Edit tour

Windows Analysis Report
http://www.nbnewstar.com.cn

Overview

General Information

Sample URL:	http://www.nbnewstar.com.cn
Analysis ID:	1410648
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1072 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2692 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2156,i,3691347965485979252,9914316177754317718,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6428 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.nbnewstar.com.cn MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

String found in binary or memory: (function(f){f.extend(f.rsProto,{_z6:function(){var a=this;a._a7={autoHideArrows:!0,autoHideControlNav:!1,autoHideBlocks:!1,autoHideCaption:!1,disableCSS3inFF:!0,youTubeCode:'<iframe src="https://www.youtube.com/embed/%id%?rel=1&showinfo=0&autoplay=1&wmode=transparent" frameborder="no"></iframe>',vimeoCode:'<iframe src="https://player.vimeo.com/video/%id%?byline=0&portrait=0&autoplay=1" frameborder="no" webkitAllowFullScreen mozallowfullscreen allowFullScreen></iframe>'};a.st.video=f.extend({},a._a7, equals www.youtube.com (Youtube)

Source: https://www.nbnewstar.com.cn/About-us.html	HTTP Parser: Title: About us - SEO does not match URL
Source: https://www.nbnewstar.com.cn/products.html	HTTP Parser: Title: Products - SEO does not match URL
Source: https://www.nbnewstar.com.cn/Inquiry/	HTTP Parser: Title: ,Online Inquiry does not match URL
Source: https://www.nbnewstar.com.cn/Contact-us.html	HTTP Parser: Title: Contact us - SEO does not match URL
Source: https://www.nbnewstar.com.cn/product/product-46-926.html	HTTP Parser: Title: Wooden Desk does not match URL
Source: https://www.nbnewstar.com.cn/product/product-53-253.html	HTTP Parser: Title: Wood ladder does not match URL
Source: https://www.nbnewstar.com.cn/product/product-38-672.html	HTTP Parser: Title: Wooden grating lifting basket does not match URL
Source: https://www.nbnewstar.com.cn/product/product-40-20.html	HTTP Parser: Title: Metal tray table does not match URL
Source: https://www.nbnewstar.com.cn/product/product-72-982.html	HTTP Parser: Title: Wood/metal side table does not match URL
Source: https://www.nbnewstar.com.cn/product/product-41-507.html	HTTP Parser: Title: Marble table does not match URL
Source: https://www.nbnewstar.com.cn/product/product-17-662.html	HTTP Parser: Title: Clock table does not match URL

Source: https://www.nbnewstar.com.cn/	HTTP Parser: No favicon
Source: https://www.nbnewstar.com.cn/	HTTP Parser: No favicon
Source: https://www.nbnewstar.com.cn/About-us.html	HTTP Parser: No favicon
Source: https://www.nbnewstar.com.cn/products.html	HTTP Parser: No favicon
Source: https://www.nbnewstar.com.cn/Inquiry/	HTTP Parser: No favicon
Source: https://www.nbnewstar.com.cn/Contact-us.html	HTTP Parser: No favicon
Source: https://www.nbnewstar.com.cn/product/product-46-926.html	HTTP Parser: No favicon
Source: https://www.nbnewstar.com.cn/product/product-53-253.html	HTTP Parser: No favicon
Source: https://www.nbnewstar.com.cn/product/product-38-672.html	HTTP Parser: No favicon
Source: https://www.nbnewstar.com.cn/product/product-40-20.html	HTTP Parser: No favicon
Source: https://www.nbnewstar.com.cn/product/product-72-982.html	HTTP Parser: No favicon
Source: https://www.nbnewstar.com.cn/product/product-41-507.html	HTTP Parser: No favicon
Source: https://www.nbnewstar.com.cn/product/product-17-662.html	HTTP Parser: No favicon

Source: https://www.nbnewstar.com.cn/	HTTP Parser: No <meta name="author".. found
Source: https://www.nbnewstar.com.cn/	HTTP Parser: No <meta name="author".. found
Source: https://www.nbnewstar.com.cn/About-us.html	HTTP Parser: No <meta name="author".. found
Source: https://www.nbnewstar.com.cn/products.html	HTTP Parser: No <meta name="author".. found
Source: https://www.nbnewstar.com.cn/Inquiry/	HTTP Parser: No <meta name="author".. found
Source: https://www.nbnewstar.com.cn/Contact-us.html	HTTP Parser: No <meta name="author".. found
Source: https://www.nbnewstar.com.cn/product/product-46-926.html	HTTP Parser: No <meta name="author".. found
Source: https://www.nbnewstar.com.cn/product/product-53-253.html	HTTP Parser: No <meta name="author".. found
Source: https://www.nbnewstar.com.cn/product/product-38-672.html	HTTP Parser: No <meta name="author".. found
Source: https://www.nbnewstar.com.cn/product/product-40-20.html	HTTP Parser: No <meta name="author".. found
Source: https://www.nbnewstar.com.cn/product/product-72-982.html	HTTP Parser: No <meta name="author".. found
Source: https://www.nbnewstar.com.cn/product/product-41-507.html	HTTP Parser: No <meta name="author".. found
Source: https://www.nbnewstar.com.cn/product/product-17-662.html	HTTP Parser: No <meta name="author".. found

