examples/ Model: jbxai	{ "brand":["TCPDF"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Download", "text_input_field_labels":["Example 001", "Example 002", "Example 003", "Example 004", "Example 005", "Example 006", "Example 007", "Example 008", "Example 009", "Example 010", "Example 011", "Example 012", "Example 013"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://github.com/tecnickcom/tc-lib-pdf Model: jbxai	{ "brand":["tecnickcom"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tcpdf.org/about/ Model: jbxai	{ "brand":["TCPDF"], "contains_trigger_text":true, "trigger_text":"TCPDF is a free Open Source PHP class for generating PDF documents.", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://github.com/tecnickcom/tcpdf Model: jbxai	{ "brand":["tecnickcom"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tcpdf.org/ Model: jbxai

URL: https://tcpdf.org/about/ Model: jbxai	{ "brand":["TCPDF"], "contains_trigger_text":true, "trigger_text":"TCPDF is a free Open Source PHP class for generating PDF documents.", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tcpdf.org/about/ Model: jbxai	{ "brand":["TCPDF"], "contains_trigger_text":true, "trigger_text":"TCPDF is a free Open Source PHP class for generating PDF documents.", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tcpdf.org/about/ Model: jbxai	{ "brand":["TCPDF"], "contains_trigger_text":true, "trigger_text":"TCPDF is a free Open Source PHP class for generating PDF documents.", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tcpdf.org/docs/https://tcpdf.org/docs Model: jbxai	{ "brand":["TCPDF"], "contains_trigger_text":true, "trigger_text":"404 Page not found", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tcpdf.org/about/ Model: jbxai	{ "brand":["TCPDF"], "contains_trigger_text":true, "trigger_text":"TCPDF is a free Open Source PHP class for generating PDF documents.", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://nicola.asuni.xyz/ Model: jbxai	{ "brand":["Nicola Asuni"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tecnick.com/ Model: jbxai	{ "brand":["Tecnick.com"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tecnick.com/ Model: jbxai	{ "brand":["TECH CK. COM", "Tech nick. com"], "contains_trigger_text":true, "trigger_text":"Free 14 Day Trial", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://tecnick.com/ Model: jbxai

URL: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35k Model: jbxai	{ "brand":["checkmk"], "contains_trigger_text":true, "trigger_text":"Download", "prominent_button_name":"Download", "text_input_field_labels":["Business email", "Select OS Distribution"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35k Model: jbxai	{ "phishing_score":1, "brands":"checkmk", "legit_domain":"checkmk.com", "classification":"known", "reasons":["The brand 'checkmk' is directly associated with the URL 'checkmk.com'.", "The domain name matches fully with the legitimate domain name associated with the brand.", "There are no suspicious elements in the URL such as misspellings, extra characters, or unusual domain extensions.", "The input field 'Business email' is typical for a legitimate business-related site."], "brand_matches":[true], "url_match":true, "brand_input":"checkmk", "input_fields":"Business email"}

URL: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35k Model: jbxai	{ "brand":["checkmk"], "contains_trigger_text":true, "trigger_text":"We use cookies", "prominent_button_name":"Download", "text_input_field_labels":["Business email", "Select OS Distribution"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://checkmk.com/l/a/start-checkmk-free-trial-us?utm_source=google&utm_medium=cpc&utm_campaign=[Campaigns]GDN-Competitors-Customers-US&utm_adgroup=topics-2024utm_content=free-trial&utm_term=tcpdf.org&gad_source=5&gclid=EAIaIQobChMIi7v75J30iAMVCzlVCB35k Model: jbxai	{ "phishing_score":1, "brands":"checkmk", "legit_domain":"checkmk.com", "classification":"known", "reasons":["The brand 'checkmk' is directly associated with the URL 'checkmk.com'.", "The domain name matches fully with the legitimate domain name associated with the brand.", "There are no suspicious elements in the URL such as misspellings, extra characters, or unusual domain extensions.", "The input field 'Business email' is typical for a legitimate business-related site."], "brand_matches":[true], "url_match":true, "brand_input":"checkmk", "input_fields":"Business email"}

