Edit tour

Windows Analysis Report
Fact-2024-10.pdf

Overview

General Information

Sample name:	Fact-2024-10.pdf
Analysis ID:	1527856
MD5:	be0f0c241442901014ee5b364e911b7e
SHA1:	e41a6b08f9af0e18afc3acaa51fca1b83109f9ab
SHA256:	5c05d426782d494decfcb5ca6cda4765090a03d05a3ab2d70c66826c21740cff
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Connects to many IPs within the same subnet mask (likely port scanning)

Phishing site detected (based on favicon image match)

Phishing site detected (based on logo match)

Detected hidden input values containing email addresses (often used in phishing pages)

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Suspicious form URL found

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 6996 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Fact-2024-10.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6328 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5624 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1732,i,380461973633087296,8658590429477565550,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://banderolaver.pro/microsoft-verify.php?user_email=cristina.marinello@smeg.es" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 8004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1572,i,13587436803085101893,8356992849763643841,262144 /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

HTTP traffic detected: POST /gen_204?s=webhp&t=cap&atyp=csi&ei=K5kDZ4GuK5mqxc8PnK3nmQ0&rt=wsrt.1575,cbs.92,cbt.436,hst.45&opi=89978449&dt=&ts=201376 HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.149"Content-Type: text/plain;charset=UTF-8sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.149", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.149"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.google.comX-Client-Data: CI+2yQEIpbbJAQipncoBCO6LywEIlaHLAQic/swBCPqYzQEIhaDNAQjcvc0BCNrDzQEIucrNAQif0c0BCNzTzQEI0dbNAQj01s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=2IPV99F8I4K9bZ_VqhXjTcQUBqqeHEk_hgeNJ-_BobpZoYS82tkp9frtlyNNytujocldaiTf0gyORfTNKdDQ8LgNgNCDg17y7JuNpeSLw0dpLY2lDbIJh9j-ucQXosc_EOtkI64AjjoJU4Xn4oWCDfrMSKX1bOE-G7Gt78yiZi1EqpN_CjTFmLQus1D4e4aR8NE; AEC=AVYB7crB1F1G-zgAOZEEzXr5bq2_oqxspub171EE_8WdjjIXjJ82j73Fghc

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cacheX-Frame-Options: SAMEORIGINX-XSS-Protection: 1; mode=blockX-Cloud-Trace-Context: 395e59fcfcea6fee3dda35449cfaf195Date: Mon, 07 Oct 2024 08:19:11 GMTServer: Google FrontendContent-Length: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/imghp?hl=en&ogbl	HTTP Parser: No favicon
Source: https://www.google.com/imghp?hl=en&ogbl	HTTP Parser: No favicon
Source: https://store.google.com/US/?utm_source=hp_header&utm_medium=google_ooo&utm_campaign=GS100042&hl=en-US	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.12:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.12:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.12:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.12:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.44:443 -> 192.168.2.12:50174 version: TLS 1.2

Source:	Binary string: _.ndb=function(a,b,c,d){_.eoa()&&_.foa.get(a)&&(a=_.Te.get(a),!c&&b&&(c=_.Ue(b)),_.Je(b\|\|document.body,a,{element:b,dataset:c,event:d,jL:void 0,nxb:!0}))};_.odb=function(a,b,c){_.Xga(a,c);return _.tb(a,2,_.Wea(b),_.La())};_.pdb=function(a){return a.previousElementSibling!==void 0?a.previousElementSibling:_.wAa(a.previousSibling,!1)};qdb=function(a,b,c,d,e,f,g){_.cm.call(this,a);this.clientX=c;this.clientY=d;this.left=f!==void 0?f:b.deltaX;this.top=g!==void 0?g:b.deltaY;this.ka=b};_.hh(qdb,_.cm); source: chromecache_599.12.dr
Source:	Binary string: _.pDb=_.J("zbW2Cf");_.qDb=_.J("OZ3M7e"); source: chromecache_567.12.dr
Source:	Binary string: [];f=JNb(f,c);!f&&b&&(b=e?a.slice(0,d):a,f=JNb(b,c));return f},LNb=function(a,b){for(var c=a.length-1;c>=0;c--){var d=a[c];if(_.XLb(d,b))return d}},MNb=function(a,b){var c=b===void 0?{}:b;b=c.threshold===void 0?0:c.threshold;c=c.wrap===void 0?!0:c.wrap;var d=INb(a);a=d.pDb;d=d.k9b;var e=d>=0&&d<a.length,f=e?a.slice(0,d+1):[];f=LNb(f,b);!f&&c&&(c=e?a.slice(d+1):a,f=LNb(c,b));return f},NNb=function(a){(0,_.un)(function(){throw a;},0)},ONb=function(a,b){var c;return(c=a.reverse().find(function(d){return d.Ua=== source: chromecache_599.12.dr
Source:	Binary string: a.Yf.Su("bs",r.body.length);e.push(r.body);break;case 4:t=document.createElement("script");_.Ok.vY(t,_.Cyb(r.body));x=document.createElement("div");x.appendChild(t);e.push(x.innerHTML);break;case 5:z=_.QDb(r.body,_.cHb,function(){return _.fd(Error("th`"+r.body.substr(0,100)),{Of:{l:""+r.body.length,t:a.Zz}})});f=_.mf(z,_.PDb,1,_.nf());g=_.Ch(z,_.Hyb,3)?_.u(z,_.Hyb,3):void 0;break;case 8:B=JSON.parse(r.body);h=Object.assign(h\|\|{},B);break;case 9:break;case 6:case 3:throw Error("uh");case 11:return V.Db(2); source: chromecache_567.12.dr
Source:	Binary string: var INb=function(a){if(!document.body.contains(a))throw Error("Yf");var b=Array.from(document.body.querySelectorAll("[tabindex], a, input, textarea, select, button"));a=_.$aa(b,a,_.zAa);if(a>=0)return{pDb:b,k9b:a-1,j9b:a+1};a=-a-1;return{pDb:b,k9b:a-1,j9b:a}},JNb=function(a,b){for(var c=0;c<a.length;c++){var d=a[c];if(_.XLb(d,b))return d}},KNb=function(a){var b={};var c=b.threshold===void 0?0:b.threshold;b=b.wrap===void 0?!0:b.wrap;var d=INb(a);a=d.pDb;d=d.j9b;var e=d>=0&&d<a.length,f=e?a.slice(d): source: chromecache_599.12.dr
Source:	Binary string: _.PDb=function(a){this.Da=_.n(a)};_.C(_.PDb,_.q);_.PDb.prototype.getId=function(){return _.E(this,1)};_.PDb.prototype.ka=function(){return _.E(this,2)}; source: chromecache_567.12.dr
Source:	Binary string: _.pHb(g,f.target.element)}).then(void 0,function(g){_.Qgc(f.target,"error");throw g;})},Rgc=function(a,b,c,d,e,f,g){return Pgc(a,b,c,d,e,g).fetch().then(function(h){f?f(b):b.log();return h})},Sgc=function(a,b){var c=new Map;b&&(c=zgc(b));c.set("google_abuse",a);return b=Object.fromEntries(c)},Tgc=function(a){_.fd(a,{Of:a.details})},Ugc=function(){_.loa("async",{u:function(a){a=a.qb.el();Ogc(a).then(void 0,Tgc)}});Ggc()},Vgc=_.Sb(_.Hyb),Wgc=_.Sb(_.PDb),Xgc=function(a,b){this.ka=b;this.cache=_.ke(_.ba.ka? source: chromecache_567.12.dr
Source:	Binary string: _.IDb=function(a,b,c,d,e,f,g){var h,l,m,p;return _.Kg(function(q){switch(q.oa){case 1:h=a.startUpdate();l=new _.jo("async","csi",void 0,{MYc:!1});m=new _.NDb(l,e.y7a,a);_.ODb(a,l,e.context,e.PPa);_.PDb(a,"yl");_.Cg(q,2);if(g){q.Fb(4);break}return q.yield(_.LDb(a,b,c,d,e,!1,l),5);case 5:g=q.Aa;case 4:return _.QDb(g),q.yield(RDb(e.onReady),6);case 6:return q.Aa?(a.setState("yp"),q.return(!1)):q.yield(_.ADb(h,g,a,{Hi:l,MAa:e.qIa,rX:m,kva:e.UK,Toa:e.Toa,ska:e.ska,source:f,triggerElement:e.trigger}),7); source: chromecache_1001.12.dr
Source:	Binary string: var sDb;sDb=function(a){_.rDb=_.td();_.Ne(document,_.pDb,a);return new _.xf(function(b){window.addEventListener("message",function e(d){d.data.type==="dosCookie"&&(window.removeEventListener("message",e),_.Ne(document,_.qDb),b(decodeURIComponent(d.data.exemptionCookie)))})})};_.rDb=null;_.tDb=sDb;_.uDb=!1; source: chromecache_567.12.dr
Source:	Binary string: case 7:if(!_.SDb(a,h))return q.return(!1);a.setState("yf");_.TDb(m,a.element);return q.return(!0);case 2:p=_.Gg(q);_.UDb(l,e.y7a);if(!_.SDb(a,h))return q.return(!1);_.PDb(a,"ye");throw p;}})};_.ODb=function(a,b,c,d){b.start();b.Gc("astyp",a.kH);(c==null?void 0:c.get("arc_id"))==="stev"&&(b.Gc("trt","st"),b.Gc("ssr","0"),d&&b.Gc("bb","1"));a=b.oa.startDate;var e,f,g,h;c=(e=google)==null?void 0:(f=e.timers)==null?void 0:(g=f.async)==null?void 0:(h=g.t)==null?void 0:h.atit;a&&c&&b.dB("tcdt",a-c)}; source: chromecache_1001.12.dr
Source:	Binary string: _.JDb.prototype.reset=function(){this.element.textContent="";this.element.removeAttribute("eid");this.setState("yp");delete this.element.__yup;_.hg()};_.JDb.prototype.setState=function(a){_.sl.removeAll(this.element,gEb);_.sl.removeAll(this.element,hEb);_.sl.add(this.element,a);_.Kt(this.element,iEb[a])};_.PDb=function(a,b){_.sl.removeAll(a.element,hEb);_.sl.add(a.element,b);_.Kt(a.element,iEb[b])};gEb=["yp","yf","yi"];hEb=["yl","ye"];jEb={}; source: chromecache_1001.12.dr
Source:	Binary string: _.pDb=function(a,b){oDb++;oDb===1&&_.Fqa("dos",function(){return""+oDb});_.Xd().Gc("dos","ssrc."+oDb+",target."+b).log()};_.qDb=function(a,b){_.Xd().Gc("dos","solved,target."+b).log()};_.rDb=function(a){var b,c,d;return(b=a?(c=window.google)==null?void 0:(d=c.ia)==null?void 0:d.r[a]:void 0)&&b.m===0?b:void 0}; source: chromecache_1001.12.dr
Source:	Binary string: cEb=function(a){var b,c,d;_.Kg(function(e){if(e.oa==1){if(a.oa!==a.Aa)return e.return();a.Hi.Gc("ima",String(a.Da));a.Hi.Gc("imn",String(a.oa));b=_.n(Object.keys(_.KCb));for(c=b.next();!c.done;c=b.next())d=c.value,a.Hi.Gc(d,_.KCb[d]());_.ko(a.Hi,"art");return a.y7a?e.yield(a.y7a(a.Hi),2):e.Fb(2)}a.Hi.log();_.Bg(e)})};var vDb=_.pDb,yDb=_.qDb;var fEb,gEb,hEb,jEb,iEb;fEb=0;_.JDb=function(a){this.element=a;this.Hra=_.ezb(a);this.oa=_.fzb(a);this.kH=_.gzb(this.Hra,this.oa,a);this.XIa=_.Xc(a,"asyncRclass")\|\|"";this.method=(this.P1=_.Xc(a,"asyncToken"))\|\|_.Xc(a,"asyncMethod")==="stateful"?"POST":"GET"};_.JDb.prototype.startUpdate=function(){fEb++;return this.element.__yup=fEb};_.SDb=function(a,b){return b===a.element.__yup}; source: chromecache_1001.12.dr
Source:	Binary string: _.LDb=function(a,b,c,d,e,f,g){var h=_.LCb.delegate().pyb.build(b,c,d,_.Rzb(a.element,e.trigger),e,a.element.id,f);g&&(h.Hi=g);var l=_.LCb.delegate().Us;return l.fetch(h).catch(function(m){return _.Kg(function(p){return p.return(xDb(m,a.element.id,l,h))})})};VDb=function(a){return function(b){var c=_.nDb(b);c&&_.pDb(c,a);throw b;}};_.QDb=function(a){a.header&&(a=_.H(a.header,2))&&a!==String(_.SCb)&&_.TCb.set(a,(_.TCb.get(a)\|\|0)+1)}; source: chromecache_1001.12.dr
Source:	Binary string: _.Odb=function(a,b){return Ndb(a.QN,b).then(function(c){if(c.size()>0)return c.Yc(0);throw _.MKa(a,b);})};_.nr=function(a,b,c){b=_.qg(b);return new _.lg(_.rf(a.QN,b,c))};_.or=function(a,b,c){b=_.qg(b);b=_.nr(a,b,c);if(b.size()>=1)return b.Yc(0);throw _.MKa(a,c);};_.Pdb=function(a,b){return _.Rn(a,'[jsname="'+b+'"]')};_.Qdb=function(a){a.oa=null;if(a.oL){if(a.oa){var b=a.oa;b.Oc=a.oL;b.render()}else _.yc(a.oL,_.Nk);_.Wl.Rb(a.oL,!!a.oa)}};_.Rdb=function(a,b){a.fRa=b;a.AP&&_.Wl.Rb(a.AP,a.fRa)}; source: chromecache_599.12.dr
Source:	Binary string: bHb=function(a,b){$Gb(_.Cyb(aHb(a,null,"script")),b)};dHb=function(a,b){var c=_.QDb(a,_.cHb,function(){_.fd(Error("If`"+a.substring(0,100)),{Of:{l:a.length.toString(),t:b}})});_.ba.W_jd\|\|(_.ba.W_jd={});for(var d=_.Ra(_.mf(c,_.PDb,1,_.nf())),e=d.next();!e.done;e=d.next())e=e.value,_.ba.W_jd[e.getId()]=JSON.parse(e.ka());_.Ch(c,_.Hyb,3)&&_.Lyb(_.u(c,_.Hyb,3))}; source: chromecache_567.12.dr