Source: https://www.nbnewstar.com.cn/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.nbnewstar.com.cn/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.nbnewstar.com.cn/About-us.html	HTTP Parser: No <meta name="copyright".. found
Source: https://www.nbnewstar.com.cn/products.html	HTTP Parser: No <meta name="copyright".. found
Source: https://www.nbnewstar.com.cn/Inquiry/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.nbnewstar.com.cn/Contact-us.html	HTTP Parser: No <meta name="copyright".. found
Source: https://www.nbnewstar.com.cn/product/product-46-926.html	HTTP Parser: No <meta name="copyright".. found
Source: https://www.nbnewstar.com.cn/product/product-53-253.html	HTTP Parser: No <meta name="copyright".. found
Source: https://www.nbnewstar.com.cn/product/product-38-672.html	HTTP Parser: No <meta name="copyright".. found
Source: https://www.nbnewstar.com.cn/product/product-40-20.html	HTTP Parser: No <meta name="copyright".. found
Source: https://www.nbnewstar.com.cn/product/product-72-982.html	HTTP Parser: No <meta name="copyright".. found
Source: https://www.nbnewstar.com.cn/product/product-41-507.html	HTTP Parser: No <meta name="copyright".. found
Source: https://www.nbnewstar.com.cn/product/product-17-662.html	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49887 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.46.128
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.46.128
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.46.128
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.46.128
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 18 Mar 2024 07:56:41 GMTServer: ApacheContent-Length: 270Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 18 Mar 2024 07:56:42 GMTServer: ApacheVary: Accept-EncodingUpgrade: h2Connection: Upgrade, closeContent-Length: 0Content-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 18 Mar 2024 07:56:45 GMTServer: ApacheContent-Length: 270Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 18 Mar 2024 07:56:53 GMTServer: ApacheContent-Length: 270Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 18 Mar 2024 07:56:57 GMTServer: ApacheContent-Length: 270Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 18 Mar 2024 07:57:03 GMTServer: ApacheContent-Length: 270Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 18 Mar 2024 07:57:09 GMTServer: ApacheContent-Length: 270Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 18 Mar 2024 07:57:16 GMTServer: ApacheContent-Length: 270Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 18 Mar 2024 07:57:19 GMTServer: ApacheContent-Length: 270Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 18 Mar 2024 07:57:25 GMTServer: ApacheContent-Length: 270Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 18 Mar 2024 07:57:32 GMTServer: ApacheContent-Length: 270Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 18 Mar 2024 07:57:37 GMTServer: ApacheContent-Length: 270Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 18 Mar 2024 07:57:43 GMTServer: ApacheContent-Length: 270Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: chromecache_151.2.dr	String found in binary or memory: http://dimsemenov.com
Source: chromecache_203.2.dr	String found in binary or memory: http://dimsemenov.com/plugins/magnific-popup/
Source: chromecache_244.2.dr	String found in binary or memory: http://nivo.dev7studios.com
Source: chromecache_243.2.dr, chromecache_147.2.dr, chromecache_180.2.dr, chromecache_283.2.dr, chromecache_260.2.dr, chromecache_234.2.dr, chromecache_178.2.dr, chromecache_181.2.dr, chromecache_241.2.dr, chromecache_187.2.dr, chromecache_273.2.dr	String found in binary or memory: http://rdf.data-vocabulary.org/#
Source: chromecache_233.2.dr	String found in binary or memory: http://tongji.baidu.com/hm-web/welcome/ico
Source: chromecache_237.2.dr	String found in binary or memory: http://wpa.qq.com/msgrd?v=3&uin=1084608356&site=qq&menu=yes
Source: chromecache_283.2.dr	String found in binary or memory: http://www.nbnewstar.com
Source: chromecache_273.2.dr	String found in binary or memory: http://www.nbnewstar.com.cn/product/product-17-662.html
Source: chromecache_260.2.dr	String found in binary or memory: http://www.nbnewstar.com.cn/product/product-38-672.html
Source: chromecache_180.2.dr	String found in binary or memory: http://www.nbnewstar.com.cn/product/product-40-20.html
Source: chromecache_243.2.dr	String found in binary or memory: http://www.nbnewstar.com.cn/product/product-41-507.html
Source: chromecache_181.2.dr	String found in binary or memory: http://www.nbnewstar.com.cn/product/product-46-926.html
Source: chromecache_241.2.dr	String found in binary or memory: http://www.nbnewstar.com.cn/product/product-53-253.html
Source: chromecache_147.2.dr	String found in binary or memory: http://www.nbnewstar.com.cn/product/product-72-982.html
Source: chromecache_244.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_233.2.dr	String found in binary or memory: https://fclog.baidu.com/log/ocpcagl?type=behavior&emd=euc
Source: chromecache_233.2.dr	String found in binary or memory: https://goutong.baidu.com/site/
Source: chromecache_243.2.dr, chromecache_147.2.dr, chromecache_180.2.dr, chromecache_283.2.dr, chromecache_260.2.dr, chromecache_234.2.dr, chromecache_178.2.dr, chromecache_181.2.dr, chromecache_241.2.dr, chromecache_187.2.dr, chromecache_273.2.dr, chromecache_237.2.dr	String found in binary or memory: https://hm.baidu.com/hm.js?25f937473d69b499c59a0b34fb494cc7
Source: chromecache_233.2.dr	String found in binary or memory: https://hmcdn.baidu.com/static
Source: chromecache_233.2.dr	String found in binary or memory: https://hmcdn.baidu.com/static/tongji/plugins/
Source: chromecache_151.2.dr	String found in binary or memory: https://player.vimeo.com/video/%id%?byline=0&portrait=0&autoplay=1
Source: chromecache_243.2.dr, chromecache_147.2.dr, chromecache_180.2.dr, chromecache_260.2.dr, chromecache_178.2.dr, chromecache_181.2.dr, chromecache_241.2.dr, chromecache_273.2.dr, chromecache_237.2.dr	String found in binary or memory: https://schema.org/Blog
Source: chromecache_243.2.dr, chromecache_147.2.dr, chromecache_180.2.dr, chromecache_283.2.dr, chromecache_260.2.dr, chromecache_234.2.dr, chromecache_178.2.dr, chromecache_181.2.dr, chromecache_241.2.dr, chromecache_187.2.dr, chromecache_273.2.dr, chromecache_237.2.dr	String found in binary or memory: https://schema.org/SiteNavigationElement
Source: chromecache_243.2.dr, chromecache_147.2.dr, chromecache_180.2.dr, chromecache_283.2.dr, chromecache_260.2.dr, chromecache_234.2.dr, chromecache_178.2.dr, chromecache_181.2.dr, chromecache_241.2.dr, chromecache_187.2.dr, chromecache_273.2.dr, chromecache_237.2.dr	String found in binary or memory: https://schema.org/WPFooter
Source: chromecache_243.2.dr, chromecache_147.2.dr, chromecache_180.2.dr, chromecache_283.2.dr, chromecache_260.2.dr, chromecache_234.2.dr, chromecache_178.2.dr, chromecache_181.2.dr, chromecache_241.2.dr, chromecache_187.2.dr, chromecache_273.2.dr, chromecache_237.2.dr	String found in binary or memory: https://schema.org/WPHeader
Source: chromecache_243.2.dr, chromecache_147.2.dr, chromecache_180.2.dr, chromecache_283.2.dr, chromecache_260.2.dr, chromecache_234.2.dr, chromecache_178.2.dr, chromecache_181.2.dr, chromecache_241.2.dr, chromecache_187.2.dr, chromecache_273.2.dr	String found in binary or memory: https://schema.org/WPSideBar
Source: chromecache_243.2.dr, chromecache_147.2.dr, chromecache_180.2.dr, chromecache_283.2.dr, chromecache_260.2.dr, chromecache_234.2.dr, chromecache_178.2.dr, chromecache_181.2.dr, chromecache_241.2.dr, chromecache_187.2.dr, chromecache_273.2.dr, chromecache_237.2.dr	String found in binary or memory: https://schema.org/WebPage
Source: chromecache_151.2.dr	String found in binary or memory: https://www.youtube.com/embed/%id%?rel=1&showinfo=0&autoplay=1&wmode=transparent