URL: https://tcpdf.org/ Model: jbxai

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.228.74.166	https://ahchoadeegu.homes?u=k8pp605&o=c9ewtnr&t=8845	Get hash	malicious	Unknown	Browse
	https://serrespec.weebly.com/tc2000-stock-charting-software.html	Get hash	malicious	Unknown	Browse
	https://btinternet-102307.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse
	https://att-service-106132.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse
	https://btinternet-107377.weeblysite.com/	Get hash	malicious	Unknown	Browse
	https://juno-message-center-101610.weeblysite.com/	Get hash	malicious	Unknown	Browse
	https://webmail-102270.weeblysite.com/	Get hash	malicious	Unknown	Browse
	https://juno-108647.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse
	https://telstra-108830.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse
	https://att-105877.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse
169.150.247.39	https://softworldenterprise.com	Get hash	malicious	Unknown	Browse	cdn.rawgit.com/michalsnik/aos/2.1.1/dist/aos.js
	http://cdn.bootcdn.net	Get hash	malicious	Unknown	Browse	cdn.bootcdn.net/
	PAYNOW_2023_08_002783pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.openlend.lat/aw8o/
	fjerbregners_patrol.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.openlend.lat/aw8o/?1NM6e=JwP18BaQn2gAMbwzAk/tzHq1rHqPkgowxzXz/N2AVg5llpqPoDBUT4Fbw9qJesVKC8w5QoNuWE8SYi183Rf2cdVRH8sDFcjA1Q==&P4=_n5TPHiTKZj
51.89.9.252	http://btinternet-104138.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse
	http://nodechain-launchpadlpx.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	http://att-103969.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse
	http://rewardsforyoutoclaim.pages.dev/	Get hash	malicious	Unknown	Browse
	https://dreativityblocksnodes.pages.dev/	Get hash	malicious	Unknown	Browse
	https://www.getcoloringpages.com/coloring/359	Get hash	malicious	Unknown	Browse
	https://multichainfix.pages.dev/chunks/patterns	Get hash	malicious	Unknown	Browse
	https://uAa.iancendit.com/9uCUGa/K%7BEmail%7D	Get hash	malicious	HTMLPhisher	Browse
	https://swishmax.en.download.it/	Get hash	malicious	PureLog Stealer	Browse
	https://multichainfix.pages.dev/chunks/patterns/promopath.html/	Get hash	malicious	Unknown	Browse
169.150.247.37	https://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E	Get hash	malicious	Unknown	Browse	security1.b-cdn.net/
	http://security-azure.b-cdn.net/	Get hash	malicious	Unknown	Browse	security-azure.b-cdn.net/
	EBAbsk8ydv.exe	Get hash	malicious	Unknown	Browse	xn--ypd.dssdhome.xyz/11/ip.bin
	https://softworldinc.com	Get hash	malicious	Unknown	Browse	cdn.rawgit.com/michalsnik/aos/2.1.1/dist/aos.js
	http://office365secure-thresholdacoustics-q5cdxz-my-sharepoint-com.b-cdn.net	Get hash	malicious	Unknown	Browse	office365secure-thresholdacoustics-q5cdxz-my-sharepoint-com.b-cdn.net/background-mailbox.jpg