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 13.107.253.67 13.107.253.67
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.60
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.60
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.60
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.60
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172

Source: chromecache_995.12.dr	String found in binary or memory: L.getElementsByTagName("iframe"),ka=P.length,na=0;na<ka;na++)if(!v&&c(P[na],H.He)){oJ("https://www.youtube.com/iframe_api");v=!0;break}})}}else F(u.vtp_gtmOnSuccess)}var q=["www.youtube.com","www.youtube-nocookie.com"],r={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},t,v=!1;Z.__ytl=n;Z.__ytl.o="ytl";Z.__ytl.isVendorTemplate=!0;Z.__ytl.priorityOverride=0;Z.__ytl.isInfrastructure=!1; equals www.youtube.com (Youtube)
Source: chromecache_755.12.dr, chromecache_1328.12.dr, chromecache_974.12.dr, chromecache_807.12.dr, chromecache_995.12.dr, chromecache_940.12.dr	String found in binary or memory: Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},bk:function(){e=zb()},nd:function(){d()}}};var gc=la(["data-gtm-yt-inspected-"]),LC=["www.youtube.com","www.youtube-nocookie.com"],MC,NC=!1; equals www.youtube.com (Youtube)
Source: chromecache_807.12.dr, chromecache_940.12.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={hh:e,fh:f,gh:g,Rh:k,Sh:m,He:n,Cb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(WC(w,"iframe_api")\|\|WC(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!NC&&UC(x[A],p.He))return wc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_867.12.dr, chromecache_799.12.dr, chromecache_759.12.dr, chromecache_731.12.dr	String found in binary or memory: return b}JC.F="internal.enableAutoEventOnTimer";var gc=la(["data-gtm-yt-inspected-"]),LC=["www.youtube.com","www.youtube-nocookie.com"],MC,NC=!1; equals www.youtube.com (Youtube)
Source: chromecache_1333.12.dr	String found in binary or memory: this.Ka=[_.rT("https://storage.googleapis.com/"),_.rT("https://storage.googleapis.com/%path"),_.rT("https://www.youtube.com/")];this.wa=this.ha=this.Ga=this.Ja=this.Ea=null;this.Ra=[_.rT("mannequin/"),_.rT("modules/"),_.rT("lottie.min.js"),_.rT("view-in-ar/"),_.rT("model-viewer.min.js"),_.rT("iframe_api")];this.Mb=()=>_.ne(this,{service:{dialog:_.QC}}).then(b=>b.service.dialog);this.Sb=()=>_.ne(this,{service:{yfa:_.zUa}}).then(b=>b.service.yfa);this.Pa=()=>_.ne(this,{service:{view:_.Lk}}).then(b=> equals www.youtube.com (Youtube)
Source: chromecache_861.12.dr	String found in binary or memory: var Ci=".story-carousel__text-inner",Di="story-carousel__text-inner--active",Fi=".glue-pagination-page-list",Bi="StoriesCarouselCtrl.model.currentPage",Ei="gluepaginationtotalpages",Ki="(min-width: 1024px)",Gi="(min-width: 0) and (max-width: 599px)",Hi="(min-width: 600px) and (max-width: 1023px)",Ji=15,Li=35;var Mi=angular.module("glueYtVideoService",[A.module.name]),Ni=Ka("https://www.youtube.com/iframe_api");function V(a,b){this.EventType={lc:"glue.ng.ytVideo.service.IframeApiInitalized"};this.i=a;this.j=b;this.Events={Sb:"glue.ng.ytVideo.service.IframeApiInitalized"};this.scriptLoaded=this.apiInitialized=!1;this.f={};this.apiInitialized\|\|Oi(this)}function Oi(a){a.j.onYouTubeIframeAPIReady=angular.bind(a,function(){this.apiInitialized=!0;this.i.$broadcast(this.EventType.lc,this)})} equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: banderolaver.pro
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: sustainability.google
Source: global traffic	DNS traffic detected: DNS query: www.blog.google
Source: global traffic	DNS traffic detected: DNS query: blog.google
Source: global traffic	DNS traffic detected: DNS query: googletagmanager.com
Source: global traffic	DNS traffic detected: DNS query: lh3.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: csp.withgoogle.com
Source: global traffic	DNS traffic detected: DNS query: mail.google.com
Source: global traffic	DNS traffic detected: DNS query: smallbusiness.withgoogle.com
Source: global traffic	DNS traffic detected: DNS query: survey.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: about.google
Source: global traffic	DNS traffic detected: DNS query: store.google.com
Source: global traffic	DNS traffic detected: DNS query: 2542116.fls.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: adservice.google.com