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2156,i,3691347965485979252,9914316177754317718,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.nbnewstar.com.cn
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2156,i,3691347965485979252,9914316177754317718,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /xiaoyucms/css/sohowp.min.css HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /xiaoyucms/css/style.min.css HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /xiaoyucms/css/responsive.min.css HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /xiaoyucms/css/style.css HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /xiaoyucms/css/zzshe.css HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /xiaoyucms/js/jquery.js HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /xiaoyucms/js/jquery-migrate.min.js HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /Uploads/flash/5a430adb90c8a.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /Uploads/flash/5a7280b1bd3a4.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /xiaoyucms/js/owl.carousel.min.js HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201d7560861.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201ce4655bc.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201d319a9a7.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201c707b9ea.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /hm.js?25f937473d69b499c59a0b34fb494cc7 HTTP/1.1Host: hm.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201bebc9bef.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /xiaoyucms/js/jquery.magnific-popup.js HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201e657c56f.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201e19e65bf.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201dc6a1258.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /Uploads/flash/5a430adb90c8a.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /Uploads/flash/5a7280b1bd3a4.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201d7560861.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201d319a9a7.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201ce4655bc.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201c707b9ea.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1
Source: global traffic	HTTP traffic detected: GET /xiaoyucms/js/sohowp.min.js HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1; Hm_lvt_25f937473d69b499c59a0b34fb494cc7=1710748660; Hm_lpvt_25f937473d69b499c59a0b34fb494cc7=1710748660
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201bebc9bef.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1; Hm_lvt_25f937473d69b499c59a0b34fb494cc7=1710748660; Hm_lpvt_25f937473d69b499c59a0b34fb494cc7=1710748660
Source: global traffic	HTTP traffic detected: GET /xiaoyucms/js/jquery.royalslider.min.js HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1; Hm_lvt_25f937473d69b499c59a0b34fb494cc7=1710748660; Hm_lpvt_25f937473d69b499c59a0b34fb494cc7=1710748660
Source: global traffic	HTTP traffic detected: GET /Uploads/flash/5726b05941ecb.gif HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1; Hm_lvt_25f937473d69b499c59a0b34fb494cc7=1710748660; Hm_lpvt_25f937473d69b499c59a0b34fb494cc7=1710748660
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201e657c56f.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1; Hm_lvt_25f937473d69b499c59a0b34fb494cc7=1710748660; Hm_lpvt_25f937473d69b499c59a0b34fb494cc7=1710748660
Source: global traffic	HTTP traffic detected: GET /Uploads/flash/ HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1; Hm_lvt_25f937473d69b499c59a0b34fb494cc7=1710748660; Hm_lpvt_25f937473d69b499c59a0b34fb494cc7=1710748660
Source: global traffic	HTTP traffic detected: GET /xiaoyucms/css/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.nbnewstar.com.cnsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.nbnewstar.com.cn/xiaoyucms/css/sohowp.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1; Hm_lvt_25f937473d69b499c59a0b34fb494cc7=1710748660; Hm_lpvt_25f937473d69b499c59a0b34fb494cc7=1710748660
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201dc6a1258.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1; Hm_lvt_25f937473d69b499c59a0b34fb494cc7=1710748660; Hm_lpvt_25f937473d69b499c59a0b34fb494cc7=1710748660
Source: global traffic	HTTP traffic detected: GET /Uploads/pro/62201e19e65bf.jpg HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1; Hm_lvt_25f937473d69b499c59a0b34fb494cc7=1710748660; Hm_lpvt_25f937473d69b499c59a0b34fb494cc7=1710748660
Source: global traffic	HTTP traffic detected: GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&rnd=1452915951&si=25f937473d69b499c59a0b34fb494cc7&v=1.3.0&lv=1&sn=23020&r=0&ww=1280&u=https%3A%2F%2Fwww.nbnewstar.com.cn%2F&tt=Ningbo%20New%20Star%20Arts%20Co.%2CLtd.%20- HTTP/1.1Host: hm.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: HMACCOUNT_BFESS=4F6EF62A4256DFA0
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.nbnewstar.com.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1; Hm_lvt_25f937473d69b499c59a0b34fb494cc7=1710748660; Hm_lpvt_25f937473d69b499c59a0b34fb494cc7=1710748660
Source: global traffic	HTTP traffic detected: GET /Uploads/flash/5726b05941ecb.gif HTTP/1.1Host: www.nbnewstar.com.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=hlgfkfnt8dicqs91lgu95vulq1; Hm_lvt_25f937473d69b499c59a0b34fb494cc7=1710748660; Hm_lpvt_25f937473d69b499c59a0b34fb494cc7=1710748660