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
paypal-dynamic.map.fastly.net	Audio_Msg..00299229202324Transcript.html	Get hash	malicious	Unknown	Browse	151.101.65.21
	(No subject) (82).eml	Get hash	malicious	Unknown	Browse	151.101.1.21
	https://www.pineapplehospitality.net/	Get hash	malicious	Unknown	Browse	151.101.193.21
	http://upspostalstamp.com/	Get hash	malicious	Unknown	Browse	151.101.1.21
	Audio_Msg..00290663894983Transcript.html	Get hash	malicious	HTMLPhisher	Browse	151.101.193.21
	1445321243TK.pdf	Get hash	malicious	Unknown	Browse	151.101.65.21
	https://www.getcoloringpages.com/coloring/359	Get hash	malicious	Unknown	Browse	151.101.129.21
	http://paypal-poc-apimatic.pages.dev/	Get hash	malicious	Unknown	Browse	151.101.193.21
	https://dlupload.com/filedetail/1967602657	Get hash	malicious	Unknown	Browse	151.101.1.21
	https://www.govern1.com/login/725553600988130?e=272348586	Get hash	malicious	Unknown	Browse	151.101.129.21
www.tcpdf.org	1445321243TK.pdf	Get hash	malicious	Unknown	Browse	69.164.210.100
cs1150.wpc.betacdn.net	https://hayanami-4df5b.web.app/verifyDelivery	Get hash	malicious	Unknown	Browse	192.229.221.25
	https://www.pineapplehospitality.net/	Get hash	malicious	Unknown	Browse	192.229.221.25
	http://upspostalstamp.com/	Get hash	malicious	Unknown	Browse	192.229.221.25
	1445321243TK.pdf	Get hash	malicious	Unknown	Browse	192.229.221.25
	https://github.com/greenshot/greenshot/releases/download/Greenshot-RELEASE-1.2.10.6/Greenshot-INSTALLER-1.2.10.6-RELEASE.exe	Get hash	malicious	Unknown	Browse	192.229.221.25
	https://dlupload.com/filedetail/1967602657	Get hash	malicious	Unknown	Browse	192.229.221.25
	https://xy2.eu/3k2fI	Get hash	malicious	Unknown	Browse	192.229.221.25
	https://bankatcitylogin.braincert.com/p/bankatcitycomcitynationalbankcitynationalloginaccessprofilevalidationid289393839bankatcitycitynationalbankcustomerloginverificationprofilecitynationalbankbankatcity	Get hash	malicious	HTMLPhisher, PayPal Phisher	Browse	192.229.221.25
	https://www.govern1.com/login/725553600988130?e=272348586	Get hash	malicious	Unknown	Browse	192.229.221.25
	https://link.edgepilot.com/s/9af6615e/9PTSwESci0mLBHHjcB2qKA?u=https://niverapaints.com/	Get hash	malicious	Unknown	Browse	192.229.221.25
googleads.g.doubleclick.net	https://irp.cdn-website.com/02ccf804/files/uploaded/webpage.html	Get hash	malicious	Unknown	Browse	142.250.185.130
	https://go.hginsights.com/rs/214-HYO-692/images/HG	Get hash	malicious	Unknown	Browse	172.217.16.130
	https://novanutrix.com/vn%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/	Get hash	malicious	Unknown	Browse	142.250.65.162
	https://novanutrix.com/vn%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/	Get hash	malicious	Unknown	Browse	142.250.184.226
	https://u9313450.ct.sendgrid.net/ls/click?upn=u001.ZfA-2BqTl2mXIVteOCc-2BANg-2BtYQAbYWaU-2BKDDWa611GxHig-2BgElXnUy1eAOeNoTI9ToS9WuAxRUdR21lAIsTPE0g-3D-3Dd8kL_bf4JG6rVotaFp8XsYJMcbHq5p6ju5xz6OkJFWJQMhev1YsQkFFV7zJr96yz5256BnjjwP-2FrVNKeomJDukUeXnM2-2FUbrpvrFpNFdN8Hxo-2B8NA1G5PPzQiWnVnq4RPrf4MxseS-2FjeJBGe3OOYXNXxDmns1gfYeFwrIC6tXtQ3KJv23PKABAyqpBB-2FnsXl7BropPMbry14s3UYpaAeg1aJih0NQeQpVSOm5MBDYOXEHCyJCtLrpoW6SuZeJlGeeWyYAhbotSAdFsjwH5JN5fjIYp-2BMzHm9VPykPI2oeKmW91mIcQqO5YJ1dVv925b7N0T1v	Get hash	malicious	Unknown	Browse	216.58.206.34
	http://reviewnewdocuments.wordpress.com/	Get hash	malicious	Unknown	Browse	142.250.186.130
	https://ahchoadeegu.homes?u=k8pp605&o=c9ewtnr&t=8845	Get hash	malicious	Unknown	Browse	172.217.23.98
	https://trello.com/c/HA4sCE32	Get hash	malicious	HTMLPhisher	Browse	172.217.16.194
	KpCJCaQswCshdLQFFKLtCbGdhL.ps1	Get hash	malicious	Unknown	Browse	142.250.186.162
	http://www.sunsetsafaris.com.au//home	Get hash	malicious	Unknown	Browse	142.250.181.226
tcpdf.org	1445321243TK.pdf	Get hash	malicious	Unknown	Browse	69.164.210.100