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Fact-2024-10.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1732,i,380461973633087296,8658590429477565550,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://banderolaver.pro/microsoft-verify.php?user_email=cristina.marinello@smeg.es"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1572,i,13587436803085101893,8356992849763643841,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1732,i,380461973633087296,8658590429477565550,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1572,i,13587436803085101893,8356992849763643841,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Fact-2024-10.pdf	Initial sample: PDF keyword /JS count = 0
Source: Fact-2024-10.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://banderolaver.pro/microsoft-verify.php?user_email=cristina.marinello@smeg.es	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://support.google.com	0%	URL Reputation	safe
https://support.google.com	0%	URL Reputation	safe
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://sustainability.google/static/index.min.js?cache=47ade0f	0%	URL Reputation	safe
https://apis.google.com/js/api.js	0%	URL Reputation	safe
https://sustainability.google/static/index.min.css?cache=732a3af	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php)	0%	URL Reputation	safe
https://lens.google.com/gen204	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
https://domains.google.com/suggest/flow	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
dart.l.doubleclick.net	172.217.23.102	true	false	unknown
mail.google.com	142.250.185.69	true	false	unknown
googletagmanager.com	142.250.186.104	true	false	unknown
s-part-0039.t-0009.fb-t-msedge.net	13.107.253.67	true	false	unknown
appspot.l.google.com	142.250.185.177	true	false	unknown
adservice.google.com	142.250.184.194	true	false	unknown
about.google	216.239.32.29	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	unknown
ghs-svc-https-sni.ghs-ssl.googlehosted.com	142.250.185.147	true	false	unknown
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	unknown
www.google.com	142.250.186.68	true	false	unknown
banderolaver.pro	104.21.84.155	true	false	unknown
google.com	142.250.185.206	true	false	unknown
csp.withgoogle.com	142.250.186.113	true	false	unknown
plus.l.google.com	172.217.16.142	true	false	unknown
ad.doubleclick.net	142.250.186.70	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
smallbusiness.withgoogle.com	142.250.186.113	true	false	unknown
store.google.com	142.250.185.110	true	false	unknown
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
www3.l.google.com	142.250.185.78	true	false	unknown
play.google.com	142.250.185.142	true	false	unknown
googleads.g.doubleclick.net	172.217.18.2	true	false	unknown
sustainability.google	216.239.36.21	true	false	unknown
td.doubleclick.net	142.250.186.98	true	false	unknown
blog.google	216.239.36.21	true	false	unknown
googlehosted.l.googleusercontent.com	172.217.16.129	true	false	unknown
www.blog.google	unknown	unknown	false	unknown
ogs.google.com	unknown	unknown	false	unknown
ajax.aspnetcdn.com	unknown	unknown	false	unknown
lh3.googleusercontent.com	unknown	unknown	false	unknown
2542116.fls.doubleclick.net	unknown	unknown	false	unknown
x1.i.lencr.org	unknown	unknown	false	unknown
aadcdn.msftauth.net	unknown	unknown	false	unknown
survey.g.doubleclick.net	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://lh3.googleusercontent.com/2noIz2X2ov5fXwxhW8AbSDnLpp8tT3mI3-iV_OQ2UOwX_EhIBBgip7FPRs10DYmPKinVM98Qkjr1uN3BhQ3StGXCp1-O_wPwoLZeDQ=rw-e365-w2880	false		unknown
https://lh3.googleusercontent.com/dMQ1Q4xlLrl3-KsZvX_9v56emij4OkRxzapLM7RSuZVd7PgqfjPxKR4KY8hVHYXqP2ZkS-_ZueXb9ywW66H2oCyTglApr1ELCy3woOAviTgFP6uyAd0=h120	false		unknown
https://lh3.googleusercontent.com/RIuSgyC1CZvycdCvOhK6kyGWtKZwR6gN88CimyIAdew4WMYXisZeD2x5A3fOi3GETtFbnKgxw7hb_2_ERw1-ygGSCExAsemrYx79J0hRsa4SZzzxz3A?=w1440	false		unknown
https://lh3.googleusercontent.com/NksFVpnLFiAE4YKEh9n84ebvfznogwh0AyAUDpmpLqpBP7h791LS9RcIzWpE8XfsiR0NJiHomxV8FyVO2ccMF2VzB_L3omeUWuHu9d3LGJ4Ww6JKviev	false		unknown
https://lh3.googleusercontent.com/4-toCoht-pqFO58Z4u-TFBsGfwuNOORZURXtLloPAEw_87kPa7TKHqFmm3Z7mMO_hi5QWrjpBGqtY9zgr06lOsx3KVezooiNyD8bzJwIHK2UC1bE-RE=h120	false		unknown
https://www.google.com/search/howsearchworks/assets/hIvGK13F.min.js	false		unknown
https://lh3.googleusercontent.com/G723MydBoHRVwUpO7w9sZe6TfYCUenXv_B1mP4YhY4JYdKbpzRhdbobPFlJ60If-jIEYt6wxrdS99O1FZ19NaZMinIzE_-yKKpvV96ftdmcGW3WsWfc=-h255-e365-rwu	false		unknown
https://www.google.com/search/howsearchworks/assets/bAPu5B1A.min.js	false		unknown
https://www.google.com/search/howsearchworks/assets/J8wBfiw3.min.js	false		unknown
https://lh3.googleusercontent.com/WBLZJkX28kCd05v5OHikm8DtDP-uR6bu0P09l69suQGEz5An2DNEj5veTRUQDZJiDVGOJmTNn-NCJMLaU1EUahENSfSTx4P9sxk=rw-e365-w3000	false		unknown
https://sustainability.google/static/index.min.js?cache=47ade0f	false	URL Reputation: safe	unknown
https://www.google.com/xjs/_/ss/k=xjs.hd.Yezew14qcA8.L.B1.O/am=JFUAAAAAAAAAAAwAAAAAAAAAAAAAAAAAAAAAgAAAABAAAAAAAAAAQAGwkwAAACMAgA0ACAAAAAAAAQDAAAAAAAAAIAEAAAAEACoAAAAAAIAAABBBAACgCAAAAACAECAAAAEUQAhQgAQEiiAehQAAAMAAAAAhAAwwDEBQAcAoQAAAAACAAAACIAQAAACqAAQIANAjEAAGgJwAAAiBHgACAAAAQAAAASAAAGYCMEAGIAAAAAAAAIAMAAAAAAAAAAAAAAAAAAAAAAAAAABAABAAUAAAAAAAAAAAAAAAAAAAAAAC/d=0/br=1/rs=ACT90oFmoh_FVZzcHrBlQ3yAMWh-gYP18g/m=syjy,syo2?xjs=s4	false		unknown
https://lh3.googleusercontent.com/kQDv-46ToDkqXJ2DIlr7hKXKalQvL0NJy4oGIhNlUkxX95btXayCKNoZuaY_KT-6U8-Iz35FlDZXRd1U3bNFo99a3k0-vwIIbtEIStTKYwD_UxNkjA	false		unknown
https://lh3.googleusercontent.com/GhfIwA6ZINFkFgE77BVZ596ZtFXFc72Z6OfHGeHh4VO8ZSNBZkXXcRdgWvhzJKDzmy22DROUcJKCaZbeDHpT7raQ-ZKBmj1MM1JqGQ=rw-e365-w2880	false		unknown
https://lh3.googleusercontent.com/fvNhHugJAnsAS2DJW1V3kQ-0lsCTl2eDWV9NW2p4KXStsynp7EjqGSiACH9xSdCIvPvw0z9l_L7kOtfVZH07iQuasGIGWyFqhpdY=s0-rw-e365	false		unknown
https://store.google.com/_/Gstore/browserinfo?f.sid=-1689536960398387825&bl=boq_gstore-neo_20241003.05_p1&hl=en-US&authuser&_reqid=215589&rt=j	false		unknown
https://lh3.googleusercontent.com/RwVe2Cm1EjeDmYhdTzr179G0ovq_PCxgPzQ92PO-YxTBEFTHWh0L6Ev8FFDWRgRGrE81vwn95tyg9Ey189OO4kllhhpLAMIsGFZ-UKA=h120	false		unknown
https://about.google/assets-products/img/glue-icons.svg	false		unknown
https://lh3.googleusercontent.com/66PxAD8XJR8BGD_OjZnKQKZu0xEVnHfPmso4XbKjMOqQORhSyZaEqsGVW0qwMbX5eJ58pY5CwbsY02RLksHDsec-h4M-UcShUtZO0HLJ9FB1Qt0RhA=-h48-e365-rwu	false		unknown
https://sustainability.google/static/index.min.css?cache=732a3af	false	URL Reputation: safe	unknown
https://www.google.com/favicon.ico	false		unknown
https://lh3.googleusercontent.com/XfxlbB7Imi28_w277XeVC0u8Yngn8e1bQxhd6YK2snOdqt_uiwripgSEl5VNxgS2cJP2kf0dHv6LfSq8AG6YeJf9cpu1BE1kP36R=h120	false		unknown
https://lh3.googleusercontent.com/moWtYpo1G3n-1QfF5rNSy7n2IIQs785-H9DStefngR0kWMsmnPkzMu-SKH3eUxHVddekMttIA5olrn_wo3p50z04NyRZYPHYBc2cxvE=h120	false		unknown
https://www.google.com/xjs/_/js/k=xjs.s.en_US.uzv50Xj9NxM.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAABAgQCAAAAAAACgAAAAAAAAAAAAAAAAAAAAAQCACAkBAAAAQAAAAWAAAAQEAAACAAAAQEAAAQIAIAACAAAAAAAAAAAACIAGACAAAAAAAuAAAIFAEAAAACAAAwAAAAEAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAEEIB-AAAAAAAAAAAAAAIAAAAAwAAAAAAAAAAAAEAAAAAQBAAADJABCAAAAAAAAOA-AAgeABhSWAAAAAAAAAAAAAAAAAAgQTAWJKAgAAAAAAAAAAAAAAAAAAAAgJSgiQME/d=0/dg=0/br=1/rs=ACT90oG05-vGRs33Gyc4kyp2lOqUCl5nyw/m=sy1j9,P10Owf,sy1dd,sy1da,sytb,gSZvdb,sy1et,sy1e2,WlNQGd,sytg,sytd,sytc,syta,DPreE,sy3qp,sy3qo,nabPbb,sy1e1,sy1dz,syj6,sy1cp,CnSW2d,kQvlef,sy5mf,fXO0xe?xjs=s4	false		unknown
https://lh3.googleusercontent.com/Kkh1J0HrlRSnxSQrtnP4DFSMb4SI7Rz0yAT0G6ku1QOARBJJ4To-rDzu0tfCOMWvNCtYvCYaM92ISqiDPr-8KtwNqYO3xuJERwASsfn2=rw-e365-w2880	false		unknown
https://lh3.googleusercontent.com/xeVlvzZX32eg9zc9V7MLUWaEeOnwoa5OQfrgI10U4ub8QA6iwdq1TgcOpLTBiKQTosiNxtMBtpOvh_z7fq7eoISf53UZqZMd0dZR0gSLAAMFkK9vVfQ?=w1440	false		unknown
https://lh3.googleusercontent.com/Amr8tRBfd1Uk8zYm779hnSCwMzArp3LGD1LUhcgPdCOIk0UJczmdKLa42Apx-wzQdrUnsATBiFsyHT5pVit9Al6PwfVewM09FnlwAA=h120	false		unknown
https://banderolaver.pro/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js	true		unknown
https://lh3.googleusercontent.com/6xlGJ-dkwosfUisVYzRKNE1Wcr5QDDfRfZ4bXktF-Nn0J0ucHd_JI1wjXTls7lt5mvJvvcvtrNc0MESF98dAx6ivasEsZNxoaUZU-Q=h120	false		unknown
https://lh3.googleusercontent.com/sq57GaRCOEk-TcLHr8ZeehZOkRrOLLv0ZIL34gOO2TNqeQjAcLqZM_YvwoZCLFQbW1DS0K28QakL4JTKArVVV4pp-PtTltns7K25Pu5d7v-6dRSh-g=w1440-l90-sg-rj-c0xffffff	false		unknown
https://www.google.com/gen_204?s=imghp&t=cap&atyp=csi&ei=Z5kDZ46CBeiAxc8Pzf-N6Qg&rt=wsrt.945,cbs.98,cbt.1071,hst.43,prt.1059&opi=89978449&dt=&ts=196113	false		unknown
https://www.google.com/xjs/_/ss/k=xjs.s.N7uEhNpUhSA.L.B1.O/am=QAoAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAAEAACAAAAAAAAAAgAgAsEwCAAAwAgAANgAgAAAAAAAIAAAYAAAAAAAAkAAAAAAAAgBUAAAAAAAAAIAAAEAEBAAAFAIAAAAAAAAABgAAAACEAAEACKAAQgCgAAkIFAGIRyEAAAAwAAAAEAAGGAYgqABgAIAAAAAAAAAAAQAAAYAQAAAAUEEAAAECAPQIBIABICcAAIQAgAAgAAAAAEAAAAABAAEAgJgADJABCAAAAAAAAAASAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAAAAAAAAAAAAAABA/d=1/ed=1/br=1/rs=ACT90oEcmwtRzquuKp01ZddG2RmHbAE5Ww/m=cdos,hsm,jsa,mb4ZUb,d,csi,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl	false		unknown
https://lh3.googleusercontent.com/uzkOxzfGFGjzRx0FK6B541qcv469wNDTQf_TUu4oqH_oPUGJoajTkqHLJ9DD188Kmocg_DJg2OBf1FxyRc6MLK_gMFFRmm7n7XTreZU=h120	false		unknown
https://lh3.googleusercontent.com/p2EiNuo4FQe3s8dhYgEiejBxjryT3B46OTWNItLqiwF58V0T62GKHa7VrbOhI7BbnQOBvdkPFu-4YGG0Dg3b0moXWWSc_aB1hw67Kts=h120	false		unknown
https://lh3.googleusercontent.com/R7Wr9OkT5zk4gY2F3-tLiMwhFaMfO_hCU5LpTxztUaTOi8kU7_0QUIvOTlhHLyMol8kvHhVvdWUtjmAZ6cqiwGhwZzdg0fvc-UXtojU=h120	false		unknown
https://lh3.googleusercontent.com/kLMr5zuHxfe-IxhnKdLp_1JkP5sl2ova0svHjQkFnV1q8X7yE6uA9p8AToT_L7xL5s5EIayVVVljNtp7BgoL69PtZ-Mf00qUbpTLfrrqXWv99tatmXI=h120	false		unknown
https://lh3.googleusercontent.com/5CsRqfMEP1Rv-PPv9G4962lyEuvb4roSLJHJQWPbmCa51AmvynfoGfoKsKiS87QhX07xQMZAeLp8qoSy7CjVZkXJ1WapQiJkroCeJw=h120	false		unknown
https://about.google/assets-products/img/glue-google-color-logo.svg	false		unknown
https://www.google.com/search/howsearchworks/assets/0-7k4-1q.min.js	false		unknown
https://smallbusiness.withgoogle.com/?subid=us-en-et-g-awa-a-g_hpbfoot1_1!o2&utm_source=google&utm_medium=ep&utm_campaign=google_hpbfooter&utm_content=google_hpbfooter&gmbsrc=us-en_US-et-gs-z-gmb-s-z-u~sb-g4sb_srvcs-u#!/	false		unknown
https://lh3.googleusercontent.com/aD5GNhlaU2d70gmSy5ioL1dMSUZN9cHDWPLkIBLhCsJ-BgcGUm-PD6o8XExZcx1i2iZV6PH0P8v3ceg0x7Tzd_OZ5FV0nXs5mX15sgA=h120	false		unknown
https://www.google.com/gen_204?atyp=csi&ei=K5kDZ4GuK5mqxc8PnK3nmQ0&s=promo&rt=hpbas.5615,hpbarr.1720&zx=1728289073838&opi=89978449	false		unknown
https://lh3.googleusercontent.com/tC78k3bL_DjdIByD4HSnnblCZF0nlR599IWYDDghEJDn7dwg-tuOIXGVR1TwxePI063JTgu9NvrsvRutrqHOfR5AAWduD51R8zuswV8=h120	false		unknown
https://www.google.com/tools/feedback/chat_load.js	false		unknown
https://www.google.com/gen_204?s=webhp&t=cap&atyp=csi&ei=K5kDZ4GuK5mqxc8PnK3nmQ0&rt=wsrt.1575,cbs.92,cbt.436,hst.45&opi=89978449&dt=&ts=201376	false		unknown
https://www.google.com/search/howsearchworks/assets/IFunn9hk.min.js	false		unknown
https://lh3.googleusercontent.com/mjVS_Izc6fGAvuaT0v--gb2so5mZvAbI5EUMUB41cWB7tpy81trBCR8rIlj8NoKgPzDWGN-Hs97NlW0T9W57YJ5z9A8QQWwXUYa_Zg=h120	false		unknown
https://www.google.com/search/howsearchworks/assets/bS7WqXuL.min.js	false		unknown
https://lh3.googleusercontent.com/7j1-9AjGTjyFcEDU5lJw2BpZNYWNKgkxegHVv012Pm5OPBratN5ZsNVtpILRwXqE5Givogcj2VMswYdKR1dKvLvo2EQFSM0p7yTxYw=h120	false		unknown
https://www.google.com/services/?subid=ww-ww-et-g-awa-a-g_hpbfoot1_1!o2&utm_source=google.com&utm_medium=referral&utm_campaign=google_hpbfooter&fg=1	false		unknown
https://lh3.googleusercontent.com/1bBfkvken8Lqz8NftP9_n8PmC2j6iMPUovX_c-tahFJYXo1tImjmPBU1nv1ATO_XIIh2dHUH6DMp0blUuhL7PZ7JvhZwNQ4QaiYnBsE7sGZcTDP3fLI=h120	false		unknown
https://lh3.googleusercontent.com/UqqZocZvjGksiGtlRkKb5NsuhpQkMLt3A85lMQ81Pms9tSZ3lLpymbAeinPIe5qUJRdmOKqL9InBBVsh6_gK-1QcNGppeUa7owoKgqo=h120	false		unknown
https://www.google.com/search/howsearchworks/assets/BLvkbcMJ.min.js	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://support.google.com	chromecache_992.12.dr, chromecache_1354.12.dr, chromecache_689.12.dr, chromecache_563.12.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://blog.igorescobar.com	chromecache_985.12.dr	false		unknown
https://instagram.com/madebygoogle	chromecache_1032.12.dr	false		unknown
https://lh3.googleusercontent.com/6Q907Y7fYBiaW6VAnv1r8BHZnFXjJm138u89gr8j8NSikSES5OrnMMP0bDiTWR7YyY	chromecache_927.12.dr	false		unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_1240.12.dr, chromecache_887.12.dr, chromecache_1207.12.dr	false	URL Reputation: safe	unknown
https://support.google.com/store/answer/2664771?hl=%3	chromecache_1032.12.dr	false		unknown
https://www.google.com/intl/zh-TW/search/howsearchworks/	chromecache_927.12.dr	false		unknown
https://www.google.com/intl/en-IN/search/howsearchworks/	chromecache_927.12.dr	false		unknown
https://lh3.googleusercontent.com/iRxTGREAOizQhtbCjDGShDHvBc39qEI004M8SClsSzIBgvBsbUMFNVMDfAfzoEzgvr	chromecache_927.12.dr	false		unknown
https://www.google.com/intl/no/search/howsearchworks/	chromecache_927.12.dr	false		unknown
https://www.google.com/intl/hr/search/howsearchworks/	chromecache_927.12.dr	false		unknown
https://nest.com/$s/%2/widget/pro-finder/	chromecache_1032.12.dr	false		unknown
https://lh3.googleusercontent.com/VT4SCA4b12NEXu4W5qmH5nMdrHvYyXiasJ8kqJWUd7rtLUdO78YTV5v0ulPoXyXn8X	chromecache_927.12.dr	false		unknown
https://www.google.com/intl/es/search/howsearchworks/	chromecache_927.12.dr	false		unknown
https://www.google.com/intl/el/search/howsearchworks/	chromecache_927.12.dr	false		unknown
https://apis.google.com/js/api.js	chromecache_1119.12.dr	false	URL Reputation: safe	unknown
https://support.google.com/pixelphone	chromecache_1032.12.dr	false		unknown
https://www.google.com/intl/es-419/search/howsearchworks/	chromecache_927.12.dr	false		unknown
https://blog.google/products/search/generative-ai-google-search-may-2024/	chromecache_927.12.dr	false		unknown
https://lh3.googleusercontent.com/uEalHdGqJHrnhoH1O5rYmk5kO2c-xB5HxCobW5KSipKv22HsrmhZNjVvQmBdWcV06W	chromecache_927.12.dr	false		unknown
https://github.com/shoelace-style/shoelace/blob/next/src/internal/slot.ts	chromecache_889.12.dr	false		unknown
https://support.google.com/store/answer/6160267?hl=%3	chromecache_1032.12.dr	false		unknown
https://www.google.com/intl/pt/search/howsearchworks/	chromecache_927.12.dr	false		unknown
https://safety.google	chromecache_992.12.dr, chromecache_689.12.dr	false		unknown
http://www.opensource.org/licenses/mit-license.php)	chromecache_985.12.dr	false	URL Reputation: safe	unknown
https://support.google.com/legal/answer/14261249	chromecache_1032.12.dr	false		unknown
https://support.google.com/store/answer/11291219?hl=%3	chromecache_1032.12.dr	false		unknown
https://www.google.com/intl/en-GB/search/howsearchworks/	chromecache_927.12.dr	false		unknown
https://lh3.googleusercontent.com/OMmSijDU0neu_vZPqLWBrVJsQGT_D0ejrnpIgQMPkTZC-0s9dO6_kbV3sGb2q9BWmp	chromecache_927.12.dr	false		unknown
https://www.google.com/intl/da/search/howsearchworks/	chromecache_927.12.dr	false		unknown
https://www.google.com/intl/%1_$s/policies/terms/	chromecache_1032.12.dr	false		unknown
https://store.google.com/intl/en/ideas/articles/pixel-safety-features/	chromecache_983.12.dr	false		unknown
https://play.google.com	chromecache_992.12.dr, chromecache_1354.12.dr, chromecache_689.12.dr, chromecache_563.12.dr	false		unknown
https://www.google.com/intl/bg/search/howsearchworks/	chromecache_927.12.dr	false		unknown
https://www.google.%1/contact/impressum.html	chromecache_1032.12.dr	false		unknown
https://www.google.com/intl/id/search/howsearchworks/	chromecache_927.12.dr	false		unknown
https://lh3.googleusercontent.com/AWAtSwGZaLr1UrvVSj5_72Uv2ckdZVWM9PIn9mm2qLdclYd2cYKLQXlvLIrVKHEzS5	chromecache_983.12.dr	false		unknown
https://lh3.googleusercontent.com/qN7B3-XsAtLKXTj8nGi839OyQHwQJTVk2TjOTp8tbKPxIlTN2tUb8syb7PjZ2tX7_x	chromecache_983.12.dr	false		unknown
https://lens.google.com/gen204	chromecache_1001.12.dr, chromecache_567.12.dr	false	URL Reputation: safe	unknown
https://www.google.com/intl/hu/search/howsearchworks/	chromecache_927.12.dr	false		unknown
https://support.google.com/store/gethelp	chromecache_1032.12.dr	false		unknown
https://support.google.com/store/answer/12436460?hl=%3#free_standard_shipping	chromecache_1032.12.dr	false		unknown
https://www.google.com/intl/ru/search/howsearchworks/	chromecache_927.12.dr	false		unknown
https://home.nest.com/en/US	chromecache_1032.12.dr	false		unknown
https://apis.google.com	chromecache_929.12.dr, chromecache_1066.12.dr, chromecache_1220.12.dr, chromecache_961.12.dr, chromecache_943.12.dr	false	URL Reputation: safe	unknown
https://domains.google.com/suggest/flow	chromecache_1066.12.dr, chromecache_961.12.dr	false	URL Reputation: safe	unknown
https://lh3.googleusercontent.com/ByIuDjG_OxNhZWu_Bix9cHR32kCnpGrjVaunDIzC9Q75eon4dC4Ei5h2pcD85FyPcj	chromecache_927.12.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.100	unknown	United States	15169	GOOGLEUS	false
142.250.185.147	ghs-svc-https-sni.ghs-ssl.googlehosted.com	United States	15169	GOOGLEUS	false
142.250.185.225	unknown	United States	15169	GOOGLEUS	false
104.21.84.155	banderolaver.pro	United States	13335	CLOUDFLARENETUS	false
216.239.36.21	sustainability.google	United States	15169	GOOGLEUS	false
142.250.186.70	ad.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.186.113	csp.withgoogle.com	United States	15169	GOOGLEUS	false
172.217.16.142	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.184.196	unknown	United States	15169	GOOGLEUS	false
142.250.185.68	unknown	United States	15169	GOOGLEUS	false
142.250.185.69	mail.google.com	United States	15169	GOOGLEUS	false
142.250.184.194	adservice.google.com	United States	15169	GOOGLEUS	false
13.107.253.67	s-part-0039.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.110	store.google.com	United States	15169	GOOGLEUS	false
172.217.18.6	unknown	United States	15169	GOOGLEUS	false
172.217.18.2	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.23.102	dart.l.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
172.217.16.193	unknown	United States	15169	GOOGLEUS	false
104.17.25.14	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.104	googletagmanager.com	United States	15169	GOOGLEUS	false
142.250.185.78	www3.l.google.com	United States	15169	GOOGLEUS	false
142.250.185.206	google.com	United States	15169	GOOGLEUS	false
142.250.184.209	unknown	United States	15169	GOOGLEUS	false
142.250.185.161	unknown	United States	15169	GOOGLEUS	false
142.250.186.98	td.doubleclick.net	United States	15169	GOOGLEUS	false
216.239.32.29	about.google	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.217.16.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.185.177	appspot.l.google.com	United States	15169	GOOGLEUS	false
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
104.77.220.172	unknown	United States	16625	AKAMAI-ASUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527856
Start date and time:	2024-10-07 10:16:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Fact-2024-10.pdf
Detection:	MAL
Classification:	mal60.phis.troj.winPDF@57/1337@106/37
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Browse: https://google.com/ Browse: https://sustainability.google/?utm_source=googlehpfooter&utm_medium=housepromos&utm_campaign=bottom-footer&utm_content= Browse: https://google.com/search/howsearchworks/?fg=1 Browse: https://mail.google.com/mail/&ogbl Browse: https://www.google.com/imghp?hl=en&ogbl Close Viewer Browse: https://www.google.com/services/?subid=ww-ww-et-g-awa-a-g_hpbfoot1_1!o2&utm_source=google.com&utm_medium=referral&utm_campaign=google_hpbfooter&fg=1 Browse: https://www.google.com/intl/en/about/products Browse: https://store.google.com/US?utm_source=hp_header&utm_medium=google_ooo&utm_campaign=GS100042&hl=en-US

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Fact-2024-10.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e0b5b6a6-9180-4925-bac0-3c116d936b06.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241007081713Z-170.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\0d9027f0-b53f-46cd-8204-7390327ddad5 (copy)

C:\Users\user\AppData\Local\Temp\MSI29924.LOG

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 04-17-11-067.log

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Windows Analysis Report
Fact-2024-10.pdf

Input	Output
URL: PDF document Model: jbxai	{ "brand":["Adobe Acrobat"], "contains_trigger_text":true, "trigger_text":"La conexin es lenta para previsualizar el PDF Descargar el documento y CLIC AQU para abrir", "prominent_button_name":"CLIC AQU", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"La conexin es lenta para previsualizar el PDF Descargar el documento y CLIC AQU para abrir", "has_visible_qrcode":false}

URL: https://banderolaver.pro/microsoft-verify.php?user_email=cristina.marinello@smeg.es Model: jbxai	{ "brand":["Microsoft"], "contains_trigger_text":true, "trigger_text":"Datos confidenciales!", "prominent_button_name":"Iniciar sesin", "text_input_field_labels":["Contrasea"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Microsoft", "has_visible_qrcode":false}

URL: https://www.google.com/ Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Sign in", "text_input_field_labels":["Google Search", "I'm Feeling Lucky"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Google SearchI'm Feeling LuckyOur third decade of climate action: join us", "has_visible_qrcode":false}

URL: https://www.google.com/ Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Sign in", "text_input_field_labels":["Google Search", "I'm Feeling Lucky"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Google Search I'm Feeling Lucky Our third decade of climate action: join us", "has_visible_qrcode":false}

URL: https://sustainability.google/?utm_source=googlehpfooter&utm_medium=housepromos&utm_campaign=bottom-footer&utm_content= Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"2024 Environmental Report", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"How to be more sustainable while commuting on a road trip", "has_visible_qrcode":false}

URL: https://www.google.com/search/howsearchworks/?fg=1 Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Learn more", "text_input_field_labels":["Generative AI in Search", "Check the facts with these Google features", "Your data in Search"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Explore the world of Google Search Discover the details of how Search works - from the technology we make to the approach we take.", "has_visible_qrcode":false}

URL: https://www.google.com/intl/en-US/gmail/about/ Model: jbxai	{ "brand":["Gmail"], "contains_trigger_text":true, "trigger_text":"Get more done with Gmail. Now integrated with Google Chat, Google Meet, and more, all in one place.", "prominent_button_name":"Create an account", "text_input_field_labels":["For work"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Secure, smart, and easy to use email", "has_visible_qrcode":false}

URL: https://www.google.com/imghp?hl=en&ogbl Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Sign in", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Google Images", "has_visible_qrcode":false}

URL: https://smallbusiness.withgoogle.com/?subid=us-en-et-g-awa-a-g_hpbfoot1_1!o2&utm_source=google&utm_medium=ep&utm_campaign=google_hpbfooter&utm_content=google_hpbfooter&gmbsrc=us-en_US-et-gs-z-gmb-s-z-u~sb-g4sb_srvcs-u#!/ Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Get the essentials", "text_input_field_labels":["Free", "Google Workspace", "Google Sites"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Succeed online with help from Google Together, we'll find the products, tools, and resources you need to move your business forward and help reach your goals. Make the most of the web with these tools", "has_visible_qrcode":false}

URL: https://about.google/products/ Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Shop Google Store", "text_input_field_labels":["Get product support", "Get disability support"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Helpful products. Built with you in mind.", "has_visible_qrcode":false}

URL: https://store.google.com/US/?utm_source=hp_header&utm_medium=google_ooo&utm_campaign=GS100042&hl=en-US Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Browse phones", "text_input_field_labels":["New"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Oh hi, Al. Meet the new Pixel 9 Pro XL, Pixel 9 Pro, Pixel 9, and Pixel 9 Pro Fold with Gemini. Popular on the Google Store.", "has_visible_qrcode":false}

URL: https://store.google.com/US/?utm_source=hp_header&utm_medium=google_ooo&utm_campaign=GS100042&hl=en-US Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Browse phones", "text_input_field_labels":["Sign in and sign up", "or enter email address"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Oh hi, Al. Meet the new Pixel 9 Pro XL, Pixel 9 Pro, Pixel 9, and Pixel 9 Pro Fold with Gemini. Popular on the Google Store.", "has_visible_qrcode":false}

URL: https://store.google.com/US/?utm_source=hp_header&utm_medium=google_ooo&utm_campaign=GS100042&hl=en-US Model: jbxai	{ "phishing_score":1, "brands":"Google", "legit_domain":"google.com", "classification":"wellknown", "reasons":["The brand 'Google' is a well-known brand with a strong online presence.", "The URL 'store.google.com' is a subdomain of 'google.com', which is the legitimate domain for Google.", "The presence of 'Sign in' and 'Sign up' fields is typical for a legitimate Google service page.", "There are no suspicious elements in the URL such as misspellings, extra characters, or unusual domain extensions."], "brand_matches":[false], "url_match":true, "brand_input":"Google", "input_fields":"Sign in and sign up"}

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.84.155	http://pixelmeldit.ru/RMQf	Get hash	malicious	HTMLPhisher	Browse
239.255.255.250	https://pub-40cb77b4a6d84294bfa2db6a96f70ff7.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse
	https://pub-21e2ca3bca8444aab694f2d286d3f97f.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse
	https://pub-2fd40031391d4470a8c3c1090493deca.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse
	https://pub-0b1b4754e32d4359b9a318e8133d30bc.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse
	https://pub-53d8c8824459455a8bb62d4b9a0d5f2f.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse
	https://gtm.you1.cn/app/381210	Get hash	malicious	Unknown	Browse
	https://pub-737d748721344356b3ba725600a8404d.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse
	http://patjimmy323.wixsite.com/my-site-1/	Get hash	malicious	HTMLPhisher	Browse
	4qZ59IMp8b.exe	Get hash	malicious	Credential Flusher	Browse
	http://org0720.wixsite.com/my-site/	Get hash	malicious	Unknown	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
13.107.253.67	172805100873dcf2097bda1ebce1dc29509a0d1c0ecef0168b8aa56fecb5a19c93ba543436853.dat-decoded.exe	Get hash	malicious	Unknown	Browse
	https://www.google.co.za/url?q=xtcjw2geVaKWnfmdoGJR&rct=plPBlHNa5kwdhss6Wkqp&sa=t&esrc=513lj8JvP7Ittpg5uakw&source=&cd=HEdeaS5QG8iPRKWBvNC5&cad=v3vi70ntSK6fhpPYoZj8&ved=blJ54Mupbf2HcJbicYcQ&uact=&url=amp/s%2Furl.za.m.mimecastprotect.com/s/BjZHCy856GFEJl8cZf1CxlF3B	Get hash	malicious	Unknown	Browse
	http://pub-3424228f58ac440c9523afb01100ed68.r2.dev/gold.html	Get hash	malicious	HTMLPhisher	Browse
	http://www.bing.com/search?q=%3Cscript%3Ealert+1+%3C/script%3E&form=WMSRPA&ao=1&qs=UT&cvid=200cb80e1a3a4f86a7cea0b49e1f972a&pq=%3C&cc=ES&setlang=es-ES&wsso=Moderate&qfig=8721b1b5480542f594a6cfbbb1ea53e6&darkschemeovr=1	Get hash	malicious	Unknown	Browse
	http://www.laborfinders.com	Get hash	malicious	Unknown	Browse
	https://jenskullenius-my.sharepoint.com/:f:/g/personal/ulf_kullenius_gaiabiomaterials_com/EmQl89SiCOBCpbtr01o20eIB9z4rZpQ3dKKrBHn2QJKTxw?e=afHuwm	Get hash	malicious	Unknown	Browse
	http://url2253.supportasecurity.com/ls/click?upn=u001.8PZYqznGDJ9-2FKUHHWNUI3Edxs36Tp2dyG-2Ba7x1-2FPzVdu3bKXNWn2LvlF5iXWtGEfIsJd795-2F6B3b8l-2FhC2f2zw-3D-3D2w7E_lb-2Bnb9KO-2BNO6xtys7-2FSgJ37Cm7-2FqCsJQuSPzRnbo9rKVbI2R8gs14rAUveIpHhIOrHXcf6q6pmPYVBrx-2F-2FgmjhscUNPFCso8gA9rpmEpgMPU1tcukTovCaYGJYvgHvVJZb2xcZFijRQrxXUqMf-2FDb1lgQXZ51YtzZvTAweZNDb5-2BmntOyGie5zyANnlrWIS-2B-2BsgFV4hER50aWpOErGN-2FpJwQITPvdi69D7CK7usgeKJrAUWK0NG8q4Skck2mCy-2F8CjQ5dmXggB2H7tLJidvPvM9khambrWj8FuwMJCzrK4LNStfQWZUtBYMpMG-2F47lnH0S-2FlyoKmWTn5XlHDdgZK6jAFBZXQVQD9cVti9OL-2BGKGmoU9N9PVXbsielqDx6aAOl8reEdBu-2FhZJovH6Cya7sU67oLz9WOmApinrNrgKyLj9-2FnZke-2FrNXntDN-2BmI9gYOp60vp-2BmyMr1b7X-2Bv-2FDGM6pqmBn9a9cF2wTYfTwH1F2O3hMuhPkvWp9ywQI3RWINRAUEkR395xhdWa3Xy4F0DYcfVrqhhW020n6qgsU6x3XOiTP5FWmNCSSr56o2HqOAE6MqQw8fCBbvm3FUVLvCfZ-2FLn4udwAmpHiaqLRuwXpVdB2abW3LmmCPMufkS0qGEGCEDPfGoZHZTkUmpRbDgXHgfWe7exJBnf-2F5hdOTYiw0mN7YOdfSuhE7vEmDV5XXoZMguGuhnIUi1S5IFDf-2BI6-2BU4PVdd42vN-2BNAzkqjdRwjd1G7lG0QQwrLQSoII9g7PyjntBfNVT9z1w1QZMIcgxRPG-2Fd0G6qwnQ6d2XTx-2BxeQOXeERokCIMuNhXscGUUDnFO-2BODGABIjUJmx99N4zNVrq6NLtNHrav1IahnhJfxQ-2BY-3D&c=E,1,E0lAJItgIyUxbXGpxJtGCBhqXoYkpM6eN57cP_YKhu3ZsbCoe3Y2FTZgOx4X7oPpj_5FBx6MpnelyXgRzl52pHKItnj6fhEACRn26PWJEhywZbLRUfbk&typo=1	Get hash	malicious	HTMLPhisher	Browse
	FirstfedwebInv27-1486.html	Get hash	malicious	BlackHacker JS Obfuscator	Browse
	Caller left VM MSG 000130 DURATION- 5a745523ed1e971a2d7f1ced4aecad012918bdba.msg	Get hash	malicious	HTMLPhisher	Browse
	https://sesh-gangrene.shop/	Get hash	malicious	HTMLPhisher	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0039.t-0009.fb-t-msedge.net	https://claim-give-away2024.oklick.xyz/	Get hash	malicious	Unknown	Browse	13.107.253.67
	https://mfacebookk.click/G1La1iS4R2BxZPGht8aruwFinR13RcrESOGuNi6nwETvnRM8NpUZu53I1U011Q0HUyXQimVwnl.html	Get hash	malicious	Unknown	Browse	13.107.253.67
	172805100873dcf2097bda1ebce1dc29509a0d1c0ecef0168b8aa56fecb5a19c93ba543436853.dat-decoded.exe	Get hash	malicious	Unknown	Browse	13.107.253.67
	https://www.google.co.za/url?q=xtcjw2geVaKWnfmdoGJR&rct=plPBlHNa5kwdhss6Wkqp&sa=t&esrc=513lj8JvP7Ittpg5uakw&source=&cd=HEdeaS5QG8iPRKWBvNC5&cad=v3vi70ntSK6fhpPYoZj8&ved=blJ54Mupbf2HcJbicYcQ&uact=&url=amp/s%2Furl.za.m.mimecastprotect.com/s/BjZHCy856GFEJl8cZf1CxlF3B	Get hash	malicious	Unknown	Browse	13.107.253.67
	http://pub-3424228f58ac440c9523afb01100ed68.r2.dev/gold.html	Get hash	malicious	HTMLPhisher	Browse	13.107.253.67
	http://www.bing.com/search?q=%3Cscript%3Ealert+1+%3C/script%3E&form=WMSRPA&ao=1&qs=UT&cvid=200cb80e1a3a4f86a7cea0b49e1f972a&pq=%3C&cc=ES&setlang=es-ES&wsso=Moderate&qfig=8721b1b5480542f594a6cfbbb1ea53e6&darkschemeovr=1	Get hash	malicious	Unknown	Browse	13.107.253.67
	http://www.laborfinders.com	Get hash	malicious	Unknown	Browse	13.107.253.67
	https://jenskullenius-my.sharepoint.com/:f:/g/personal/ulf_kullenius_gaiabiomaterials_com/EmQl89SiCOBCpbtr01o20eIB9z4rZpQ3dKKrBHn2QJKTxw?e=afHuwm	Get hash	malicious	Unknown	Browse	13.107.253.67
	https://www.phoenixartstudio.net/?keyvalue=93749&page=https%3A%2F%2Fshdeiw.com%2Fsewirsd	Get hash	malicious	Unknown	Browse	13.107.253.67
	http://url2253.supportasecurity.com/ls/click?upn=u001.8PZYqznGDJ9-2FKUHHWNUI3Edxs36Tp2dyG-2Ba7x1-2FPzVdu3bKXNWn2LvlF5iXWtGEfIsJd795-2F6B3b8l-2FhC2f2zw-3D-3D2w7E_lb-2Bnb9KO-2BNO6xtys7-2FSgJ37Cm7-2FqCsJQuSPzRnbo9rKVbI2R8gs14rAUveIpHhIOrHXcf6q6pmPYVBrx-2F-2FgmjhscUNPFCso8gA9rpmEpgMPU1tcukTovCaYGJYvgHvVJZb2xcZFijRQrxXUqMf-2FDb1lgQXZ51YtzZvTAweZNDb5-2BmntOyGie5zyANnlrWIS-2B-2BsgFV4hER50aWpOErGN-2FpJwQITPvdi69D7CK7usgeKJrAUWK0NG8q4Skck2mCy-2F8CjQ5dmXggB2H7tLJidvPvM9khambrWj8FuwMJCzrK4LNStfQWZUtBYMpMG-2F47lnH0S-2FlyoKmWTn5XlHDdgZK6jAFBZXQVQD9cVti9OL-2BGKGmoU9N9PVXbsielqDx6aAOl8reEdBu-2FhZJovH6Cya7sU67oLz9WOmApinrNrgKyLj9-2FnZke-2FrNXntDN-2BmI9gYOp60vp-2BmyMr1b7X-2Bv-2FDGM6pqmBn9a9cF2wTYfTwH1F2O3hMuhPkvWp9ywQI3RWINRAUEkR395xhdWa3Xy4F0DYcfVrqhhW020n6qgsU6x3XOiTP5FWmNCSSr56o2HqOAE6MqQw8fCBbvm3FUVLvCfZ-2FLn4udwAmpHiaqLRuwXpVdB2abW3LmmCPMufkS0qGEGCEDPfGoZHZTkUmpRbDgXHgfWe7exJBnf-2F5hdOTYiw0mN7YOdfSuhE7vEmDV5XXoZMguGuhnIUi1S5IFDf-2BI6-2BU4PVdd42vN-2BNAzkqjdRwjd1G7lG0QQwrLQSoII9g7PyjntBfNVT9z1w1QZMIcgxRPG-2Fd0G6qwnQ6d2XTx-2BxeQOXeERokCIMuNhXscGUUDnFO-2BODGABIjUJmx99N4zNVrq6NLtNHrav1IahnhJfxQ-2BY-3D&c=E,1,E0lAJItgIyUxbXGpxJtGCBhqXoYkpM6eN57cP_YKhu3ZsbCoe3Y2FTZgOx4X7oPpj_5FBx6MpnelyXgRzl52pHKItnj6fhEACRn26PWJEhywZbLRUfbk&typo=1	Get hash	malicious	HTMLPhisher	Browse	13.107.253.67
s-part-0017.t-0009.t-msedge.net	https://pub-737d748721344356b3ba725600a8404d.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://uppholldbcloginn.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://pub-ba5a046c69974217b0431bca4ba43740.r2.dev/rep.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://pub-04836febb1fc46fca4a8c225ef7d2a38.r2.dev/tantindex.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://pub-17d7828daac64fc3a83940a40d8b01d8.r2.dev/qwertyuiopBowa.html	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	13.107.246.45
	http://webmailserv3038z.wixsite.com/my-site/	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://pub-3e7a5cfb45bf4e96837e2976d2a1ca5a.r2.dev/be141.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://orange234.wixsite.com/my-site/	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://pub-722720be67154192a1102b2cf085d306.r2.dev/askm.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://sites.google.com/coinswallett.com/walletconnectt/home/	Get hash	malicious	Unknown	Browse	13.107.246.45
sni1gl.wpc.omegacdn.net	https://ad2856b9b0e7b744c59c43afe9662cee9ce9abdecb1bb7ab61ba226eb7.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://rolledalloys12-dot-wind-blade-416540.uk.r.appspot.com/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	http://foth.federal-docs.com/uAfwC	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	Payment receipt 50%Invoicelp612117_CQDM.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://smallpdf.com/sign-pdf/document#data=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2VzaWduLnNtYWxscGRmLXN0YWdpbmcuY29tIiwic3ViIjoiN2NmYmYzYzYtZGJhZS00MDU2LWFmNjEtZTE1OTY4NGUxZTc4IiwiYXVkIjpbImVzaWduIl0sImV4cCI6MTcyOTI1NTE2OCwibmJmIjoxNzI4MDQ1NTY4LCJpYXQiOjE3MjgwNDU1NjgsImp0aSI6IjdjZmJmM2M2LWRiYWUtNDA1Ni1hZjYxLWUxNTk2ODRlMWU3OCIsInBheWxvYWQiOnsiZW52ZWxvcGVfaWQiOiIyNDYxNDE2ZC1iYWJmLTQzMDktOTRhYy1hZWJkYzRjMmZmY2MiLCJzaWduX3JlcXVlc3RfaWQiOiI3Y2ZiZjNjNi1kYmFlLTQwNTYtYWY2MS1lMTU5Njg0ZTFlNzgiLCJ0b2tlbl90eXBlIjoibm90aWZpY2F0aW9uIiwidXNlcl9lbWFpbCI6ImZyYW5jZXMud29vZEB1a3JpLm9yZyIsInVzZXJfZmlyc3RuYW1lIjoiZnJhbmNlcy53b29kQHVrcmkub3JnIiwidXNlcl9sYXN0bmFtZSI6ImZyYW5jZXMud29vZEB1a3JpLm9yZyJ9fQ.OqxYiO2DP6wYmX2t6u3X4Qa-FIZ5J__ELTV29qKimLo&eid=2461416d-babf-4309-94ac-aebdc4c2ffcc&esrt=7cfbf3c6-dbae-4056-af61-e159684e1e78	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	Payout Receipt.pptx	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://www.thefirsthbcu.com/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://forms.office.com/Pages/ResponsePage.aspx?id=4mPIUn7HtEOifSf_jkD9akHPEdQOqpJDoTs5yuUf8txUMEFQTE42TU03SUJBSU84VTY3MEtFR1JaUS4u	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://wvr4dgzxxavl6jjpq7rl.igortsaplin.pro/WFzFCiNx	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	voicemaiVOIP_1002202474911222280000000082autoresponse.htm	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
cdnjs.cloudflare.com	https://pub-40cb77b4a6d84294bfa2db6a96f70ff7.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://pub-21e2ca3bca8444aab694f2d286d3f97f.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://pub-2fd40031391d4470a8c3c1090493deca.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://pub-0b1b4754e32d4359b9a318e8133d30bc.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://pub-53d8c8824459455a8bb62d4b9a0d5f2f.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://pub-737d748721344356b3ba725600a8404d.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://ikergalindez.github.io/gofish/	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Farahexperiences.com_Report_87018.pdf	Get hash	malicious	Unknown	Browse	104.17.24.14
	http://pub-51f896deb233450089fc1a520e6ed957.r2.dev/kanehods.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://pub-04836febb1fc46fca4a8c225ef7d2a38.r2.dev/tantindex.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://pub-21e2ca3bca8444aab694f2d286d3f97f.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	173.222.162.60
	https://pub-0b1b4754e32d4359b9a318e8133d30bc.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	173.222.162.60
	http://org0720.wixsite.com/my-site/	Get hash	malicious	Unknown	Browse	173.222.162.60
	http://ikergalindez.github.io/gofish/	Get hash	malicious	HTMLPhisher	Browse	173.222.162.60
	http://pub-17d7828daac64fc3a83940a40d8b01d8.r2.dev/qwertyuiopBowa.html	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	173.222.162.60
	http://webmailserv3038z.wixsite.com/my-site/	Get hash	malicious	Unknown	Browse	173.222.162.60
	http://tcaconnect.ac-page.com/toronto-construction-association-inc/	Get hash	malicious	Unknown	Browse	173.222.162.60
	http://maine619.github.io/office/	Get hash	malicious	HTMLPhisher	Browse	173.222.162.60
	http://pub-3e7a5cfb45bf4e96837e2976d2a1ca5a.r2.dev/be141.html	Get hash	malicious	HTMLPhisher	Browse	173.222.162.60
	http://pub-f3922f20d4c74ba1869fd3db906e3295.r2.dev/gsecondcheck.html	Get hash	malicious	HTMLPhisher	Browse	173.222.162.60
28a2c9bd18a11de089ef85a160da29e4	https://pub-40cb77b4a6d84294bfa2db6a96f70ff7.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 184.28.90.27 13.107.246.44
	https://pub-21e2ca3bca8444aab694f2d286d3f97f.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 184.28.90.27 13.107.246.44
	https://pub-2fd40031391d4470a8c3c1090493deca.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 184.28.90.27 13.107.246.44
	https://pub-0b1b4754e32d4359b9a318e8133d30bc.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 184.28.90.27 13.107.246.44
	https://pub-53d8c8824459455a8bb62d4b9a0d5f2f.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 184.28.90.27 13.107.246.44
	https://gtm.you1.cn/app/381210	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.44
	https://pub-737d748721344356b3ba725600a8404d.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 184.28.90.27 13.107.246.44
	http://patjimmy323.wixsite.com/my-site-1/	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 184.28.90.27 13.107.246.44
	4qZ59IMp8b.exe	Get hash	malicious	Credential Flusher	Browse	4.245.163.56 184.28.90.27 13.107.246.44
	http://org0720.wixsite.com/my-site/	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.44

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.186969707955441
Encrypted:	false
SSDEEP:	6:c+3cM+q2Pv2nKuAl9OmbnIFUt8lYUCJZmw+lYUCcMVkwOv2nKuAl9OmbjLJ:XMM+v2HAahFUt87c/+7XMV5bHAaSJ
MD5:	EF37456B9CC4AE0E1165D83CC9C5AC49
SHA1:	1B6A36E629263BF876E4B5C222FA688CEC2D172D
SHA-256:	582DA2613E37F5A47DAB26CCDF30C31C91811C39D2E05091B230E155408F3D1E
SHA-512:	6C19D35BC3F196F2FE0D419C8F26D265E3DE2FAA2B0343E3F248DADA6DE1873913AA9CC7CC913A660E3D8288128C2EB9576CAEB18438D14BA35EAA75AEA615BC
Malicious:	false
Reputation:	low
Preview:	2024/10/07-04:17:08.784 18fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/07-04:17:08.786 18fc Recovering log #3.2024/10/07-04:17:08.786 18fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	10651
Entropy (8bit):	7.961321901660215
Encrypted:	false
SSDEEP:	192:cKJybYYxDcxwgJvE13KppZ++idd9Y7EbzjdyBmhh9PVg6QKgLX1:2TxDcXJvlppizpyBgvPF1gLl
MD5:	04405CB5BEF43037606087703C4A4DC0
SHA1:	5E3FDA97A72802F51CD726542CBBCF5D840242B2
SHA-256:	00343494C05D69E1E0D85A889C016DE56447E263260DAED0474F66D6FB09AB3E
SHA-512:	4ACC2B10EEF92A0AF8445885806E6AE4BA3EC7F36A137E6675720D04FC45CFBA5E79DBDECB476261C2C4268F5B83C903EF3CB7DFCB26E93B777AAF326C7DA54D
Malicious:	false
Preview:	Cr24....E.........0.."0....H.............0.........:.2.W.))...I...5_U(I7nz...2[.;..H...S.../...nb%Yx.6.]i.....u...PDF.i.LJK.?....l.....R...\|...j...C..j!.%'..s....[."...Gy...=l)..=.l\....4..Q!$e.=...C.1.%d..B...K.[.l,.....7......y...$7J..G&TT..W.-=jgs[...&.@/.j$....+...yk\|l^..Km)\Y..x..}OCXf.....A5s.7..8..o....L..(p[...^e......?&X..:~,.)..C..n...Hh.....<..N..0.....woa6....'&y....tH..7@..a.t.....F..YQU......<......m!..^.#f.'F".....lt..97U3f...WM....]Lw...)..x...)..Hy Z...l.a.)J~'.y.o.NS.#.,6.D.9UMW..l>.pa.WG.^..L,..B...."p.Y.....<............u....].Q..=..c...{i..'!\.D....H=..1N.I...F.!.,........j\....8..C......V_]-.G.Q.SA..f....E.4t...~...u..F.vY.9..j..}Ib......W.v!b.C.+...d..O............Q......x}VA.$.8......<..t.m.7.V'.%I..r.A....[.L...m....G@$.%.o.t.^...._.i.+.3.\|(.... .LHz$l..Q..su.t..}.W..gC.j.q.u..7..?.)].f.3...}....&......==r.....4.....RY.pt5...8i$...<...I.....;.U_....Z.:J...-.<B. .z.\|.7!....Ito..;....t...>.5...ek..I3@~.%M

File type:	PDF document, version 1.7
Entropy (8bit):	7.9725629381882746
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Fact-2024-10.pdf
File size:	137'550 bytes
MD5:	be0f0c241442901014ee5b364e911b7e
SHA1:	e41a6b08f9af0e18afc3acaa51fca1b83109f9ab
SHA256:	5c05d426782d494decfcb5ca6cda4765090a03d05a3ab2d70c66826c21740cff
SHA512:	2f5f2905106d2de8351ef33822fbd18ee8f87b5fcce78e38a6feb34a154ba2dd57bf8578aa2c4d36de43b5b751f9696caeaa9431183fd05b391dfb9cadacaf0e
SSDEEP:	3072:yW2JJc6ra7wl4w0dLprdAzpRnjeGOqdnaW+B7:yJJi6ryUzpRnyyat7
TLSH:	28D312645F8AB538CC80742168C50A238A56D482AA5C19FF7C8DDBC77F1EDBAB91487C
File Content Preview:	%PDF-1.7.%.....2 0 obj.<<./AcroForm 4 0 R./Metadata 5 0 R./Pages 6 0 R./Type /Catalog.>>.endobj.5 0 obj.<<./Length 3266./Subtype /XML./Type /Metadata.>>.stream.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp

General
Header:	%PDF-1.7
Total Entropy:	7.972563
Total Bytes:	137550
Stream Entropy:	7.975670
Stream Bytes:	135792
Entropy outside Streams:	5.055216
Bytes outside Streams:	1758
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	18
endobj	18
stream	17
endstream	17
xref	0
trailer	0
startxref	1
/Page	0
/Encrypt	0
/ObjStm	1
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	1
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 10:17:22.406615019 CEST	192.168.2.12	1.1.1.1	0xfdf4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:35.305860996 CEST	192.168.2.12	1.1.1.1	0x7e7f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:35.931610107 CEST	192.168.2.12	1.1.1.1	0x572c	Standard query (0)	banderolaver.pro	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:35.931977987 CEST	192.168.2.12	1.1.1.1	0xec80	Standard query (0)	banderolaver.pro	65	IN (0x0001)	false
Oct 7, 2024 10:17:37.923379898 CEST	192.168.2.12	1.1.1.1	0x8c70	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:37.923523903 CEST	192.168.2.12	1.1.1.1	0xdb9	Standard query (0)	google.com	65	IN (0x0001)	false
Oct 7, 2024 10:17:37.924593925 CEST	192.168.2.12	1.1.1.1	0xfc82	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:37.924711943 CEST	192.168.2.12	1.1.1.1	0x102b	Standard query (0)	ajax.aspnetcdn.com	65	IN (0x0001)	false
Oct 7, 2024 10:17:37.925122023 CEST	192.168.2.12	1.1.1.1	0xed47	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:37.925504923 CEST	192.168.2.12	1.1.1.1	0x4735	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Oct 7, 2024 10:17:37.929198980 CEST	192.168.2.12	1.1.1.1	0xe293	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:37.929368973 CEST	192.168.2.12	1.1.1.1	0xaeed	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Oct 7, 2024 10:17:38.524550915 CEST	192.168.2.12	1.1.1.1	0x86eb	Standard query (0)	banderolaver.pro	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:38.524765968 CEST	192.168.2.12	1.1.1.1	0xa00f	Standard query (0)	banderolaver.pro	65	IN (0x0001)	false
Oct 7, 2024 10:17:38.620433092 CEST	192.168.2.12	1.1.1.1	0xf57b	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:38.620635986 CEST	192.168.2.12	1.1.1.1	0x32f9	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Oct 7, 2024 10:17:38.891663074 CEST	192.168.2.12	1.1.1.1	0x99df	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:38.891911983 CEST	192.168.2.12	1.1.1.1	0xcdf9	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:17:39.165534973 CEST	192.168.2.12	1.1.1.1	0x75fe	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:39.165699959 CEST	192.168.2.12	1.1.1.1	0x5733	Standard query (0)	ajax.aspnetcdn.com	65	IN (0x0001)	false
Oct 7, 2024 10:17:40.672458887 CEST	192.168.2.12	1.1.1.1	0xde2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:40.672460079 CEST	192.168.2.12	1.1.1.1	0x1adf	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:17:46.349807978 CEST	192.168.2.12	1.1.1.1	0x97e6	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:46.349807978 CEST	192.168.2.12	1.1.1.1	0x228e	Standard query (0)	google.com	65	IN (0x0001)	false
Oct 7, 2024 10:17:49.254072905 CEST	192.168.2.12	1.1.1.1	0x4f5d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:49.255028963 CEST	192.168.2.12	1.1.1.1	0xa134	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:17:50.173954010 CEST	192.168.2.12	1.1.1.1	0x738f	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:50.174256086 CEST	192.168.2.12	1.1.1.1	0xb25d	Standard query (0)	ogs.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:17:50.182344913 CEST	192.168.2.12	1.1.1.1	0x9541	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:50.182672024 CEST	192.168.2.12	1.1.1.1	0xabfb	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:17:51.163680077 CEST	192.168.2.12	1.1.1.1	0x4991	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:51.163835049 CEST	192.168.2.12	1.1.1.1	0x9bd6	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:17:52.637906075 CEST	192.168.2.12	1.1.1.1	0x3364	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:52.638096094 CEST	192.168.2.12	1.1.1.1	0xe016	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:17:52.744479895 CEST	192.168.2.12	1.1.1.1	0xef15	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:17:52.744821072 CEST	192.168.2.12	1.1.1.1	0x5ac1	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:17:53.228298903 CEST	192.168.2.12	1.1.1.1	0xdcc5	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:18:06.317123890 CEST	192.168.2.12	1.1.1.1	0x7482	Standard query (0)	sustainability.google	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:18:06.317323923 CEST	192.168.2.12	1.1.1.1	0x24a6	Standard query (0)	sustainability.google	65	IN (0x0001)	false
Oct 7, 2024 10:18:09.881302118 CEST	192.168.2.12	1.1.1.1	0x6cc	Standard query (0)	sustainability.google	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:18:09.881453037 CEST	192.168.2.12	1.1.1.1	0x4bae	Standard query (0)	sustainability.google	65	IN (0x0001)	false
Oct 7, 2024 10:18:10.139136076 CEST	192.168.2.12	1.1.1.1	0x4a56	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:18:12.378113985 CEST	192.168.2.12	1.1.1.1	0xe050	Standard query (0)	www.blog.google	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:18:12.378253937 CEST	192.168.2.12	1.1.1.1	0x3ad3	Standard query (0)	www.blog.google	65	IN (0x0001)	false
Oct 7, 2024 10:18:13.546272039 CEST	192.168.2.12	1.1.1.1	0xe8f9	Standard query (0)	blog.google	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:18:13.546488047 CEST	192.168.2.12	1.1.1.1	0xf90f	Standard query (0)	blog.google	65	IN (0x0001)	false
Oct 7, 2024 10:18:14.894588947 CEST	192.168.2.12	1.1.1.1	0xec08	Standard query (0)	blog.google	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:18:14.895004988 CEST	192.168.2.12	1.1.1.1	0x8fed	Standard query (0)	blog.google	65	IN (0x0001)	false
Oct 7, 2024 10:18:21.577419043 CEST	192.168.2.12	1.1.1.1	0x67e3	Standard query (0)	googletagmanager.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:18:21.577573061 CEST	192.168.2.12	1.1.1.1	0x5a7c	Standard query (0)	googletagmanager.com	65	IN (0x0001)	false
Oct 7, 2024 10:18:21.735295057 CEST	192.168.2.12	1.1.1.1	0x9ef7	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:18:21.735474110 CEST	192.168.2.12	1.1.1.1	0x11f5	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Oct 7, 2024 10:18:22.940131903 CEST	192.168.2.12	1.1.1.1	0x9488	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:18:22.940280914 CEST	192.168.2.12	1.1.1.1	0x1d9a	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Oct 7, 2024 10:18:29.045200109 CEST	192.168.2.12	1.1.1.1	0x524d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:18:29.370791912 CEST	192.168.2.12	1.1.1.1	0xe589	Standard query (0)	csp.withgoogle.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:18:29.370994091 CEST	192.168.2.12	1.1.1.1	0x38a4	Standard query (0)	csp.withgoogle.com	65	IN (0x0001)	false
Oct 7, 2024 10:18:32.317106009 CEST	192.168.2.12	1.1.1.1	0xcb48	Standard query (0)	mail.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:18:32.317342043 CEST	192.168.2.12	1.1.1.1	0x8d8	Standard query (0)	mail.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:18:48.874435902 CEST	192.168.2.12	1.1.1.1	0x192d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:03.285917997 CEST	192.168.2.12	1.1.1.1	0xd0b4	Standard query (0)	smallbusiness.withgoogle.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:03.286314011 CEST	192.168.2.12	1.1.1.1	0x136e	Standard query (0)	smallbusiness.withgoogle.com	65	IN (0x0001)	false
Oct 7, 2024 10:19:04.400335073 CEST	192.168.2.12	1.1.1.1	0x1f3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:04.400335073 CEST	192.168.2.12	1.1.1.1	0x5d36	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:19:04.408847094 CEST	192.168.2.12	1.1.1.1	0x5292	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:04.408847094 CEST	192.168.2.12	1.1.1.1	0xf6b8	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Oct 7, 2024 10:19:05.468457937 CEST	192.168.2.12	1.1.1.1	0x8297	Standard query (0)	smallbusiness.withgoogle.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:05.468657970 CEST	192.168.2.12	1.1.1.1	0x43ca	Standard query (0)	smallbusiness.withgoogle.com	65	IN (0x0001)	false
Oct 7, 2024 10:19:10.221913099 CEST	192.168.2.12	1.1.1.1	0x3232	Standard query (0)	survey.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:10.222048998 CEST	192.168.2.12	1.1.1.1	0x6122	Standard query (0)	survey.g.doubleclick.net	65	IN (0x0001)	false
Oct 7, 2024 10:19:11.629698038 CEST	192.168.2.12	1.1.1.1	0xa909	Standard query (0)	about.google	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:11.629889965 CEST	192.168.2.12	1.1.1.1	0x9fe3	Standard query (0)	about.google	65	IN (0x0001)	false
Oct 7, 2024 10:19:14.904586077 CEST	192.168.2.12	1.1.1.1	0xbaad	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:14.904732943 CEST	192.168.2.12	1.1.1.1	0xb92e	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Oct 7, 2024 10:19:15.085689068 CEST	192.168.2.12	1.1.1.1	0x51b5	Standard query (0)	about.google	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:15.085854053 CEST	192.168.2.12	1.1.1.1	0x4532	Standard query (0)	about.google	65	IN (0x0001)	false
Oct 7, 2024 10:19:23.168395042 CEST	192.168.2.12	1.1.1.1	0xf438	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:23.168838978 CEST	192.168.2.12	1.1.1.1	0x9a06	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Oct 7, 2024 10:19:42.319583893 CEST	192.168.2.12	1.1.1.1	0x21f3	Standard query (0)	store.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:42.319796085 CEST	192.168.2.12	1.1.1.1	0x9975	Standard query (0)	store.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:19:43.846777916 CEST	192.168.2.12	1.1.1.1	0x5b45	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:43.846924067 CEST	192.168.2.12	1.1.1.1	0xd76d	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Oct 7, 2024 10:19:47.222059011 CEST	192.168.2.12	1.1.1.1	0x9ffb	Standard query (0)	store.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:47.222202063 CEST	192.168.2.12	1.1.1.1	0x929	Standard query (0)	store.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:19:49.477338076 CEST	192.168.2.12	1.1.1.1	0xc73b	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:49.477900028 CEST	192.168.2.12	1.1.1.1	0x9ed	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:19:50.446454048 CEST	192.168.2.12	1.1.1.1	0xf3e3	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:50.446619987 CEST	192.168.2.12	1.1.1.1	0x7e54	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:19:51.362837076 CEST	192.168.2.12	1.1.1.1	0x9f43	Standard query (0)	2542116.fls.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:51.363240957 CEST	192.168.2.12	1.1.1.1	0xbfdb	Standard query (0)	2542116.fls.doubleclick.net	65	IN (0x0001)	false
Oct 7, 2024 10:19:51.372551918 CEST	192.168.2.12	1.1.1.1	0x144e	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:51.373498917 CEST	192.168.2.12	1.1.1.1	0x2607	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Oct 7, 2024 10:19:51.374056101 CEST	192.168.2.12	1.1.1.1	0xff24	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:51.374396086 CEST	192.168.2.12	1.1.1.1	0x4c8b	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Oct 7, 2024 10:19:51.483313084 CEST	192.168.2.12	1.1.1.1	0x4679	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:51.483479023 CEST	192.168.2.12	1.1.1.1	0xe664	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Oct 7, 2024 10:19:52.269510031 CEST	192.168.2.12	1.1.1.1	0xa054	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:52.269696951 CEST	192.168.2.12	1.1.1.1	0xcef6	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Oct 7, 2024 10:19:53.006856918 CEST	192.168.2.12	1.1.1.1	0x1d8a	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:53.007126093 CEST	192.168.2.12	1.1.1.1	0x4ae2	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Oct 7, 2024 10:19:53.147599936 CEST	192.168.2.12	1.1.1.1	0xb046	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:53.147857904 CEST	192.168.2.12	1.1.1.1	0xf0d9	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:19:54.130631924 CEST	192.168.2.12	1.1.1.1	0x6bf1	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:19:54.130949020 CEST	192.168.2.12	1.1.1.1	0xfe8c	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Oct 7, 2024 10:20:21.036252975 CEST	192.168.2.12	1.1.1.1	0xf22f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 10:20:21.036402941 CEST	192.168.2.12	1.1.1.1	0xe4c1	Standard query (0)	www.google.com	65	IN (0x0001)	false