Source	Detection	Scanner	Label	Link
http://www.nbnewstar.com.cn	0%	Avira URL Cloud	safe
http://www.nbnewstar.com.cn	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
hm.e.shifen.com	0%	Virustotal		Browse
www.nbnewstar.com.cn	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://www.nbnewstar.com.cn/xiaoyucms/images/sidebar2.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/xiaoyucms/js/jquery.magnific-popup.js	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62a7deb4ad91f.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62201e19e6b0e.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62201d319ae8c.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/flash/5a7280b1bd3a4.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62a7de387053d.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/image/20170713/20170713103943_85789.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62201ce465aff.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62201673b0ffe.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/622016cee99a4.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62201d7560861.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62a7de85ef012.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62201c707b9ea.jpg	0%	Avira URL Cloud	safe
http://www.nbnewstar.com.cn/product/product-53-253.html	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62201c707bf23.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62a7df32839ff.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/flash/	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62201e19e65bf.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62201d319a9a7.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62201dc6a1258.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62201a77d2aa1.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/xiaoyucms/css/sohowp.min.css	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62a7df6c81b60.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/xiaoyucms/js/jquery-migrate.min.js	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/xiaoyucms/js/sohowp.min.js	0%	Avira URL Cloud	safe
http://rdf.data-vocabulary.org/#	0%	Avira URL Cloud	safe
http://www.nbnewstar.com.cn/product/product-38-672.html	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/flash/5726b05941ecb.gif	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62201d7560d3e.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/xiaoyucms/css/zzshe.css	0%	Avira URL Cloud	safe
http://rdf.data-vocabulary.org/#	0%	Virustotal		Browse
http://www.nbnewstar.com.cn/product/product-17-662.html	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62201dc6a1856.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/xiaoyucms/css/responsive.min.css	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/Uploads/pro/62201e657c98e.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/xiaoyucms/js/owl.carousel.min.js	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/xiaoyucms/css/style.min.css	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/xiaoyucms/images/sidebar1.jpg	0%	Avira URL Cloud	safe
https://www.nbnewstar.com.cn/xiaoyucms/js/jquery.js	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dnsus6.zzshe.site	45.201.245.75	true	false		unknown
www.google.com	142.250.80.68	true	false		high
hm.e.shifen.com	103.235.46.191	true	false	0%, Virustotal, Browse	unknown
s7.addthis.com	unknown	unknown	false		high
www.nbnewstar.com.cn	unknown	unknown	false	0%, Virustotal, Browse	unknown
hm.baidu.com	unknown	unknown	false		high