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://www.google.de/url?q=8Oshpephqbbshop&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=XS40i2Jop98hjgaswD&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkOuteybdtwrQvao&ved=HXUursu8uE=&url=amp%2Fgvhs2020.com%2Fgtaowpqtwp%3Fe%3Dhttps%3A%2F%2Foutlook.office.com	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	Aura.exe	Get hash	malicious	RedLine	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	https://url.us.m.mimecastprotect.com/s/8I0_CKrkVEt48y6BzfMfWF5hBIN?domain=woems-my.sharepoint.com	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	https://t.co/dvIdjH2Xsv	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	https://irp.cdn-website.com/02ccf804/files/uploaded/webpage.html	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	http://whinairith.net	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	Full Litigation File.pdf	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	http://185.95.84.78/rd/4gmsyP17223JZmx332lihotmtcwn9842ZSCGIOAIIATLJCU85240TITV3606d9	Get hash	malicious	Phisher	Browse	4.175.87.197 184.28.90.27 13.107.246.45
3b5074b1b5d032e5620f69f9f700ff0e	RFQ__PO_PO 24090041-PDF____PDF.exe	Get hash	malicious	AgentTesla	Browse	40.113.110.67 40.113.103.199
	New order.exe	Get hash	malicious	AgentTesla	Browse	40.113.110.67 40.113.103.199
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse	40.113.110.67 40.113.103.199
	ra66DSpa.exe	Get hash	malicious	XWorm	Browse	40.113.110.67 40.113.103.199
	https://www.sexpartnercommunity.com/?e7ak3e0m=57296397&tba4bck7=eyJpdiI6Imp1cHMxdGJERWI4SjBwNVYvSWdWeHc9PSIsInZhbHVlIjoiSGhGdTY1TlFyN1JJQm03UEJhZGZxQjV2NncyZ0JWajdJZnRWaWNBZlM2dzVxV05KdGx3TXZaaURxZzgraDNUYURDK2EwcFUra28rNEE2YTdRYWRhdFdwQkxaL09xeDRCVUt0Rm1IT3cxa3hPd1huM3FkN3NzNS9BYjEwV2hOY3dzblZ6TW1TaUdDeXBOTG9zc2FtU0VZKzhNeVgzS1FkTnE3WnA5NUZqWXJTQkVaNlN1UmUrZFFTUlZzZ05pbVlnIiwibWFjIjoiOTFjZDc5Y2FhNTBkNGYyYWYzZDRiYzhlYjljMjZmYTE1MzBhNGI2MmQ0NTFhYmYyZmVjN2IwMGUyNmFlNjU3MCIsInRhZyI6IiJ9&spaRoute=/livecams/all&trk=toza80h	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	http://masdeliveryusa.com/	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	file.exe	Get hash	malicious	Credential Flusher	Browse	40.113.110.67 40.113.103.199
	tMREqVW0.exe	Get hash	malicious	XWorm	Browse	40.113.110.67 40.113.103.199
	https://wvr4dgzxxavl6jjpq7rl.igortsaplin.pro/WFzFCiNx	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67 40.113.103.199
	wSVyC8FY.exe	Get hash	malicious	XWorm	Browse	40.113.110.67 40.113.103.199