Name	Malicious	Antivirus Detection	Reputation
https://www.nbnewstar.com.cn/Uploads/pro/62a7deb4ad91f.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/xiaoyucms/images/sidebar2.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/xiaoyucms/js/jquery.magnific-popup.js	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62201e19e6b0e.jpg	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&lt=1710748660&rnd=1618186217&si=25f937473d69b499c59a0b34fb494cc7&v=1.3.0&lv=2&sn=23079&r=0&ww=1280&u=https%3A%2F%2Fwww.nbnewstar.com.cn%2Fproduct%2Fproduct-41-507.html&tt=Marble%20table	false		high
https://www.nbnewstar.com.cn/Uploads/pro/62201d319ae8c.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/flash/5a7280b1bd3a4.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62a7de387053d.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62201673b0ffe.jpg	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&rnd=1452915951&si=25f937473d69b499c59a0b34fb494cc7&v=1.3.0&lv=1&sn=23020&r=0&ww=1280&u=https%3A%2F%2Fwww.nbnewstar.com.cn%2F&tt=Ningbo%20New%20Star%20Arts%20Co.%2CLtd.%20-	false		high
https://www.nbnewstar.com.cn/Uploads/pro/62201ce465aff.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/image/20170713/20170713103943_85789.jpg	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&lt=1710748660&rnd=633515083&si=25f937473d69b499c59a0b34fb494cc7&v=1.3.0&lv=2&sn=23085&r=0&ww=1280&u=https%3A%2F%2Fwww.nbnewstar.com.cn%2Fproduct%2Fproduct-17-662.html&tt=Clock%20table	false		high
https://www.nbnewstar.com.cn/Uploads/pro/622016cee99a4.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62201d7560861.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62a7de85ef012.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62201c707b9ea.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62201c707bf23.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62a7df32839ff.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62201e19e65bf.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/product/product-72-982.html	false		unknown
https://www.nbnewstar.com.cn/Uploads/flash/	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62201d319a9a7.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62201dc6a1258.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62201a77d2aa1.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/xiaoyucms/css/sohowp.min.css	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/products.html	false		unknown
https://www.nbnewstar.com.cn/Uploads/pro/62a7df6c81b60.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/product/product-41-507.html	false		unknown
https://www.nbnewstar.com.cn/Contact-us.html	false		unknown
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&lt=1710748660&rnd=1981542389&si=25f937473d69b499c59a0b34fb494cc7&v=1.3.0&lv=2&sn=23034&r=0&ww=1280&u=https%3A%2F%2Fwww.nbnewstar.com.cn%2Fproducts.html&tt=Products%20-%20SEO%E6%A0%87%E9%A2%98%E4%BC%98%E5%8C%96	false		high
https://www.nbnewstar.com.cn/xiaoyucms/js/jquery-migrate.min.js	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/product/product-46-926.html	false		unknown
https://www.nbnewstar.com.cn/xiaoyucms/js/sohowp.min.js	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/flash/5726b05941ecb.gif	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62201d7560d3e.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/xiaoyucms/css/zzshe.css	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&lt=1710748660&rnd=1592948523&si=25f937473d69b499c59a0b34fb494cc7&v=1.3.0&lv=2&sn=23051&r=0&ww=1280&u=https%3A%2F%2Fwww.nbnewstar.com.cn%2Fproduct%2Fproduct-46-926.html&tt=Wooden%20Desk	false		high
https://www.nbnewstar.com.cn/product/product-38-672.html	false		unknown
https://www.nbnewstar.com.cn/Uploads/pro/62201dc6a1856.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/xiaoyucms/css/responsive.min.css	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62201e657c98e.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/product/product-40-20.html	false		unknown
https://www.nbnewstar.com.cn/xiaoyucms/css/style.min.css	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/xiaoyucms/js/owl.carousel.min.js	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.js?25f937473d69b499c59a0b34fb494cc7	false		high
https://www.nbnewstar.com.cn/xiaoyucms/images/sidebar1.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/xiaoyucms/js/jquery.js	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&lt=1710748660&rnd=640635952&si=25f937473d69b499c59a0b34fb494cc7&v=1.3.0&lv=2&sn=23027&r=0&ww=1280&u=https%3A%2F%2Fwww.nbnewstar.com.cn%2FAbout-us.html&tt=About%20us%20-%20SEO%E6%A0%87%E9%A2%98	false		high
https://www.nbnewstar.com.cn/About-us.html	false		unknown
https://www.nbnewstar.com.cn/Uploads/pro/62201ce4655bc.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62201bafa7560.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62a7dfe5889be.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/6220190863137.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/xiaoyucms/css/style.css	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62a7dedd9e956.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62201e657c56f.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/image/20180201/20180201024002_39975.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/xiaoyucms/css/fontawesome-webfont.woff2?v=4.7.0	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/	false		unknown
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&lt=1710748660&rnd=984176187&si=25f937473d69b499c59a0b34fb494cc7&v=1.3.0&lv=2&sn=23074&r=0&ww=1280&u=https%3A%2F%2Fwww.nbnewstar.com.cn%2Fproduct%2Fproduct-72-982.html&tt=Wood%2Fmetal%20side%20table	false		high
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&lt=1710748660&rnd=1158034493&si=25f937473d69b499c59a0b34fb494cc7&v=1.3.0&lv=2&sn=23039&r=0&ww=1280&u=https%3A%2F%2Fwww.nbnewstar.com.cn%2FInquiry%2F&tt=%2COnline%20Inquiry%EF%BC%8C	false		high
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&lt=1710748660&rnd=1775517933&si=25f937473d69b499c59a0b34fb494cc7&v=1.3.0&lv=2&sn=23045&r=0&ww=1280&u=https%3A%2F%2Fwww.nbnewstar.com.cn%2FContact-us.html&tt=Contact%20us%20-%20SEO%E6%A0%87%E9%A2%98	false		high
https://www.nbnewstar.com.cn/Uploads/pro/6220195000cc2.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/62a7df0e25e3e.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/flash/5a430adb90c8a.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/622019a06914a.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/product/product-53-253.html	false		unknown
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&lt=1710748660&rnd=546187987&si=25f937473d69b499c59a0b34fb494cc7&v=1.3.0&lv=2&sn=23067&r=0&ww=1280&u=https%3A%2F%2Fwww.nbnewstar.com.cn%2Fproduct%2Fproduct-40-20.html&tt=Metal%20tray%20table	false		high
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&lt=1710748660&rnd=1283857657&si=25f937473d69b499c59a0b34fb494cc7&v=1.3.0&lv=2&sn=23061&r=0&ww=1280&u=https%3A%2F%2Fwww.nbnewstar.com.cn%2Fproduct%2Fproduct-38-672.html&tt=Wooden%20grating%20lifting%20basket	false		high
https://www.nbnewstar.com.cn/Uploads/pro/62201bebc9bef.jpg	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&lt=1710748660&rnd=542787232&si=25f937473d69b499c59a0b34fb494cc7&v=1.3.0&lv=2&sn=23057&r=0&ww=1280&u=https%3A%2F%2Fwww.nbnewstar.com.cn%2Fproduct%2Fproduct-53-253.html&tt=Wood%20ladder	false		high
https://www.nbnewstar.com.cn/Uploads/pro/62201836f3436.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Inquiry/	false		unknown
http://www.nbnewstar.com.cn/	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/Uploads/pro/622015ff1bfcc.jpg	false	Avira URL Cloud: safe	unknown
https://www.nbnewstar.com.cn/xiaoyucms/images/icon-ver-menu.png	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://wpa.qq.com/msgrd?v=3&uin=1084608356&site=qq&menu=yes	chromecache_237.2.dr	false		high
http://www.opensource.org/licenses/mit-license.php	chromecache_244.2.dr	false		high
https://schema.org/WPSideBar	chromecache_243.2.dr, chromecache_147.2.dr, chromecache_180.2.dr, chromecache_283.2.dr, chromecache_260.2.dr, chromecache_234.2.dr, chromecache_178.2.dr, chromecache_181.2.dr, chromecache_241.2.dr, chromecache_187.2.dr, chromecache_273.2.dr	false		high
http://www.nbnewstar.com.cn/product/product-53-253.html	chromecache_241.2.dr	false	Avira URL Cloud: safe	unknown
https://schema.org/Blog	chromecache_243.2.dr, chromecache_147.2.dr, chromecache_180.2.dr, chromecache_260.2.dr, chromecache_178.2.dr, chromecache_181.2.dr, chromecache_241.2.dr, chromecache_273.2.dr, chromecache_237.2.dr	false		high
http://dimsemenov.com/plugins/magnific-popup/	chromecache_203.2.dr	false		high
https://hmcdn.baidu.com/static/tongji/plugins/	chromecache_233.2.dr	false		high
https://schema.org/WPHeader	chromecache_243.2.dr, chromecache_147.2.dr, chromecache_180.2.dr, chromecache_283.2.dr, chromecache_260.2.dr, chromecache_234.2.dr, chromecache_178.2.dr, chromecache_181.2.dr, chromecache_241.2.dr, chromecache_187.2.dr, chromecache_273.2.dr, chromecache_237.2.dr	false		high
http://rdf.data-vocabulary.org/#	chromecache_243.2.dr, chromecache_147.2.dr, chromecache_180.2.dr, chromecache_283.2.dr, chromecache_260.2.dr, chromecache_234.2.dr, chromecache_178.2.dr, chromecache_181.2.dr, chromecache_241.2.dr, chromecache_187.2.dr, chromecache_273.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.nbnewstar.com.cn/product/product-38-672.html	chromecache_260.2.dr	false	Avira URL Cloud: safe	unknown
http://www.nbnewstar.com.cn/product/product-17-662.html	chromecache_273.2.dr	false	Avira URL Cloud: safe	unknown
https://schema.org/WPFooter	chromecache_243.2.dr, chromecache_147.2.dr, chromecache_180.2.dr, chromecache_283.2.dr, chromecache_260.2.dr, chromecache_234.2.dr, chromecache_178.2.dr, chromecache_181.2.dr, chromecache_241.2.dr, chromecache_187.2.dr, chromecache_273.2.dr, chromecache_237.2.dr	false		high
https://fclog.baidu.com/log/ocpcagl?type=behavior&emd=euc	chromecache_233.2.dr	false		high
http://www.nbnewstar.com.cn/product/product-41-507.html	chromecache_243.2.dr	false	Avira URL Cloud: safe	unknown
http://www.nbnewstar.com.cn/product/product-46-926.html	chromecache_181.2.dr	false	Avira URL Cloud: safe	unknown
https://hmcdn.baidu.com/static	chromecache_233.2.dr	false		high
https://schema.org/SiteNavigationElement	chromecache_243.2.dr, chromecache_147.2.dr, chromecache_180.2.dr, chromecache_283.2.dr, chromecache_260.2.dr, chromecache_234.2.dr, chromecache_178.2.dr, chromecache_181.2.dr, chromecache_241.2.dr, chromecache_187.2.dr, chromecache_273.2.dr, chromecache_237.2.dr	false		high
http://tongji.baidu.com/hm-web/welcome/ico	chromecache_233.2.dr	false		high
https://schema.org/WebPage	chromecache_243.2.dr, chromecache_147.2.dr, chromecache_180.2.dr, chromecache_283.2.dr, chromecache_260.2.dr, chromecache_234.2.dr, chromecache_178.2.dr, chromecache_181.2.dr, chromecache_241.2.dr, chromecache_187.2.dr, chromecache_273.2.dr, chromecache_237.2.dr	false		high
https://goutong.baidu.com/site/	chromecache_233.2.dr	false		high
http://www.nbnewstar.com.cn/product/product-40-20.html	chromecache_180.2.dr	false	Avira URL Cloud: safe	unknown
http://www.nbnewstar.com	chromecache_283.2.dr	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/embed/%id%?rel=1&showinfo=0&autoplay=1&wmode=transparent	chromecache_151.2.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.80.68	www.google.com	United States	15169	GOOGLEUS	false
103.235.46.191	hm.e.shifen.com	Hong Kong	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
45.201.245.75	dnsus6.zzshe.site	Seychelles	131178	KINGCORP-KHOpenNetISPCambodiaKH	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1410648
Start date and time:	2024-03-18 08:56:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 18s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.nbnewstar.com.cn
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@28/225@22/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.nbnewstar.com.cn/About-us.html Browse: https://www.nbnewstar.com.cn/products.html Browse: https://www.nbnewstar.com.cn/Inquiry/ Browse: https://www.nbnewstar.com.cn/Contact-us.html Browse: https://www.nbnewstar.com.cn/product/product-46-926.html Browse: https://www.nbnewstar.com.cn/product/product-53-253.html Browse: https://www.nbnewstar.com.cn/product/product-38-672.html Browse: https://www.nbnewstar.com.cn/product/product-40-20.html Browse: https://www.nbnewstar.com.cn/product/product-72-982.html Browse: https://www.nbnewstar.com.cn/product/product-41-507.html Browse: https://www.nbnewstar.com.cn/product/product-17-662.html

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with very long lines (4022), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	55278
Entropy (8bit):	4.4056251061956
Encrypted:	false
SSDEEP:	384:S7Vc52XHqEYIAgWDH9YAV70jeVakMwS0PsFAQG54c0RYZX2oAWL/X9aATFKohOci:S7Vc0XgIAjreQnQrohOGWkBeGXCJ80
MD5:	B3F9E8A5A2AD2C9F8EE9E9E90C290325
SHA1:	E1CEE5F22E76A60ACAC5CB58028986A7827C023C
SHA-256:	30E8F06C5D260D05206426B4A66743BF7AF36E8CBE31DC0E53C3660C8CE0180D
SHA-512:	786677931089A2082E971AD9064B520124D2701AC0D47A3E74DA8C0CCAD1D96F07D22F0598C3A095F66B8DD92FA5E9BFDD1B8B771EC4AA05834A1FE383D560C9
Malicious:	false
Reputation:	low
URL:	https://www.nbnewstar.com.cn/product/product-72-982.html
Preview:	. <!DOCTYPE HTML>.<html class="" lang="en-US">.<head>.<meta charset="UTF-8"><script>.var _hmt = _hmt \|\| [];.(function() {. var hm = document.createElement("script");. hm.src = "https://hm.baidu.com/hm.js?25f937473d69b499c59a0b34fb494cc7";. var s = document.getElementsByTagName("script")[0]; . s.parentNode.insertBefore(hm, s);.})();.</script>.<meta name="viewport" content="width=device-width, initial-scale=1">.<title>Wood/metal side table </title>.<meta name="keywords" content="Wood/metal side table " />.<meta name="description" content="" />..<link rel='stylesheet' id='us-base-css' href='/xiaoyucms/css/sohowp.min.css' type='text/css' media='all' />.<link rel='stylesheet' id='us-style-css' href='/xiaoyucms/css/style.min.css' type='text/css' media='all' />.<link rel='stylesheet' id='us-responsive-css' href='/xiaoyucms/css/responsive.min.css' type='text/css' media='all' />.<link rel='stylesheet' id='theme-style-css' href='/xiaoyucms/css/style.css' type='text/css' media='all' /