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.17701023266396
Encrypted:	false
SSDEEP:	6:Qeut+q2PN72nKuAl9OmbnIFUt8He8Zmw+He8VkwON72nKuAl9OmbjLJ:QeuovVaHAahFUt8He8/+He85OaHAaSJ
MD5:	B7B4DD22A1BEBB4D2E047047F7B890F2
SHA1:	D44230655F2B3612753C4394562FB36ACC25F0ED
SHA-256:	9EB427E2B320894275A3E0C8384559D0AF88ED0FA8DEF1F2BD4D3A0CBF75F043
SHA-512:	D99400B0012FC8AFDB34E65114C033DE6BC535F131314BFECC71E17254B06EA87587DDC42B5B1F29E69CF59DCBAC7DDEB6AD7AC3C471948C821F7F61EA5937EE
Malicious:	false
Reputation:	low
Preview:	2024/10/04-03:45:26.024 3f8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/04-03:45:26.026 3f8 Recovering log #3.2024/10/04-03:45:26.026 3f8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	6331
Entropy (8bit):	7.953120980262837
Encrypted:	false
SSDEEP:	192:+O9sjRwhPKMZ9scGFQn2bIrtX6Nu75khz2o:rejuhyMZ9b2Y6Nu7qX
MD5:	D7616A73A058BC95A363106420D6DC3C
SHA1:	AA4F9609CC0EBD7D6F09A3ED7F7D7D2435911A55
SHA-256:	BDCD1C90FF59AD4CD4984FF01C919CB11EC78EB0CC82751FB1E06A71F0164C96
SHA-512:	5BAA0026B6F975E1DB64EF10E082A03E4DAE376D95E7179220839D346939594C264F4E8548CF8EB9B1041CE93221FE4DD0D3895CB79A1E96F7841ECF952A47C2
Malicious:	false
URL:	https://avatars.githubusercontent.com/u/53585086?s=64&v=4
Preview:	.PNG........IHDR...@...@.....%......IDATx..zI.$Wz..b.=......d...r<..h4.\|.%....._}.a.&..Y._...\|...2d... .C.Ci4-...M........"c}....^Dfdu..FWddF.~.......o)..1 H.%....8.RB....R.W..b..2E.....\..;:........5..=Z..Q.W.. ..]...;7.....z.N(.....@.L.R...AD..(.0F.RA)aD..J....Jg..."%@.E...E\|..?.{F.M.....g_...(....p....0J..qb5..X....O~..{...7...w[.6...F4v$..!"...E....(Xki;.......J............f.aY.....J....~.._.I.....v....?J.TI..A.g..L..8..Y.sj..r.?...%... .W.....^... C.+.H........<.+...V:.X.\...~.E.w.......a..l.+.`...q.d.G.s..a.2..i.$a.E)t.......t.u.Z..#:^Y..)...Q..v................q)..d...H...........U.pF.....q.....B..V..Z-B0."...%<..J...8U..=.w..r..0.!F.-....!...?.....!D.[..sU......W.R.n.....T...."0..L....$....+....$M)..u]..L.LFi..=N........W/...TG.1..KO.f.U.P..;..S.".E.Y...J..(....?..X.....FM8.Ra%..s].......e......r .eJ..e..@e.'.....+.\..\|.0..`..Vp,.!.d.......J.x.>.?..BN.....X>..0?7...>{.(H2....r...4......$I..M...`.GB...^\|.[:.K...C).."....<....J._

File type:	PDF document, version 1.7, 1 pages
Entropy (8bit):	7.8699467986951595
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	FA-EDI-2409-0280.pdf
File size:	38'369 bytes
MD5:	8d65098e335bdc5e3b5ab43f42e0c69b
SHA1:	03f1c56e1696a97edf59439dba262105c739554d
SHA256:	6a3208e585f53c1ada70aa5abaf89e6b6ebef375caa61217c187c8f79ffb969b
SHA512:	ab453da9a18fd4696bd587a35ead1e97388806f97f7fcff38d710e03bf9798748743dfa4bd9399373986c517ba4fbff1ec0c7e1a3af3e289d8b0470f8680cf0f
SSDEEP:	768:BIA76pvlcA58ljNPfgSBz5ovjdaAEyTTKd9UtU:BIAQcyQRPf/5EjE2TTKduU
TLSH:	4B03AFA0566DD84DD086F801D8B8F39696BB373884F79860F6A7DE97E063180FD01A5B
File Content Preview:	%PDF-1.7.%.....6 0 obj.<< /Type /Page /Parent 1 0 R /LastModified (D:20241003130402+02'00') /Resources 2 0 R /MediaBox [0.000000 0.000000 595.275591 841.889764] /CropBox [0.000000 0.000000 595.275591 841.889764] /BleedBox [0.000000 0.000000 595.275591 841

General
Header:	%PDF-1.7
Total Entropy:	7.869947
Total Bytes:	38369
Stream Entropy:	7.913177
Stream Bytes:	35874
Entropy outside Streams:	5.268354
Bytes outside Streams:	2495
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	11
endobj	11
stream	3
endstream	3
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	1
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0