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 18, 2024 08:57:23.710432053 CET	49675	443	192.168.2.4	173.222.162.32
Mar 18, 2024 08:57:24.398025036 CET	49678	443	192.168.2.4	104.46.162.224
Mar 18, 2024 08:57:33.318917036 CET	49675	443	192.168.2.4	173.222.162.32
Mar 18, 2024 08:57:33.738464117 CET	49735	443	192.168.2.4	142.250.80.68
Mar 18, 2024 08:57:33.738492966 CET	443	49735	142.250.80.68	192.168.2.4
Mar 18, 2024 08:57:33.738555908 CET	49735	443	192.168.2.4	142.250.80.68
Mar 18, 2024 08:57:33.738905907 CET	49735	443	192.168.2.4	142.250.80.68
Mar 18, 2024 08:57:33.738922119 CET	443	49735	142.250.80.68	192.168.2.4
Mar 18, 2024 08:57:33.929846048 CET	443	49735	142.250.80.68	192.168.2.4
Mar 18, 2024 08:57:33.930115938 CET	49735	443	192.168.2.4	142.250.80.68
Mar 18, 2024 08:57:33.930131912 CET	443	49735	142.250.80.68	192.168.2.4
Mar 18, 2024 08:57:33.931087017 CET	443	49735	142.250.80.68	192.168.2.4
Mar 18, 2024 08:57:33.931149960 CET	49735	443	192.168.2.4	142.250.80.68
Mar 18, 2024 08:57:33.932178020 CET	49735	443	192.168.2.4	142.250.80.68
Mar 18, 2024 08:57:33.932246923 CET	443	49735	142.250.80.68	192.168.2.4
Mar 18, 2024 08:57:33.976586103 CET	49735	443	192.168.2.4	142.250.80.68
Mar 18, 2024 08:57:33.976596117 CET	443	49735	142.250.80.68	192.168.2.4
Mar 18, 2024 08:57:34.022999048 CET	49735	443	192.168.2.4	142.250.80.68
Mar 18, 2024 08:57:34.691719055 CET	49737	80	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:34.692998886 CET	49738	80	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:34.712379932 CET	49739	80	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:34.846380949 CET	80	49737	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:34.846491098 CET	49737	80	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:34.846803904 CET	49737	80	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:34.847526073 CET	80	49738	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:34.847609997 CET	49738	80	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:34.866930008 CET	80	49739	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:34.867023945 CET	49739	80	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:35.001280069 CET	80	49737	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:35.002119064 CET	80	49737	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:35.002134085 CET	80	49737	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:35.002187014 CET	49737	80	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:35.004616022 CET	49737	80	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:35.159365892 CET	80	49737	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:36.022684097 CET	49740	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.022757053 CET	443	49740	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.022831917 CET	49740	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.025211096 CET	49740	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.025229931 CET	443	49740	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.137516022 CET	49741	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.137557983 CET	443	49741	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:36.137626886 CET	49741	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.137984991 CET	49741	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.138001919 CET	443	49741	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:36.209886074 CET	443	49740	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.209968090 CET	49740	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.217065096 CET	49740	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.217086077 CET	443	49740	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.217381001 CET	443	49740	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.258025885 CET	49740	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.396538973 CET	49740	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.444232941 CET	443	49740	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.459027052 CET	443	49741	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:36.462258101 CET	49741	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.462271929 CET	443	49741	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:36.463397026 CET	443	49741	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:36.463462114 CET	49741	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.470227957 CET	49741	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.470290899 CET	443	49741	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:36.470906973 CET	49741	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.470912933 CET	443	49741	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:36.485181093 CET	443	49740	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.485327959 CET	443	49740	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.485402107 CET	49740	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.485591888 CET	49740	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.485632896 CET	443	49740	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.485661030 CET	49740	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.485677004 CET	443	49740	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.511084080 CET	49741	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.564829111 CET	49742	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.564898968 CET	443	49742	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.564985991 CET	49742	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.565859079 CET	49742	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.565891027 CET	443	49742	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.746256113 CET	443	49742	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.746356964 CET	49742	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.748423100 CET	49742	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.748450041 CET	443	49742	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.748668909 CET	443	49742	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.751319885 CET	49742	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.792253017 CET	443	49742	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.824337959 CET	443	49741	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:36.824362040 CET	443	49741	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:36.824368954 CET	443	49741	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:36.824425936 CET	49741	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.824435949 CET	443	49741	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:36.866997957 CET	49741	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.867012024 CET	443	49741	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:36.916903973 CET	49741	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.923661947 CET	443	49742	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.923719883 CET	443	49742	23.51.58.94	192.168.2.4
Mar 18, 2024 08:57:36.923908949 CET	49742	443	192.168.2.4	23.51.58.94
Mar 18, 2024 08:57:36.932756901 CET	49743	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.932787895 CET	443	49743	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:36.932895899 CET	49743	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.933950901 CET	49744	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.934035063 CET	443	49744	45.201.245.75	192.168.2.4
Mar 18, 2024 08:57:36.934120893 CET	49744	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.935353041 CET	49745	443	192.168.2.4	45.201.245.75
Mar 18, 2024 08:57:36.935422897 CET	443	49745	45.201.245.75	192.168.2.4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 18, 2024 08:57:33.433971882 CET	192.168.2.4	1.1.1.1	0xe0bd	Standard query (0)	www.nbnewstar.com.cn	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:33.434129953 CET	192.168.2.4	1.1.1.1	0x8c01	Standard query (0)	www.nbnewstar.com.cn	65	IN (0x0001)	false
Mar 18, 2024 08:57:33.648726940 CET	192.168.2.4	1.1.1.1	0x2be4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:33.649302006 CET	192.168.2.4	1.1.1.1	0xdee6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 18, 2024 08:57:34.447061062 CET	192.168.2.4	1.1.1.1	0xb5af	Standard query (0)	www.nbnewstar.com.cn	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:34.447740078 CET	192.168.2.4	1.1.1.1	0x3a2f	Standard query (0)	www.nbnewstar.com.cn	65	IN (0x0001)	false
Mar 18, 2024 08:57:35.014730930 CET	192.168.2.4	1.1.1.1	0x4dea	Standard query (0)	www.nbnewstar.com.cn	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:35.015384912 CET	192.168.2.4	1.1.1.1	0xd96e	Standard query (0)	www.nbnewstar.com.cn	65	IN (0x0001)	false
Mar 18, 2024 08:57:36.051459074 CET	192.168.2.4	1.1.1.1	0x175b	Standard query (0)	www.nbnewstar.com.cn	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:36.051783085 CET	192.168.2.4	1.1.1.1	0xb55d	Standard query (0)	www.nbnewstar.com.cn	65	IN (0x0001)	false
Mar 18, 2024 08:57:38.593810081 CET	192.168.2.4	1.1.1.1	0x406	Standard query (0)	hm.baidu.com	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:38.595698118 CET	192.168.2.4	1.1.1.1	0x4d01	Standard query (0)	hm.baidu.com	65	IN (0x0001)	false
Mar 18, 2024 08:57:38.619332075 CET	192.168.2.4	1.1.1.1	0x3706	Standard query (0)	s7.addthis.com	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:38.707263947 CET	192.168.2.4	1.1.1.1	0x5400	Standard query (0)	s7.addthis.com	65	IN (0x0001)	false
Mar 18, 2024 08:57:39.266028881 CET	192.168.2.4	1.1.1.1	0x91dd	Standard query (0)	www.nbnewstar.com.cn	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:39.267199993 CET	192.168.2.4	1.1.1.1	0x39d0	Standard query (0)	www.nbnewstar.com.cn	65	IN (0x0001)	false
Mar 18, 2024 08:57:44.022206068 CET	192.168.2.4	1.1.1.1	0x9dc0	Standard query (0)	hm.baidu.com	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:44.022490025 CET	192.168.2.4	1.1.1.1	0x572b	Standard query (0)	hm.baidu.com	65	IN (0x0001)	false
Mar 18, 2024 08:58:38.855272055 CET	192.168.2.4	1.1.1.1	0xf6a3	Standard query (0)	s7.addthis.com	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:58:38.855962038 CET	192.168.2.4	1.1.1.1	0x4997	Standard query (0)	s7.addthis.com	65	IN (0x0001)	false
Mar 18, 2024 08:58:47.719321012 CET	192.168.2.4	1.1.1.1	0x2506	Standard query (0)	hm.baidu.com	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:58:47.719968081 CET	192.168.2.4	1.1.1.1	0xa725	Standard query (0)	hm.baidu.com	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 18, 2024 08:57:33.736979008 CET	1.1.1.1	192.168.2.4	0x2be4	No error (0)	www.google.com		142.250.80.68	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:33.737027884 CET	1.1.1.1	192.168.2.4	0xdee6	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 18, 2024 08:57:34.453361034 CET	1.1.1.1	192.168.2.4	0x8c01	No error (0)	www.nbnewstar.com.cn	dnsus6.zzshe.site		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:34.690387964 CET	1.1.1.1	192.168.2.4	0xe0bd	No error (0)	www.nbnewstar.com.cn	dnsus6.zzshe.site		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:34.690387964 CET	1.1.1.1	192.168.2.4	0xe0bd	No error (0)	dnsus6.zzshe.site		45.201.245.75	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:35.538839102 CET	1.1.1.1	192.168.2.4	0xb5af	No error (0)	www.nbnewstar.com.cn	dnsus6.zzshe.site		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:35.538839102 CET	1.1.1.1	192.168.2.4	0xb5af	No error (0)	dnsus6.zzshe.site		45.201.245.75	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:35.696269035 CET	1.1.1.1	192.168.2.4	0x3a2f	No error (0)	www.nbnewstar.com.cn	dnsus6.zzshe.site		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:36.083383083 CET	1.1.1.1	192.168.2.4	0x4dea	No error (0)	www.nbnewstar.com.cn	dnsus6.zzshe.site		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:36.083383083 CET	1.1.1.1	192.168.2.4	0x4dea	No error (0)	dnsus6.zzshe.site		45.201.245.75	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:36.286498070 CET	1.1.1.1	192.168.2.4	0xd96e	No error (0)	www.nbnewstar.com.cn	dnsus6.zzshe.site		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:36.286751986 CET	1.1.1.1	192.168.2.4	0xb55d	No error (0)	www.nbnewstar.com.cn	dnsus6.zzshe.site		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:37.097584963 CET	1.1.1.1	192.168.2.4	0x175b	No error (0)	www.nbnewstar.com.cn	dnsus6.zzshe.site		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:37.097584963 CET	1.1.1.1	192.168.2.4	0x175b	No error (0)	dnsus6.zzshe.site		45.201.245.75	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:38.681936026 CET	1.1.1.1	192.168.2.4	0x406	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:38.681936026 CET	1.1.1.1	192.168.2.4	0x406	No error (0)	hm.e.shifen.com		103.235.46.191	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:38.684528112 CET	1.1.1.1	192.168.2.4	0x4d01	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:38.730952978 CET	1.1.1.1	192.168.2.4	0x3706	No error (0)	s7.addthis.com	s8.addthis.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:38.730952978 CET	1.1.1.1	192.168.2.4	0x3706	No error (0)	s8.addthis.com	ds-s7.addthis.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:38.795450926 CET	1.1.1.1	192.168.2.4	0x5400	No error (0)	s7.addthis.com	s8.addthis.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:38.795450926 CET	1.1.1.1	192.168.2.4	0x5400	No error (0)	s8.addthis.com	ds-s7.addthis.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:39.812246084 CET	1.1.1.1	192.168.2.4	0x39d0	No error (0)	www.nbnewstar.com.cn	dnsus6.zzshe.site		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:40.281951904 CET	1.1.1.1	192.168.2.4	0x91dd	No error (0)	www.nbnewstar.com.cn	dnsus6.zzshe.site		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:40.281951904 CET	1.1.1.1	192.168.2.4	0x91dd	No error (0)	dnsus6.zzshe.site		45.201.245.75	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:57:44.110624075 CET	1.1.1.1	192.168.2.4	0x572b	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:44.111071110 CET	1.1.1.1	192.168.2.4	0x9dc0	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:57:44.111071110 CET	1.1.1.1	192.168.2.4	0x9dc0	No error (0)	hm.e.shifen.com		103.235.46.191	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:58:38.944284916 CET	1.1.1.1	192.168.2.4	0x4997	No error (0)	s7.addthis.com	s8.addthis.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:58:38.944284916 CET	1.1.1.1	192.168.2.4	0x4997	No error (0)	s8.addthis.com	ds-s7.addthis.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:58:38.944905043 CET	1.1.1.1	192.168.2.4	0xf6a3	No error (0)	s7.addthis.com	s8.addthis.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:58:38.944905043 CET	1.1.1.1	192.168.2.4	0xf6a3	No error (0)	s8.addthis.com	ds-s7.addthis.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:58:47.808303118 CET	1.1.1.1	192.168.2.4	0x2506	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 08:58:47.808303118 CET	1.1.1.1	192.168.2.4	0x2506	No error (0)	hm.e.shifen.com		103.235.46.191	A (IP address)	IN (0x0001)	false
Mar 18, 2024 08:58:47.809323072 CET	1.1.1.1	192.168.2.4	0xa725	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false

Target ID:	0
Start time:	08:57:27
Start date:	18/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.nbnewstar.com.cn

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Chrome Cache Entry: 156

Chrome Cache Entry: 157

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 160

Chrome Cache Entry: 161

Chrome Cache Entry: 162

Chrome Cache Entry: 163

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Chrome Cache Entry: 166

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Chrome Cache Entry: 169

Chrome Cache Entry: 170

Chrome Cache Entry: 171

Chrome Cache Entry: 172

Chrome Cache Entry: 173

Chrome Cache Entry: 174

Chrome Cache Entry: 175

Windows Analysis Report
http://www.nbnewstar.com.cn

Target ID:	2
Start time:	08:57:28
Start date:	18/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2156,i,3691347965485979252,9914316177754317718,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	08:57:32
Start date:	18/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.nbnewstar.com.cn
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre