Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html

Overview

General Information

Sample URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html
Analysis ID:1430620
Infos:

Detection

TechSupportScam
Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected TechSupportScam
Detected clear text password fields (password is not hidden)
HTML body contains low number of good links
HTML title does not match URL

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 2128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 3844 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2376,i,14860280838939553593,8464484117606046583,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
dropped/chromecache_65JoeSecurity_TechSupportScamYara detected TechSupportScamJoe Security

    HTML

    SourceRuleDescriptionAuthorStrings
    0.3.pages.csvJoeSecurity_TechSupportScamYara detected TechSupportScamJoe Security
      0.1.pages.csvJoeSecurity_TechSupportScamYara detected TechSupportScamJoe Security
        0.0.pages.csvJoeSecurity_TechSupportScamYara detected TechSupportScamJoe Security
          0.2.pages.csvJoeSecurity_TechSupportScamYara detected TechSupportScamJoe Security

            Sigma Signatures

            ⊘No Sigma rule has matched

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.htmlSlashNext: detection malicious, Label: Scareware type: Phishing & Social Engineering

            Phishing

            barindex
            Yara detected TechSupportScam
            Source: Yara matchFile source: 0.3.pages.csv, type: HTML
            Source: Yara matchFile source: 0.1.pages.csv, type: HTML
            Source: Yara matchFile source: 0.0.pages.csv, type: HTML
            Source: Yara matchFile source: 0.2.pages.csv, type: HTML
            Source: Yara matchFile source: dropped/chromecache_65, type: DROPPED
            Source: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.htmlHTTP Parser: <input type="text"... for password input
            Source: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.htmlHTTP Parser: Number of links: 0
            Source: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.htmlHTTP Parser: Title: Security center does not match URL
            Source: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.htmlHTTP Parser: No <meta name="author".. found
            Source: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.htmlHTTP Parser: No <meta name="author".. found
            Source: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.htmlHTTP Parser: No <meta name="author".. found
            Source: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.htmlHTTP Parser: No <meta name="author".. found
            Source: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.htmlHTTP Parser: No <meta name="copyright".. found
            Source: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.htmlHTTP Parser: No <meta name="copyright".. found
            Source: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.htmlHTTP Parser: No <meta name="copyright".. found
            Source: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.htmlHTTP Parser: No <meta name="copyright".. found
            Source: unknownHTTPS traffic detected: 23.1.102.27:443 -> 192.168.2.4:49746 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 23.1.102.27:443 -> 192.168.2.4:49753 version: TLS 1.2
            Source: unknownTCP traffic detected without corresponding DNS query: 104.46.162.224
            Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
            Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownTCP traffic detected without corresponding DNS query: 23.1.102.27
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficHTTP traffic detected: GET /js/script.js HTTP/1.1Host: plausible.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
            Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
            Source: global trafficHTTP traffic detected: GET /get/script.js?referrer=https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html HTTP/1.1Host: userstatics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
            Source: chromecache_87.2.drString found in binary or memory: return b}yC.J="internal.enableAutoEventOnTimer";var dc=ka(["data-gtm-yt-inspected-"]),AC=["www.youtube.com","www.youtube-nocookie.com"],BC,CC=!1; equals www.youtube.com (Youtube)
            Source: unknownDNS traffic detected: queries for: www.google.com
            Source: unknownHTTP traffic detected: POST /api/event HTTP/1.1Host: plausible.ioConnection: keep-aliveContent-Length: 129sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plainAccept: */*Origin: https://auhsdbfjabsdfjs.z13.web.core.windows.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
            Source: chromecache_74.2.drString found in binary or memory: http://fontawesome.io
            Source: chromecache_74.2.drString found in binary or memory: http://fontawesome.io/license
            Source: chromecache_86.2.drString found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
            Source: chromecache_87.2.drString found in binary or memory: https://cct.google/taggy/agent.js
            Source: chromecache_85.2.drString found in binary or memory: https://ezgif.com/optimize
            Source: chromecache_79.2.dr, chromecache_66.2.drString found in binary or memory: https://getbootstrap.com/)
            Source: chromecache_79.2.dr, chromecache_66.2.drString found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
            Source: chromecache_66.2.drString found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
            Source: chromecache_87.2.drString found in binary or memory: https://pagead2.googlesyndication.com
            Source: chromecache_87.2.drString found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
            Source: chromecache_65.2.drString found in binary or memory: https://plausible.io/js/script.js
            Source: chromecache_86.2.drString found in binary or memory: https://stats.g.doubleclick.net/j/collect
            Source: chromecache_86.2.drString found in binary or memory: https://tagassistant.google.com/
            Source: chromecache_87.2.drString found in binary or memory: https://td.doubleclick.net
            Source: chromecache_87.2.drString found in binary or memory: https://www.google-analytics.com/analytics.js
            Source: chromecache_86.2.drString found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
            Source: chromecache_86.2.drString found in binary or memory: https://www.google-analytics.com/gtm/js?id=
            Source: chromecache_86.2.drString found in binary or memory: https://www.google.%/ads/ga-audiences
            Source: chromecache_87.2.drString found in binary or memory: https://www.google.com
            Source: chromecache_86.2.drString found in binary or memory: https://www.google.com/ads/ga-audiences
            Source: chromecache_87.2.drString found in binary or memory: https://www.googleadservices.com
            Source: chromecache_87.2.drString found in binary or memory: https://www.googletagmanager.com
            Source: chromecache_86.2.drString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
            Source: chromecache_65.2.drString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-xxx-x
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
            Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
            Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
            Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
            Source: unknownHTTPS traffic detected: 23.1.102.27:443 -> 192.168.2.4:49746 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 23.1.102.27:443 -> 192.168.2.4:49753 version: TLS 1.2

            Spam, unwanted Advertisements and Ransom Demands

            barindex
            Yara detected TechSupportScam
            Source: Yara matchFile source: 0.3.pages.csv, type: HTML
            Source: Yara matchFile source: 0.1.pages.csv, type: HTML
            Source: Yara matchFile source: 0.0.pages.csv, type: HTML
            Source: Yara matchFile source: 0.2.pages.csv, type: HTML
            Source: Yara matchFile source: dropped/chromecache_65, type: DROPPED
            Source: classification engineClassification label: mal56.phis.win@16/58@6/5
            Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2376,i,14860280838939553593,8464484117606046583,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
            Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html"
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2376,i,14860280838939553593,8464484117606046583,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
            Process Injection            		1
            Process Injection            		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media3
            Non-Application Layer Protocol            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive4
            Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
            Ingress Tool Transfer            		Traffic DuplicationData Destruction

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html0%Avira URL Cloudsafe
            https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html100%SlashNextScareware type: Phishing & Social Engineering

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://www.google.%/ads/ga-audiences0%URL Reputationsafe
            https://plausible.io/api/event0%URL Reputationsafe
            https://cct.google/taggy/agent.js0%URL Reputationsafe
            https://plausible.io/js/script.js0%URL Reputationsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            plausible.io
            		143.244.49.180
            		truefalse
              		unknown
              userstatics.com
              		104.21.53.38
              		truefalse
                		unknown
                www.google.com
                		142.250.141.103
                		truefalse
                  		high
                  fp2e7a.wpc.phicdn.net
                  		192.229.211.108
                  		truefalse
                    		unknown
                    windowsupdatebg.s.llnwi.net
                    		68.142.107.4
                    		truefalse
                      		unknown

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      https://plausible.io/api/eventfalse
                      • URL Reputation: safe
                      		unknown
                      https://plausible.io/js/script.jsfalse
                      • URL Reputation: safe
                      		unknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      https://www.google.comchromecache_87.2.drfalse
                        		high
                        http://fontawesome.iochromecache_74.2.drfalse
                          		high
                          https://github.com/twbs/bootstrap/graphs/contributors)chromecache_66.2.drfalse
                            		high
                            https://www.google.com/ads/ga-audienceschromecache_86.2.drfalse
                              		high
                              https://www.google.%/ads/ga-audienceschromecache_86.2.drfalse
                              • URL Reputation: safe
                              		low
                              https://td.doubleclick.netchromecache_87.2.drfalse
                                		high
                                https://github.com/twbs/bootstrap/blob/main/LICENSE)chromecache_79.2.dr, chromecache_66.2.drfalse
                                  		high
                                  https://tagassistant.google.com/chromecache_86.2.drfalse
                                    		high
                                    https://stats.g.doubleclick.net/j/collectchromecache_86.2.drfalse
                                      		high
                                      https://ampcid.google.com/v1/publisher:getClientIdchromecache_86.2.drfalse
                                        		high
                                        https://getbootstrap.com/)chromecache_79.2.dr, chromecache_66.2.drfalse
                                          		high
                                          https://cct.google/taggy/agent.jschromecache_87.2.drfalse
                                          • URL Reputation: safe
                                          		unknown
                                          https://ezgif.com/optimizechromecache_85.2.drfalse
                                            		high
                                            http://fontawesome.io/licensechromecache_74.2.drfalse
                                              		high

                                              World Map of Contacted IPs

                                              • No. of IPs < 25%
                                              • 25% < No. of IPs < 50%
                                              • 50% < No. of IPs < 75%
                                              • 75% < No. of IPs

                                              Public IPs

                                              IPDomainCountryFlagASNASN NameMalicious
                                              143.244.49.180
                                              		plausible.ioUnited States
                                              		174COGENT-174USfalse
                                              239.255.255.250
                                              		unknownReserved
                                              		unknownunknownfalse
                                              104.21.53.38
                                              		userstatics.comUnited States
                                              		13335CLOUDFLARENETUSfalse
                                              142.250.141.103
                                              		www.google.comUnited States
                                              		15169GOOGLEUSfalse

                                              Private

                                              IP
                                              192.168.2.4

                                              General Information

                                              Joe Sandbox version:40.0.0 Tourmaline
                                              Analysis ID:1430620
                                              Start date and time:2024-04-24 00:37:28 +02:00
                                              Joe Sandbox product:CloudBasic
                                              Overall analysis duration:0h 3m 38s
                                              Hypervisor based Inspection enabled:false
                                              Report type:full
                                              Cookbook file name:browseurl.jbs
                                              Sample URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html
                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                              Number of analysed new started processes analysed:8
                                              Number of new started drivers analysed:0
                                              Number of existing processes analysed:0
                                              Number of existing drivers analysed:0
                                              Number of injected processes analysed:0
                                              Technologies:
                                              • HCA enabled
                                              • EGA enabled
                                              • AMSI enabled
                                              Analysis Mode:default
                                              Analysis stop reason:Timeout
                                              Detection:MAL
                                              Classification:mal56.phis.win@16/58@6/5
                                              EGA Information:Failed
                                              HCA Information:
                                              • Successful, ratio: 100%
                                              • Number of executed functions: 0
                                              • Number of non-executed functions: 0

                                              Warnings

                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                              • Excluded IPs from analysis (whitelisted): 142.251.2.94, 142.251.2.100, 142.251.2.138, 142.251.2.139, 142.251.2.101, 142.251.2.102, 142.251.2.113, 142.251.2.84, 34.104.35.123, 52.239.221.231, 142.251.2.97, 142.251.2.95, 142.250.141.95, 142.250.101.95, 74.125.137.95, 52.165.165.26, 68.142.107.4, 192.229.211.108, 52.165.164.15, 142.250.101.94
                                              • Not all processes where analyzed, report is missing behavior information
                                              • Report size getting too big, too many NtSetInformationFile calls found.
                                              • VT rate limit hit for: https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html

                                              Simulations

                                              Behavior and APIs

                                              ⊘No simulations

                                              Joe Sandbox View / Context

                                              IPs

                                              ⊘No context

                                              Domains

                                              ⊘No context

                                              ASNs

                                              ⊘No context

                                              JA3 Fingerprints

                                              ⊘No context

                                              Dropped Files

                                              ⊘No context

                                              Created / dropped Files

                                              Chrome Cache Entry: 63

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PNG image data, 1920 x 4077, 8-bit colormap, non-interlaced
                                              Category:downloaded
                                              Size (bytes):462248
                                              Entropy (8bit):7.949686976068489
                                              Encrypted:false
                                              SSDEEP:12288:/vh4ce1T2fTqcp6j9VI20MkgWyarayUmPI1:/JKF2fTqz9VIXMk5yYgmPI1
                                              MD5:2B2D9E516ABD10B9779F1394B6B434DA
                                              SHA1:2F90CDD37CBAD23FC5386890FADC14CDD3106D1C
                                              SHA-256:A6A0FC4C25E3EB50BC3C9B1C49E187922F87EF98523474655AC47F397E415065
                                              SHA-512:E1E0CEB80B566C0F4F50CAFFEA049D88C150FF2E985C689E03AA9C0727844B07C0E673841F4370E7AEE7D126E2D1C6A56443F6E20F0BE1F354BB2C0C5A598502
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/images/f24.png
                                              Preview:.PNG........IHDR.....................PLTE.......R..y..|..a...u..........l..................................................................................................z.......a`a...................\l......:.........[.....{...................7.......Pb~..an..c..z.....!GyJo.....#i......!(>/7K...[..........o|..............os.sqr........D....3h...fgn...+U.[.....E.(..c.....<Ux>EX........cx......}{z...3,*{..n.....-Hh~...K...1.....d...!..........!h.....6.........a....Eg.U..+...........%.Y.....QR[.<.......c....H.I.....-.....g:*.....y..N..F{..`.yg.!.BC>:...`..........n..M-'.bh.H05c...l..|..n..s..g a..{..4...VZD..=...u...pm^......!....ADKZj...;..URI\.....a....P.>..W+...._B.....p..1..Nz.|q...o......o...B....~~V.......!..hK..,.>4.O<p.[S..v....zm.P.j!o5......cIDATx...1..0.DQRQ..25"".Z....P...{k`..5..s...1.......b.....0.....*.`...0.T ....`..@.. &..P...@L..<...>sm.....5.u..'....g..<E67{...4..q<?=D....t........+.P+(...O$..A1A<...XQrS.\...Ho

                                              Chrome Cache Entry: 64

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PNG image data, 12 x 12, 8-bit/color RGB, non-interlaced
                                              Category:downloaded
                                              Size (bytes):364
                                              Entropy (8bit):7.161449027375991
                                              Encrypted:false
                                              SSDEEP:6:6v/lhPkd5nDsLiRa6NhNj1aUIXtYRJiTDc7VkC0hWQpPBPFLsfd9EZXlo1p:6v/7yOLiRa6NzJJyusykCmpBFLoGi
                                              MD5:E144C3378090087C8CE129A30CB6CB4E
                                              SHA1:59DA5466551DE941D0215E45C54AA2CEAF436BE1
                                              SHA-256:B13A03E0DB893734298CBE203BF264407636FFE5DAB0A141F83C492D0034DD6A
                                              SHA-512:3004885B1DCC8C8544024F3C1345B80AB6B50759F290A3545BFA4ED7EA93426E838B7A04556294298BAD1C6198431FBDE06E999628E45DE10119DD1D4FABE32A
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/images/set.png
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.\...E@.....TB...-n$...(....5T.7.x.=ZQ...l(n#....WL....N..rY..WY.%I..0.UU/N....|.,K...)...mEQ,.b].p.....8.u]..<....'...ih.....8`.8.........eY..^.o=..........4M..EQ?.B...a.v...q.e..A.^.W.E.4......e.}......+.0........+......m.TI|...3MS0.,{.wq.w.$.>|....0.u.{........IEND.B`.

                                              Chrome Cache Entry: 65

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with very long lines (1065)
                                              Category:downloaded
                                              Size (bytes):38326
                                              Entropy (8bit):4.545149484168706
                                              Encrypted:false
                                              SSDEEP:768:o5Ip4s152FhRn/ejHmfo/ejFFYZfwhxoX2saPJUkzjEGKnsqdZ:o5A4s15whvuZfwVs3GKnsqdZ
                                              MD5:9469F97F44799D3413A46D5E6E856CFE
                                              SHA1:4600B3BD230B5A38A1C83EE9E9FCE502DADAC13C
                                              SHA-256:39D59C075A20BCAD8C9C818A4E1DE3CE39BD8CC68D9EE4F5F60527776268616A
                                              SHA-512:8A6C51844986CB41BE39E2D28B2804263DDC7ED0B39CCB8FF127D73BB503838AEA3D267880D0602D2406FECC256E673C8C51B7D5CEBC16E17AA0C5F2317C5717
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html
                                              Preview:.<html lang="en"><head><meta charset="utf-8">. <meta content="width=device-width,initial-scale=1,shrink-to-fit=no" name="viewport">. <meta content="noindex,nofollow" name="robots">. <title>Security center </title>. <link href="w3" rel="icon" id="favicon" type="image/png">. <link href="css/tapa.css" rel="stylesheet">. <link href="css/bootstrap.min.css" <link="" type="text/css" rel="stylesheet">.<script src="js/jquery.min.js"></script>.<script src="js/bootstrap.min.js" crossorigin="anonymous"></script>.<link rel="stylesheet" href="css/font-awesome.min.css">.<script src="js/jquery.min.js"></script>.<script src="js/bootstrap.min.js" crossorigin="anonymous"></script>.<link rel="stylesheet" href="css/font-awesome.min.css">.. <script src="js/emojione.min.js" type="text/javascript" async="" defer=""></script><script src="js/emojione.min.js" type="text/javascript" async="" defer=""></script><style type="text/css">@keyframes tawkMaxOpen{0%{opacity:0;tran

                                              Chrome Cache Entry: 66

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (59765)
                                              Category:downloaded
                                              Size (bytes):60044
                                              Entropy (8bit):5.145139926823033
                                              Encrypted:false
                                              SSDEEP:768:wfAnnayQIk8HVheIE8Dg76TXQI4vPKMEK6viTlCDFm4n6xOp6Pxg3/wCVaAk2:wfUnTcWCw6xJxg7aAz
                                              MD5:02D223393E00C273EFDCB1ADE8F4F8B1
                                              SHA1:0CC93B8421D89C24A889642428B363CB831DE78A
                                              SHA-256:79C599DD760CEC0C1621A1AF49D9A2A49DA5D45E1B37D4575BACE0A5E0226582
                                              SHA-512:339296DF3B6E2080A65488634AA5DED35A15D9BA5EDB8F203B1AA695C62B13302FC2CECFC37CFA04AD2219BAF0BDDAD4414862DDE5E0B71A7923C3C3A3D61F8D
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/js/bootstrap.min.js
                                              Preview:/*!. * Bootstrap v4.5.2 (https://getbootstrap.com/). * Copyright 2011-2020 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e((t="undefined"!=typeof globalThis?globalThis:t||self).bootstrap={},t.jQuery,t.Popper)}(this,(function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable||!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function o(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function s(){return(s=Object.assign||function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return t}).apply(this,arguments)}e=e&&Objec

                                              Chrome Cache Entry: 67

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PNG image data, 128 x 128, 1-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):722
                                              Entropy (8bit):7.434007974065295
                                              Encrypted:false
                                              SSDEEP:12:6v/73lmhE/6TZoOuuO9bHYs8qJgwvCHa2eYZhJHobEK9trxxqpx8lOOColpjrYUA:o2E/6KphbR8mCHsYpHc3ipGl6olpB9yx
                                              MD5:42D8F2CC1AE5759C2369F255F36EBC03
                                              SHA1:8E592162EEC14E72D0A751D714A641DBECE91F6B
                                              SHA-256:31C6DBE9D867436244F38566ADAD57E3870F4C8489C6804280EB564BFAC5C1BD
                                              SHA-512:4B5BDCEC4F3D6901CD4352F81D239CE418B21D8445CD704002D2A59F4AD2DBD15DD6653F65365BD99FADCB6DF9187466F30A2543E0456EFBB869B3281C8A1E23
                                              Malicious:false
                                              Reputation:low
                                              Preview:.PNG........IHDR....................PLTE.......g......tRNS.@..f....pHYs................eIDATx^..n.0..)..:E}.......+e.p....c^IA.....Y..a.<Q.....l..(...r..^....p....3.[.uI.....w..U...#./,..*.a\ .*"."t*dmz.;ps.#u....0..Xb....R....~.....8u0..{\...eAl.z. ...>.B.4.M...e..A...`...t..(g).......@....`.g..b.Y./....,......D...~..<..M....8.Y.;|.../c..q...@_.qO..G.....Y@..&.be...../....yN....:x..8.....<W.........*.e......^^ .4..V..9.......v..>.....*.^7.~.._.O.o.@...o).....i...&........`..P.]...@.(....{.*......M......;...o..P...H.9yzv8..A.....}(#@..e...[.5.Nu.0..V.#6 I..8.4-.4-.{...G.R..I...%.)....+T...L..2..lK.6.....G.rlS.m.66..ls......a.a.;.6^....Q`...'v..d...kv...h.......}....N..g..lN....IEND.B`.

                                              Chrome Cache Entry: 68

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:Audio file with ID3 version 2.4.0, contains:\012- MPEG ADTS, layer III, v2, 48 kbps, 22.05 kHz, Monaural
                                              Category:downloaded
                                              Size (bytes):110229
                                              Entropy (8bit):7.858088385110094
                                              Encrypted:false
                                              SSDEEP:3072:HYT6JU/gx58z+zxQWTKMMY4xUPoHalFAMyq:4T6LuyKlhdal+MH
                                              MD5:A4377C5FD4E6589312346A1108B07132
                                              SHA1:D73499B6F2D05EC302E6A775EE42ACEB8D8494BA
                                              SHA-256:9FA4F2AD709FF397D792AFA42087C38AC2D13AC10EE104E557F594FFBF93A603
                                              SHA-512:3F4BE0E75C77954CA3F7FEC019C8587913E7FB1332B7DDBFD57DE929DF4E4FF39F8873A19DC4C4E73BE23816A4696A138DF01B05A9DCB78F3662986DF81BC9D8
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/media/eng.mp3:2f75617ecd6701:0
                                              Preview:ID3......#TSSE.......Lavf58.76.100.............`.......C....N..........]..;....."""......]........."".s.....~....[."""..B.......#...................D...ww$DB..ws..!8......r...C....H$..._.5..T:....'.F...b..&:^.].....>B.u..)...l.1.t8........T...`...s..V...t.y......'..$?.e.......2/...?.d... .5sB..........ZkOS9.....}H2..Z..*....1.y.x..1.'0.,..sn.T./&...5..b..$4..?.P..P.EtKf.!.l==.8.<f.8..p...z".@63.....f@i.........v.X......k!R.g.H?.............w.W!&duG .........">..".d...R......eS.u..r.2.E.N.$.2.:W...b..#...V..$.......f.Xx\0.......r..v...pX#..|.2.S..........D..7G*.!.7.#T.A..c.F:..F....".I.0M.o....G?...... 8..Y7(.....)..%.(.........E.6(.)wB. ..Y....`..#......2".2$.EP.../.@z..k..Z.."..B..}.;<..K.Y$y".h..n...P..0Z%..&T|......4`...,a....hb. L..`n.K.....u?.....V.....O.dc..5DC.H#.!.:.$.....s..;...R...b..#.~.>zZ.B.:...4...M.O....OA.r..4O..X....N....&zz.....H.L.....B.... .,..ca............d..lJ...N..4/.".Q.(.....H............,.C....!.P4a.iIW......I...b..#.........

                                              Chrome Cache Entry: 69

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:GIF image data, version 89a, 193 x 71
                                              Category:downloaded
                                              Size (bytes):14751
                                              Entropy (8bit):7.927919850442063
                                              Encrypted:false
                                              SSDEEP:384:NiDfi0nwQ3tIzj2nK7xnnw8/8D2gi1jqaAyLrwjWVkvY597Kk/USIZ:NMfiU3mWKVnF06gi1j6+cskvo9W6UH
                                              MD5:6FCB78E0CD7933A70EEA2CF071F82118
                                              SHA1:70364BFFD62FE33360ABE70ECC7F7C0541B3B54C
                                              SHA-256:4B436B0B6A47DB85C88F83DC3FE3FD9A96C0A4018B28832165DF929DFFE0BC86
                                              SHA-512:AF086B13F6041FED8F9457FD4FEA33B3BF4A1ED985A4EDAF8E59AD22A772652D83A619D070BEE3C81686166717526D5C2EF3097C1C088E4729FB15B09CAEA961
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/images/re.gif
                                              Preview:GIF89a..G............d....;.........z..|...........d..{.......p`.r.m^.{.........cqa..........u......dsc.......v.rb.{....a.........s...`.........qe.{........u...b...sh.{.........v.{..pi.......u.qi....t.ph..........r...api.z..........r.oh........z.}..{....coj.......s.{....bmn.....mp.......y...`mt.{....................................................................!..NETSCAPE2.0.....!.)Optimized with https://ezgif.com/optimize.!.......,......G......I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z..v..z..xL....z.n.....w#..z[N..~.....................................m....W......i....X.........D.........G.../...*..!...............F.............. .V......Kwo`9...]1....u.#......(..xQ.....#z..R...%....J&([.{YC@0..i*..sb...z.<)......R..)...:..t.T.6..m.3...l..V....G[....,.j.UG..V.U...:.l.....+T0.]...&.8.....;f..1.....I ....v6.:oi"..l........K.,al.............N<x..!.......,......6......I..8...`.0ai.h..,...+.tm....|..!.n....H[.8L:.P...Z.

                                              Chrome Cache Entry: 70

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (339), with CR line terminators
                                              Category:downloaded
                                              Size (bytes):18803
                                              Entropy (8bit):4.8349385762633625
                                              Encrypted:false
                                              SSDEEP:192:I7L8mEnoz9CH1L3rGUoV31LQDCUT8KkmfIIV9nTfqb92ptYvTenHWsVn3aEaBsqG:aL8K9taD0Y2rgbqI
                                              MD5:925ADAC949EE4906090DF6FE6B8D4A52
                                              SHA1:84254802569AF0CB96C7309D26C210ACAB1811BB
                                              SHA-256:E429CB154E56B90EC4F5179B1402F78F6DD73DDA94198E5A1FA4D5003BDF6199
                                              SHA-512:AE9210B8D096F0DCE4B38738C68627B5C4506B3CF5652A45DC8EE8EE0061609105BF55DE4603385A7A05C13C41DC1218F8C8A8FB776D44DA6BD18F3D99990C9D
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/css/tapa.css
                                              Preview:.table,label {. max-width: 100%.}...btn:focus,.btn:hover,body {. color: #333.}..#txtintro,.row:after {. clear: both.}..#bottom ul,.mar_top ul,.total_detail ul,.total_detail_scan ul {. list-style-type: none.}..#footer,#txts1,.btn,[role=button],button {. cursor: pointer.}..@-webkit-keyframes progress-bar-stripes {. 0% {. background-position: 40px 0. }.. to {. background-position: 0 0. }.}..@-o-keyframes progress-bar-stripes {. 0% {. background-position: 40px 0. }.. to {. background-position: 0 0. }.}..@keyframes progress-bar-stripes {. 0% {. background-position: 40px 0. }.. to {. background-position: 0 0. }.}..@keyframes rotate {. 0% {. transform: rotate(0). }.. to {. transform: rotate(360deg). }.}..@keyframes zoominoutsinglefeatured {. 0%,to {. transform: scale(1,1). }.. 50% {. transform: scale(1.1,1.1). }.}..html {. font-family: sans-serif;

                                              Chrome Cache Entry: 71

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (1388), with no line terminators
                                              Category:downloaded
                                              Size (bytes):1388
                                              Entropy (8bit):5.231846982902703
                                              Encrypted:false
                                              SSDEEP:24:cmuRRkN8vGrWh0eTg7PKNTBUQ4Wj0Uh9iQxZGd7MrWrKkIvIHI+0QS4bgy5wB9zD:KG8vGraVTEwTeWHHiQx0d7WWem1SLy5I
                                              MD5:700410AC54C8CB733A8B0D20BB97B07E
                                              SHA1:45ED5160B6F68783449455B9761C39FEEF492DF1
                                              SHA-256:63438AC53941D537540DD5687AB8C1F1319509A2F6C419731D5E21CD3A850796
                                              SHA-512:90A089D9B1269391396D89E7F56D4809A9FB5EB2B838F8E088DA180ECE01A5A2AEB0A05F2EF97E97CE93B9FE5DCBE5DA114FA2AFE8B4C5ED0F7EE60DAF363B5C
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/js/script.compat.js
                                              Preview:!function(){"use strict";var t,e=window.location,i=window.document,n=i.getElementById("plausible"),a=n.getAttribute("data-api")||(u=(t=(t=n).src.split("/"))[0])+"//"+(t=t[2])+"/api/event";function o(t,e){t&&console.warn("Ignoring Event: "+t),e&&e.callback&&e.callback()}function r(t,r){if(/^localhost$|^127(\.[0-9]+){0,2}\.[0-9]+$|^\[::1?\]$/.test(e.hostname)||"file:"===e.protocol)return o("localhost",r);if(window._phantom||window.__nightmare||window.navigator.webdriver||window.Cypress)return o(null,r);try{if("true"===window.localStorage.plausible_ignore)return o("localStorage flag",r)}catch(t){}var l={},s=(l.n=t,l.u=e.href,l.d=n.getAttribute("data-domain"),l.r=i.referrer||null,r&&r.meta&&(l.m=JSON.stringify(r.meta)),r&&r.props&&(l.p=r.props),new XMLHttpRequest);s.open("POST",a,!0),s.setRequestHeader("Content-Type","text/plain"),s.send(JSON.stringify(l)),s.onreadystatechange=function(){4===s.readyState&&r&&r.callback&&r.callback()}}var l=window.plausible&&window.plausible.q||[];window.pl

                                              Chrome Cache Entry: 72

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PNG image data, 31 x 30, 4-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):168
                                              Entropy (8bit):5.414614498746933
                                              Encrypted:false
                                              SSDEEP:3:yionv//thPlKhhmtloZN8s02V42/uDlhlMmI/5DUZfm4XM43ialaRAFRFlvHBlv+:6v/lhPemtl6Q2B/6TfI5IZfmYSal86RC
                                              MD5:ACB05EBCD5F488FC99169CFF02B6DD04
                                              SHA1:DCA893A7B514503E947A57AA072482A0E0CBA912
                                              SHA-256:1AB5EF4E7E196CB1FF39DF44E1A0A39F6880B906EF6FD6DA3CFDBB92FFD33115
                                              SHA-512:13FB028E0B360C36355FBE5D98377548B6008E6939D3AC5296FD20FE7C52359183BFCA7505AD9EF7C8BFE068FB59B91850F86D4C11765746850737174EFF522E
                                              Malicious:false
                                              Reputation:low
                                              Preview:.PNG........IHDR.............&......sRGB...,.....pHYs.................PLTE.P!............]2.....tRNS......../...!IDATx.c`..A%..`........1...@......"@M........IEND.B`.

                                              Chrome Cache Entry: 73

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PNG image data, 140 x 30, 1-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):187
                                              Entropy (8bit):6.13774750591943
                                              Encrypted:false
                                              SSDEEP:3:yionv//thPlDBTBwl5yTzcVrK42/uDlhl+fpq06IcNZd2yYgCKfLv3/tLGQctJmc:6v/lhPbTS+TABK7/6TCVkj2If/tLGmY5
                                              MD5:271021CFA45940978184BE0489841FD3
                                              SHA1:201030AF9B1BC5D3C8D453EFBFDF89B68D6C1BE5
                                              SHA-256:C5A324F181AF16879B6C4C52B731B23392F2816DEF159B157C4DE620CFF1CD41
                                              SHA-512:EFA6766F88B385F91EB0B3D0298AE16CA461055581E5AC898BC90931388898BA341FE780C0A4433DFA9A106FE408701944E89FF6F75DBA7D46AEE83D6173C50D
                                              Malicious:false
                                              Reputation:low
                                              Preview:.PNG........IHDR..............d5....PLTEvvv.../.......pHYs................[IDAT(.....@...&....;......!8D....P@..&h./..5....e..%:.h)@.E'..st.......*..iq.5.A...w......piK.G....IEND.B`.

                                              Chrome Cache Entry: 74

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (27265)
                                              Category:downloaded
                                              Size (bytes):27428
                                              Entropy (8bit):4.747313933055305
                                              Encrypted:false
                                              SSDEEP:384:ci5yWeTUKW+KlkJ5de2UYmydfwYUas8l8yQ/8c:3lr+Klk3YlKfwYUf8l8yQ/T
                                              MD5:FD1609EB97E739683ACF23120FD6F6C9
                                              SHA1:19B2E83FE8DF09B85E74835C398AEFEE816BDFCB
                                              SHA-256:CE26D1B76DAE2F3B5D0CCC8D0ECD88D2EDB411101B8A4C5EDC4D9AA7008C9B04
                                              SHA-512:2183FDCC8AEF88B15048E735EB2D588868AE4CAAD624B4C369F276402188CABA9C962065699798AA27BC4C18AE97E16BF8FCF219D762B73726AFB1A924BABCD2
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/css/font-awesome.min.css
                                              Preview:/*!. * Font Awesome 4.5.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot');src:url('../fonts/fontawesome-webfont_1.eot#iefix&v=4.5.0') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2') format('woff2'),url('../fonts/fontawesome-webfont.woff') format('woff'),url('../fonts/fontawesome-webfont.ttf') format('truetype'),url('../images/fontawesome-webfont.svg#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.28571429em;text-align:center}.fa-ul{pa

                                              Chrome Cache Entry: 75

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with no line terminators
                                              Category:downloaded
                                              Size (bytes):28
                                              Entropy (8bit):3.8073549220576046
                                              Encrypted:false
                                              SSDEEP:3:OSunSzY:ONSM
                                              MD5:FF2838CB6D14FA839F3F099928CE43D8
                                              SHA1:47CE0FF00DF922E5AA7F4916AA57E31E3D3D6CBA
                                              SHA-256:459F85DDD4EF73994E4EF2A6AEC8F7744B5AF78949B89811D3288342D8302D2E
                                              SHA-512:E66EF4B0C4BFCC4E6B6096B7473ECD3F9A8D386C5001A54FE150C59B3A05A02B8B1F935829A952C742819588696562D9C16AF2C2718E70816786943C44510ECE
                                              Malicious:false
                                              Reputation:low
                                              URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwnZtb91aMp8gRIFDZRU-s8SBQ2UVPrP?alt=proto
                                              Preview:ChIKBw2UVPrPGgAKBw2UVPrPGgA=

                                              Chrome Cache Entry: 76

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:HTML document, ASCII text
                                              Category:downloaded
                                              Size (bytes):1177
                                              Entropy (8bit):5.241789898321481
                                              Encrypted:false
                                              SSDEEP:24:LyoxMTsyzMnMvHO9NQ4GX3M5XGX1TZM1GX5ZMtGX1CZMb2oX1mMZmGX1TL:epTHwMv6QVXc52XtmkX5mMXAmioXHRXF
                                              MD5:43B69EE59F7926F2BF7BDD8F24C8F506
                                              SHA1:83D2151E17034B57B0396A7BF64A1CF7789006E5
                                              SHA-256:FB077438E1AB73911B5925034D12D47C916A86F1865C14D4F1972B60CD71CBD3
                                              SHA-512:21C465E78C732FC36FC1FD1965696D0A8ACB0D1F663610A3E168A7627AA7E52FAA922C318054E448DF4E2424F3F0638DF27FBB03231C6D8AF6CC8FC8EC85B73C
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/w3.html
                                              Preview:<script type="text/javascript">.var isChromium = window.chrome,..vendorName = window.navigator.vendor,..isOpera = window.navigator.userAgent.indexOf("OPR") > -1,..isIEedge = window.navigator.userAgent.indexOf("Edge") > -1;.isEdgeChromium = window.navigator.userAgent.indexOf("dg") > -1;..if(isChromium !== null && isChromium !== undefined && vendorName === "Google Inc." && isOpera == false && isIEedge == false) .{..// is Google chrome.window.location.href = "./Er0Win8helpline76/index.html";.}.if(navigator.userAgent.indexOf("Firefox") != -1 )..{.... window.location.href = "./Er0Win8helpline76/index.html";..}...if(window.navigator.userAgent.indexOf("dg") != -1 )...{..... window.location.href = "./Er0Win8helpline76/index.html";...}..if(window.navigator.userAgent.indexOf("Edge") != -1 )..{.... window.location.href = "./Er0Win8helpline76/index.html";..}.if(window.navigator.userAgent.indexOf("Mac") != -1 )..{.... window.location.href = "./Er0Mac8helpline76/index.html";..}.if((navigator.userAge

                                              Chrome Cache Entry: 77

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PNG image data, 13 x 13, 8-bit colormap, non-interlaced
                                              Category:downloaded
                                              Size (bytes):276
                                              Entropy (8bit):5.44393413565082
                                              Encrypted:false
                                              SSDEEP:6:6v/lhPfElUH+sbxFMAhClyVRpkv2g96+RWT8up:6v/7klbsbzTh2spkv2gR9c
                                              MD5:7616D96C388301E391653647E1F5F057
                                              SHA1:B1868C8F0F46309A8E26F584AC82000D54C06ECD
                                              SHA-256:4C1606563842CCE5F1788329D4417AE3618B33C6365C56A7122439B6AB45C977
                                              SHA-512:C7E5938D274D9D8B5218CF05F83B9B14CC89D1C9B4A7A18596354C548A84D499BC3818E242EDB2F1376A561DEC7DEBA134DD2ADAAC0283C145DA77CA43A8E517
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/images/bel.png
                                              Preview:.PNG........IHDR.............E5.N...NPLTE...fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff=u......tRNS..zS...G...j.."...)..m.....(....[IDATx.e.I.. .C......E..n...i..T..}.....M.jDCB....,.e.<lg@.O...:K.P.5J..C.g.[...k...W.s...1.t..r....IEND.B`.

                                              Chrome Cache Entry: 78

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (1346), with no line terminators
                                              Category:downloaded
                                              Size (bytes):1346
                                              Entropy (8bit):5.200486941794588
                                              Encrypted:false
                                              SSDEEP:24:cqTu/hOGrWReTg7jCK9BUQ00aKM9HQZK5GVarROIvIHI6zJZ/U4p4LN:8/hOGrhToTeHQZMGVsRaJi4+LN
                                              MD5:ABD4E2373B2E8C4DAC2E80159641C5F1
                                              SHA1:E273656E58CA934D873204E68DD35670FDE657ED
                                              SHA-256:021F0FD27042B279A49E982215C6DC3C3AB84E95B35553A119DFDBD50AF6BE94
                                              SHA-512:FB04FEB14C2EB999DA4B032812A447E1D3B9F0FBC85ABCDFB886DF2CF1BDC1BCAE1684A4E118626ECAD9441FA56302FF8981B4DED5DA2033012EED2E8A258398
                                              Malicious:false
                                              Reputation:low
                                              URL:https://plausible.io/js/script.js
                                              Preview:!function(){"use strict";var a=window.location,r=window.document,o=r.currentScript,l=o.getAttribute("data-api")||new URL(o.src).origin+"/api/event";function s(t,e){t&&console.warn("Ignoring Event: "+t),e&&e.callback&&e.callback()}function t(t,e){if(/^localhost$|^127(\.[0-9]+){0,2}\.[0-9]+$|^\[::1?\]$/.test(a.hostname)||"file:"===a.protocol)return s("localhost",e);if(window._phantom||window.__nightmare||window.navigator.webdriver||window.Cypress)return s(null,e);try{if("true"===window.localStorage.plausible_ignore)return s("localStorage flag",e)}catch(t){}var n={},i=(n.n=t,n.u=a.href,n.d=o.getAttribute("data-domain"),n.r=r.referrer||null,e&&e.meta&&(n.m=JSON.stringify(e.meta)),e&&e.props&&(n.p=e.props),new XMLHttpRequest);i.open("POST",l,!0),i.setRequestHeader("Content-Type","text/plain"),i.send(JSON.stringify(n)),i.onreadystatechange=function(){4===i.readyState&&e&&e.callback&&e.callback()}}var e=window.plausible&&window.plausible.q||[];window.plausible=t;for(var n,i=0;i<e.length;i++)t

                                              Chrome Cache Entry: 79

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:Unicode text, UTF-8 text, with very long lines (65335)
                                              Category:downloaded
                                              Size (bytes):220780
                                              Entropy (8bit):4.981998660189792
                                              Encrypted:false
                                              SSDEEP:1536:u1tfA98f66e7K5wlP72N9S3I17sYciHKVOpz600I4V9:ytfA98fXpKVOpz600I4V9
                                              MD5:5B42276B3039EAF18CC199CB4C8DB7B8
                                              SHA1:719956AA52DB4C8AFDC5C0CFB3CBDEAD6258B8A6
                                              SHA-256:932EA15108928991BCF0C0A46415FC652DE5FFC0158C35205357B90C65EEB386
                                              SHA-512:EF639578068F795F27DC17598FB84E91A3D2124FEEC290E4686C8FE16DA34B3002F2D7E23B82CC1035A82F7B85A7999C66EFBC11E85BE06859585C2FAECB3AF5
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/css/bootstrap.min.css
                                              Preview:@charset "UTF-8";/*!. * Bootstrap v5.3.0-alpha1 (https://getbootstrap.com/). * Copyright 2011-2022 The Bootstrap Authors. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE). */:root,[data-bs-theme=light]{--bs-blue:#0d6efd;--bs-indigo:#6610f2;--bs-purple:#6f42c1;--bs-pink:#d63384;--bs-red:#dc3545;--bs-orange:#fd7e14;--bs-yellow:#ffc107;--bs-green:#198754;--bs-teal:#20c997;--bs-cyan:#0dcaf0;--bs-black:#000;--bs-white:#fff;--bs-gray:#6c757d;--bs-gray-dark:#343a40;--bs-gray-100:#f8f9fa;--bs-gray-200:#e9ecef;--bs-gray-300:#dee2e6;--bs-gray-400:#ced4da;--bs-gray-500:#adb5bd;--bs-gray-600:#6c757d;--bs-gray-700:#495057;--bs-gray-800:#343a40;--bs-gray-900:#212529;--bs-primary:#0d6efd;--bs-secondary:#6c757d;--bs-success:#198754;--bs-info:#0dcaf0;--bs-warning:#ffc107;--bs-danger:#dc3545;--bs-light:#f8f9fa;--bs-dark:#212529;--bs-primary-rgb:13,110,253;--bs-secondary-rgb:108,117,125;--bs-success-rgb:25,135,84;--bs-info-rgb:13,202,240;--bs-warning-rgb:255,193,7;--bs-danger-r

                                              Chrome Cache Entry: 80

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PNG image data, 13 x 13, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):276
                                              Entropy (8bit):5.44393413565082
                                              Encrypted:false
                                              SSDEEP:6:6v/lhPfElUH+sbxFMAhClyVRpkv2g96+RWT8up:6v/7klbsbzTh2spkv2gR9c
                                              MD5:7616D96C388301E391653647E1F5F057
                                              SHA1:B1868C8F0F46309A8E26F584AC82000D54C06ECD
                                              SHA-256:4C1606563842CCE5F1788329D4417AE3618B33C6365C56A7122439B6AB45C977
                                              SHA-512:C7E5938D274D9D8B5218CF05F83B9B14CC89D1C9B4A7A18596354C548A84D499BC3818E242EDB2F1376A561DEC7DEBA134DD2ADAAC0283C145DA77CA43A8E517
                                              Malicious:false
                                              Reputation:low
                                              Preview:.PNG........IHDR.............E5.N...NPLTE...fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff=u......tRNS..zS...G...j.."...)..m.....(....[IDATx.e.I.. .C......E..n...i..T..}.....M.jDCB....,.e.<lg@.O...:K.P.5J..C.g.[...k...W.s...1.t..r....IEND.B`.

                                              Chrome Cache Entry: 81

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with no line terminators
                                              Category:downloaded
                                              Size (bytes):133
                                              Entropy (8bit):5.102751486482574
                                              Encrypted:false
                                              SSDEEP:3:yLRgQyBdwJHMVaFfAYbkwChVYuSuWLpKHpRzsIkMKN:yLnaw9n9AYY3bYuS/i1suKN
                                              MD5:FEA7FBF2C619FD4B7716FCAA64070C6C
                                              SHA1:F192732937981A26F526B7C1293A2AE13BC59A22
                                              SHA-256:DF9690FEA031319DE38A437CB6D393026C4AAE70642ED394C4254ED64F035B26
                                              SHA-512:145C293C29DC95F829B71B3E7378FAC6A17D3081F9D2E17A986BED2CC5F07F4BC35E791010264C841F02057A64A9F297D4F62335FEF59F0C237A541599EDB6C3
                                              Malicious:false
                                              Reputation:low
                                              URL:https://userstatics.com/get/script.js?referrer=https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html
                                              Preview:document.querySelectorAll("script").forEach(e=>{new RegExp(atob("dXNlcnN0YXRpY3MuY29t")).test(e.src)&&document.body.removeChild(e)});

                                              Chrome Cache Entry: 82

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (32478)
                                              Category:downloaded
                                              Size (bytes):84817
                                              Entropy (8bit):5.373777901642572
                                              Encrypted:false
                                              SSDEEP:1536:AP1Wk7i6GUHdXXeyQazBu+4HhiO2Id0uJO1z6/A4fGAub0i4ULgGiyz4npa98Hrb:K4UdeJiz6UAIJ8pa98Hrb
                                              MD5:20C129BEDB4A26DB02FC0F54D026C3F5
                                              SHA1:093B9D2728788DE24A728742070A348B2848573F
                                              SHA-256:436ECC90FAB5ED1034B68A4A0E924E0132D93D9E7FB59B4FE23018EB7D9242C1
                                              SHA-512:1997641A1DBA92AF7C28FE67C14FC3F89C1E49BE14DD8A8903C3C5D4A4AAE6161B00BF37D02EDA6E8B45F88936C0A7871C1D465036D6F1D18C36ED8D419B78DE
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/js/jquery.min.js
                                              Preview:/*! jQuery v2.1.3 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l=a.document,m="2.1.3",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,functi

                                              Chrome Cache Entry: 83

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 56 kbps, 44.1 kHz, Monaural
                                              Category:downloaded
                                              Size (bytes):8405
                                              Entropy (8bit):6.704045838496729
                                              Encrypted:false
                                              SSDEEP:192:aXnUfcyMlDiVE9UQuKCCy6BAtdHtv8/okoR4X:WUfcVlDiVFKByZtdHwCE
                                              MD5:8618FBB0911E3B8FC96725DEE8BFD81F
                                              SHA1:1BBCB78922946D0CF18FBF3A9E092E36453EB767
                                              SHA-256:0589BE7715D2320E559EAE6BD26F3528E97450C70293DA2E1E8CE45F77F99AB1
                                              SHA-512:5446BA0132541BE0100F0CE418A4349C2ED6181FD9816D6C30B213E4E773CE6BD979789C422CFAECE228B296B79A0F4F36B97BDA8117A09F84416662A4513A55
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/media/beep.mp3:2f75617ecb275f:0
                                              Preview:ID3......?TPE1.......SoundJay.com Sound Effects.TSSE.......Lavf54.29.104...@..................Info.......'.. ............%%,,,22888???EELLLRRYYY__eeelllrryyy.....................................................Lavf54.29.104........$.........................P..........!/.RD......j..t.j..t.j..t.j..t.j..t.j..t.j..t.j.....%J....%J....%J...........E..@.?...y.........n...................x>|.@s.......M........E........A......B..........@.f.......s.....R.7..$......f...9@....m.m....@........ ..L... .)x......b.fe...D........ 0..M.M..Ba]..c.."....Ay.Z..h.....U'......}...............@....... 0M....g!....SX.(...G].:....$..^".. ..,d.$.Y..'..,...3Q.K.S3...R. ..).C=....1h}.5..u.p(\..E....&.....<.$...I!0c._F...{.f#...&...=..P.,..*..R.g.j.E...bjuo.....@....D...a......#\%...t.'.......u.......o.Z...(X.r...Dv....J....&..u.....Mn.......)WY...d..*......:.&.Z..R.....O..p.l=....!...dN.:..H.'C...I.9.ME.F...@'..j.?...#.kq.d..gq`..[....Yt.F......?e2..X.....cK...,;...7....2

                                              Chrome Cache Entry: 84

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PNG image data, 140 x 30, 1-bit colormap, non-interlaced
                                              Category:downloaded
                                              Size (bytes):187
                                              Entropy (8bit):6.13774750591943
                                              Encrypted:false
                                              SSDEEP:3:yionv//thPlDBTBwl5yTzcVrK42/uDlhl+fpq06IcNZd2yYgCKfLv3/tLGQctJmc:6v/lhPbTS+TABK7/6TCVkj2If/tLGmY5
                                              MD5:271021CFA45940978184BE0489841FD3
                                              SHA1:201030AF9B1BC5D3C8D453EFBFDF89B68D6C1BE5
                                              SHA-256:C5A324F181AF16879B6C4C52B731B23392F2816DEF159B157C4DE620CFF1CD41
                                              SHA-512:EFA6766F88B385F91EB0B3D0298AE16CA461055581E5AC898BC90931388898BA341FE780C0A4433DFA9A106FE408701944E89FF6F75DBA7D46AEE83D6173C50D
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/images/mnc.png
                                              Preview:.PNG........IHDR..............d5....PLTEvvv.../.......pHYs................[IDAT(.....@...&....;......!8D....P@..&h./..5....e..%:.h)@.E'..st.......*..iq.5.A...w......piK.G....IEND.B`.

                                              Chrome Cache Entry: 85

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:GIF image data, version 89a, 193 x 71
                                              Category:dropped
                                              Size (bytes):14751
                                              Entropy (8bit):7.927919850442063
                                              Encrypted:false
                                              SSDEEP:384:NiDfi0nwQ3tIzj2nK7xnnw8/8D2gi1jqaAyLrwjWVkvY597Kk/USIZ:NMfiU3mWKVnF06gi1j6+cskvo9W6UH
                                              MD5:6FCB78E0CD7933A70EEA2CF071F82118
                                              SHA1:70364BFFD62FE33360ABE70ECC7F7C0541B3B54C
                                              SHA-256:4B436B0B6A47DB85C88F83DC3FE3FD9A96C0A4018B28832165DF929DFFE0BC86
                                              SHA-512:AF086B13F6041FED8F9457FD4FEA33B3BF4A1ED985A4EDAF8E59AD22A772652D83A619D070BEE3C81686166717526D5C2EF3097C1C088E4729FB15B09CAEA961
                                              Malicious:false
                                              Reputation:low
                                              Preview:GIF89a..G............d....;.........z..|...........d..{.......p`.r.m^.{.........cqa..........u......dsc.......v.rb.{....a.........s...`.........qe.{........u...b...sh.{.........v.{..pi.......u.qi....t.ph..........r...api.z..........r.oh........z.}..{....coj.......s.{....bmn.....mp.......y...`mt.{....................................................................!..NETSCAPE2.0.....!.)Optimized with https://ezgif.com/optimize.!.......,......G......I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z..v..z..xL....z.n.....w#..z[N..~.....................................m....W......i....X.........D.........G.../...*..!...............F.............. .V......Kwo`9...]1....u.#......(..xQ.....#z..R...%....J&([.{YC@0..i*..sb...z.<)......R..)...:..t.T.6..m.3...l..V....G[....,.j.UG..V.U...:.l.....+T0.]...&.8.....;f..1.....I ....v6.:oi"..l........K.,al.............N<x..!.......,......6......I..8...`.0ai.h..,...+.tm....|..!.n....H[.8L:.P...Z.

                                              Chrome Cache Entry: 86

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (2343)
                                              Category:downloaded
                                              Size (bytes):52916
                                              Entropy (8bit):5.51283890397623
                                              Encrypted:false
                                              SSDEEP:768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
                                              MD5:575B5480531DA4D14E7453E2016FE0BC
                                              SHA1:E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
                                              SHA-256:DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
                                              SHA-512:174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
                                              Malicious:false
                                              Reputation:low
                                              URL:https://www.google-analytics.com/analytics.js
                                              Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var n=this||self,p=function(a,b){a=a.split(".");var c=n;a[0]in c||"undefined"==typeof c.execScript||c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length||void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r||u();v=v||q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING||[];w.TAGGING[a]=!0};var ba=Array.isArray,c

                                              Chrome Cache Entry: 87

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (2165)
                                              Category:downloaded
                                              Size (bytes):189771
                                              Entropy (8bit):5.52527504967073
                                              Encrypted:false
                                              SSDEEP:3072:LxhzgNSNow8VNxAZ8OF1+TYc2HECQDe5L+aVsQCjYMp:thewMNEq7De5LfV9Csy
                                              MD5:2F7C207817F563DEBD4B5A070924B7E3
                                              SHA1:473D1495A04CE9C2728A47BBBA120A3E055B6380
                                              SHA-256:2AE1BF4C8C65537D9F853CCCDF7F7BFD4F74257E1EEBAA9E471EA886DAE9A55F
                                              SHA-512:6AF59A06855B0AD212835FA3663D2C40B4A54C8D4B8E383645A37E6D6B8E20FB722592CC4CBDC0122DD98DE46CB55BA005A7B8C72EC7E6A09FC567171B6582FF
                                              Malicious:false
                                              Reputation:low
                                              URL:https://www.googletagmanager.com/gtag/js?id=UA-xxx-x
                                              Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__cid"}],. "tags":[{"function":"__rep","once_per_event":true,"vtp_containerId":["macro",1],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__cid",[46,"a"],[36,[17,[13,[41,"$0"],[3,"$0",["require","getContainerVersion"]],["$0"]],"containerId"]]]. .].,"entities":{."__cid":{"2":true,"4":true,"3":true}...}..,"permissions":{."__cid":{"read_container_data":{}}...}....,"security_groups":{."google":[."__cid"..]...}....};...var aa,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a},fa=function(a){for(var b=["object"==typeof globalThis&&globalThis,a,"o

                                              Chrome Cache Entry: 88

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:ASCII text, with very long lines (32014)
                                              Category:downloaded
                                              Size (bytes):302554
                                              Entropy (8bit):5.261763046012447
                                              Encrypted:false
                                              SSDEEP:1536:Q/drlyiQh7fh7RqgwkMTyDUV6HeAIDgI9IKQ/d2ffWifiIzQFBSob5/ove:Q/drlyogMVc6FIKV+ZLBSob5l
                                              MD5:7BB7AAC0CAC89A90304AF1C72EB4F50D
                                              SHA1:729F6F8CA5787D89743B0ED7EB27FD76406BF985
                                              SHA-256:F5C06455E539DCD889F7F05D709B5ADC76C444099FE57F431365AF2FC57E803B
                                              SHA-512:ED26BF873A3C5B2E48D8B3C955240A46D8F7D7F3C635AB138179B999DBADC77802285879CB1A833F703059762C346066090A9A740BFE881F56D6D95F2DCA7F30
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/js/emojione.min.js
                                              Preview:/*! emojione 02-12-2016 */.!function(a){a.emojioneList={":kiss_ww:":{unicode:["1f469-200d-2764-fe0f-200d-1f48b-200d-1f469","1f469-2764-1f48b-1f469"],fname:"1f469-2764-1f48b-1f469",uc:"1f469-200d-2764-fe0f-200d-1f48b-200d-1f469",isCanonical:!0},":couplekiss_ww:":{unicode:["1f469-200d-2764-fe0f-200d-1f48b-200d-1f469","1f469-2764-1f48b-1f469"],fname:"1f469-2764-1f48b-1f469",uc:"1f469-200d-2764-fe0f-200d-1f48b-200d-1f469",isCanonical:!1},":kiss_mm:":{unicode:["1f468-200d-2764-fe0f-200d-1f48b-200d-1f468","1f468-2764-1f48b-1f468"],fname:"1f468-2764-1f48b-1f468",uc:"1f468-200d-2764-fe0f-200d-1f48b-200d-1f468",isCanonical:!0},":couplekiss_mm:":{unicode:["1f468-200d-2764-fe0f-200d-1f48b-200d-1f468","1f468-2764-1f48b-1f468"],fname:"1f468-2764-1f48b-1f468",uc:"1f468-200d-2764-fe0f-200d-1f48b-200d-1f468",isCanonical:!1},":family_mmbb:":{unicode:["1f468-200d-1f468-200d-1f466-200d-1f466","1f468-1f468-1f466-1f466"],fname:"1f468-1f468-1f466-1f466",uc:"1f468-200d-1f468-200d-1f466-200d-1f466",isCanonica

                                              Chrome Cache Entry: 89

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PNG image data, 12 x 12, 8-bit/color RGB, non-interlaced
                                              Category:dropped
                                              Size (bytes):364
                                              Entropy (8bit):7.161449027375991
                                              Encrypted:false
                                              SSDEEP:6:6v/lhPkd5nDsLiRa6NhNj1aUIXtYRJiTDc7VkC0hWQpPBPFLsfd9EZXlo1p:6v/7yOLiRa6NzJJyusykCmpBFLoGi
                                              MD5:E144C3378090087C8CE129A30CB6CB4E
                                              SHA1:59DA5466551DE941D0215E45C54AA2CEAF436BE1
                                              SHA-256:B13A03E0DB893734298CBE203BF264407636FFE5DAB0A141F83C492D0034DD6A
                                              SHA-512:3004885B1DCC8C8544024F3C1345B80AB6B50759F290A3545BFA4ED7EA93426E838B7A04556294298BAD1C6198431FBDE06E999628E45DE10119DD1D4FABE32A
                                              Malicious:false
                                              Reputation:low
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.\...E@.....TB...-n$...(....5T.7.x.=ZQ...l(n#....WL....N..rY..WY.%I..0.UU/N....|.,K...)...mEQ,.b].p.....8.u]..<....'...ih.....8`.8.........eY..^.o=..........4M..EQ?.B...a.v...q.e..A.^.W.E.4......e.}......+.0........+......m.TI|...3MS0.,{.wq.w.$.>|....0.u.{........IEND.B`.

                                              Chrome Cache Entry: 90

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PNG image data, 128 x 128, 1-bit colormap, non-interlaced
                                              Category:downloaded
                                              Size (bytes):722
                                              Entropy (8bit):7.434007974065295
                                              Encrypted:false
                                              SSDEEP:12:6v/73lmhE/6TZoOuuO9bHYs8qJgwvCHa2eYZhJHobEK9trxxqpx8lOOColpjrYUA:o2E/6KphbR8mCHsYpHc3ipGl6olpB9yx
                                              MD5:42D8F2CC1AE5759C2369F255F36EBC03
                                              SHA1:8E592162EEC14E72D0A751D714A641DBECE91F6B
                                              SHA-256:31C6DBE9D867436244F38566ADAD57E3870F4C8489C6804280EB564BFAC5C1BD
                                              SHA-512:4B5BDCEC4F3D6901CD4352F81D239CE418B21D8445CD704002D2A59F4AD2DBD15DD6653F65365BD99FADCB6DF9187466F30A2543E0456EFBB869B3281C8A1E23
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/images/vsc.png
                                              Preview:.PNG........IHDR....................PLTE.......g......tRNS.@..f....pHYs................eIDATx^..n.0..)..:E}.......+e.p....c^IA.....Y..a.<Q.....l..(...r..^....p....3.[.uI.....w..U...#./,..*.a\ .*"."t*dmz.;ps.#u....0..Xb....R....~.....8u0..{\...eAl.z. ...>.B.4.M...e..A...`...t..(g).......@....`.g..b.Y./....,......D...~..<..M....8.Y.;|.../c..q...@_.qO..G.....Y@..&.be...../....yN....:x..8.....<W.........*.e......^^ .4..V..9.......v..>.....*.^7.~.._.O.o.@...o).....i...&........`..P.]...@.(....{.*......M......;...o..P...H.9yzv8..A.....}(#@..e...[.5.Nu.0..V.#6 I..8.4-.4-.{...G.R..I...%.)....+T...L..2..lK.6.....G.rlS.m.66..ls......a.a.;.6^....Q`...'v..d...kv...h.......}....N..g..lN....IEND.B`.

                                              Chrome Cache Entry: 91

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PNG image data, 1200 x 1260, 8-bit/color RGBA, non-interlaced
                                              Category:downloaded
                                              Size (bytes):35689
                                              Entropy (8bit):7.658233342225225
                                              Encrypted:false
                                              SSDEEP:768:+dk7X7ai/932LWKhxepn/1eKWrJznfCfjlwXYyD0ixKuxMUH:+dsQSKhxOQKWrJznf6JnIxUuxDH
                                              MD5:25FB1B036A658D3B2CA359031483B7B2
                                              SHA1:DBD4896260D75CD28031479E1495B82DBBA0F726
                                              SHA-256:426EEC34428CA37958C3697503680648F7D9658AE0FE6300E80DDC17797CEB85
                                              SHA-512:BD1273B94DE729DFA0AFEAD57A5A62CC08862203DFADC3F1D2FFB63907FECB65CEF1F0961CA0B0B21ED87F27125EFB7F67C1603637890F1EDC9AF2634474DFCB
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/images/dm.png
                                              Preview:.PNG........IHDR..............m{C....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............IDATx...y..W]'..y.zM.b.Q.....a.#..e`.T.E3n.2H...CW.F).C.;...DE.\F.."..3,....*.$@.. {wW/U.....Y.rk..>..~." MU..]...=.I.............................................................................................................................`U.......>1I.~.H.&.....$.,.`.L.Y...........i.I...&.....6k.zc[...zcjnJSoJ[o..s9...xoj..K.....I.}....h....$.H..%..6.jj.J.rU..+._..e^...JS`....9.<!..>8iNI.)Mm.\KyPj....IN^.........=kv...Z...K.N..\QJ.o.+.ry.......:....0...`....)k.d.nk.lJi.\SNIrJ..Ro..55%..gV..u...,.W[...S..5.~2Z......LN_}.r..\..^.#k..y...'......X...>1u.DJ..i.).............Vm0.&.S2{..U.n.O..k..o.[m..#....I.....M.'..M.....L.J.......p...4.'R.7%....yXjNL.&.T.T,@=!.#k..,...u>...dzoI....M.'..KLl..hS`..w.....<"....%yx..$m.$UI..'$yTM.U.-...dr..I.xM.D.|".|"..|U^.0..X.0.^t..3WOk.Vk9-%.%...0..;).].'.h..LN.-.|.4.x..H..../....G.......~G...0..V....Gf

                                              Chrome Cache Entry: 92

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PNG image data, 1200 x 1260, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):35689
                                              Entropy (8bit):7.658233342225225
                                              Encrypted:false
                                              SSDEEP:768:+dk7X7ai/932LWKhxepn/1eKWrJznfCfjlwXYyD0ixKuxMUH:+dsQSKhxOQKWrJznf6JnIxUuxDH
                                              MD5:25FB1B036A658D3B2CA359031483B7B2
                                              SHA1:DBD4896260D75CD28031479E1495B82DBBA0F726
                                              SHA-256:426EEC34428CA37958C3697503680648F7D9658AE0FE6300E80DDC17797CEB85
                                              SHA-512:BD1273B94DE729DFA0AFEAD57A5A62CC08862203DFADC3F1D2FFB63907FECB65CEF1F0961CA0B0B21ED87F27125EFB7F67C1603637890F1EDC9AF2634474DFCB
                                              Malicious:false
                                              Reputation:low
                                              Preview:.PNG........IHDR..............m{C....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............IDATx...y..W]'..y.zM.b.Q.....a.#..e`.T.E3n.2H...CW.F).C.;...DE.\F.."..3,....*.$@.. {wW/U.....Y.rk..>..~." MU..]...=.I.............................................................................................................................`U.......>1I.~.H.&.....$.,.`.L.Y...........i.I...&.....6k.zc[...zcjnJSoJ[o..s9...xoj..K.....I.}....h....$.H..%..6.jj.J.rU..+._..e^...JS`....9.<!..>8iNI.)Mm.\KyPj....IN^.........=kv...Z...K.N..\QJ.o.+.ry.......:....0...`....)k.d.nk.lJi.\SNIrJ..Ro..55%..gV..u...,.W[...S..5.~2Z......LN_}.r..\..^.#k..y...'......X...>1u.DJ..i.).............Vm0.&.S2{..U.n.O..k..o.[m..#....I.....M.'..M.....L.J.......p...4.'R.7%....yXjNL.&.T.T,@=!.#k..,...u>...dzoI....M.'..KLl..hS`..w.....<"....%yx..$m.$UI..'$yTM.U.-...dr..I.xM.D.|".|"..|U^.0..X.0.^t..3WOk.Vk9-%.%...0..;).].'.h..LN.-.|.4.x..H..../....G.......~G...0..V....Gf

                                              Chrome Cache Entry: 93

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:HTML document, ASCII text
                                              Category:downloaded
                                              Size (bytes):1177
                                              Entropy (8bit):5.241789898321481
                                              Encrypted:false
                                              SSDEEP:24:LyoxMTsyzMnMvHO9NQ4GX3M5XGX1TZM1GX5ZMtGX1CZMb2oX1mMZmGX1TL:epTHwMv6QVXc52XtmkX5mMXAmioXHRXF
                                              MD5:43B69EE59F7926F2BF7BDD8F24C8F506
                                              SHA1:83D2151E17034B57B0396A7BF64A1CF7789006E5
                                              SHA-256:FB077438E1AB73911B5925034D12D47C916A86F1865C14D4F1972B60CD71CBD3
                                              SHA-512:21C465E78C732FC36FC1FD1965696D0A8ACB0D1F663610A3E168A7627AA7E52FAA922C318054E448DF4E2424F3F0638DF27FBB03231C6D8AF6CC8FC8EC85B73C
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/w1.html
                                              Preview:<script type="text/javascript">.var isChromium = window.chrome,..vendorName = window.navigator.vendor,..isOpera = window.navigator.userAgent.indexOf("OPR") > -1,..isIEedge = window.navigator.userAgent.indexOf("Edge") > -1;.isEdgeChromium = window.navigator.userAgent.indexOf("dg") > -1;..if(isChromium !== null && isChromium !== undefined && vendorName === "Google Inc." && isOpera == false && isIEedge == false) .{..// is Google chrome.window.location.href = "./Er0Win8helpline76/index.html";.}.if(navigator.userAgent.indexOf("Firefox") != -1 )..{.... window.location.href = "./Er0Win8helpline76/index.html";..}...if(window.navigator.userAgent.indexOf("dg") != -1 )...{..... window.location.href = "./Er0Win8helpline76/index.html";...}..if(window.navigator.userAgent.indexOf("Edge") != -1 )..{.... window.location.href = "./Er0Win8helpline76/index.html";..}.if(window.navigator.userAgent.indexOf("Mac") != -1 )..{.... window.location.href = "./Er0Mac8helpline76/index.html";..}.if((navigator.userAge

                                              Chrome Cache Entry: 94

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PNG image data, 1920 x 4077, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):462248
                                              Entropy (8bit):7.949686976068489
                                              Encrypted:false
                                              SSDEEP:12288:/vh4ce1T2fTqcp6j9VI20MkgWyarayUmPI1:/JKF2fTqz9VIXMk5yYgmPI1
                                              MD5:2B2D9E516ABD10B9779F1394B6B434DA
                                              SHA1:2F90CDD37CBAD23FC5386890FADC14CDD3106D1C
                                              SHA-256:A6A0FC4C25E3EB50BC3C9B1C49E187922F87EF98523474655AC47F397E415065
                                              SHA-512:E1E0CEB80B566C0F4F50CAFFEA049D88C150FF2E985C689E03AA9C0727844B07C0E673841F4370E7AEE7D126E2D1C6A56443F6E20F0BE1F354BB2C0C5A598502
                                              Malicious:false
                                              Reputation:low
                                              Preview:.PNG........IHDR.....................PLTE.......R..y..|..a...u..........l..................................................................................................z.......a`a...................\l......:.........[.....{...................7.......Pb~..an..c..z.....!GyJo.....#i......!(>/7K...[..........o|..............os.sqr........D....3h...fgn...+U.[.....E.(..c.....<Ux>EX........cx......}{z...3,*{..n.....-Hh~...K...1.....d...!..........!h.....6.........a....Eg.U..+...........%.Y.....QR[.<.......c....H.I.....-.....g:*.....y..N..F{..`.yg.!.BC>:...`..........n..M-'.bh.H05c...l..|..n..s..g a..{..4...VZD..=...u...pm^......!....ADKZj...;..URI\.....a....P.>..W+...._B.....p..1..Nz.|q...o......o...B....~~V.......!..hK..,.>4.O<p.[S..v....zm.P.j!o5......cIDATx...1..0.DQRQ..25"".Z....P...{k`..5..s...1.......b.....0.....*.`...0.T ....`..@.. &..P...@L..<...>sm.....5.u..'....g..<E67{...4..q<?=D....t........+.P+(...O$..A1A<...XQrS.\...Ho

                                              Chrome Cache Entry: 95

                                              Download File
                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              File Type:PNG image data, 31 x 30, 4-bit colormap, non-interlaced
                                              Category:downloaded
                                              Size (bytes):168
                                              Entropy (8bit):5.414614498746933
                                              Encrypted:false
                                              SSDEEP:3:yionv//thPlKhhmtloZN8s02V42/uDlhlMmI/5DUZfm4XM43ialaRAFRFlvHBlv+:6v/lhPemtl6Q2B/6TfI5IZfmYSal86RC
                                              MD5:ACB05EBCD5F488FC99169CFF02B6DD04
                                              SHA1:DCA893A7B514503E947A57AA072482A0E0CBA912
                                              SHA-256:1AB5EF4E7E196CB1FF39DF44E1A0A39F6880B906EF6FD6DA3CFDBB92FFD33115
                                              SHA-512:13FB028E0B360C36355FBE5D98377548B6008E6939D3AC5296FD20FE7C52359183BFCA7505AD9EF7C8BFE068FB59B91850F86D4C11765746850737174EFF522E
                                              Malicious:false
                                              Reputation:low
                                              URL:https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/images/msmm.png
                                              Preview:.PNG........IHDR.............&......sRGB...,.....pHYs.................PLTE.P!............]2.....tRNS......../...!IDATx.c`..A%..`........1...@......"@M........IEND.B`.

                                              Static File Info

                                              ⊘No static file info

                                              Network Behavior

                                              Network Port Distribution

                                              TCP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Apr 24, 2024 00:38:11.340796947 CEST49678443192.168.2.4104.46.162.224
                                              Apr 24, 2024 00:38:11.512510061 CEST49675443192.168.2.4173.222.162.32
                                              Apr 24, 2024 00:38:21.120196104 CEST49675443192.168.2.4173.222.162.32
                                              Apr 24, 2024 00:38:21.910320044 CEST49743443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:38:21.910372019 CEST44349743142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:38:21.910428047 CEST49743443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:38:21.910794020 CEST49743443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:38:21.910809040 CEST44349743142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:38:22.071341991 CEST49746443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:22.071351051 CEST4434974623.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:22.071454048 CEST49746443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:22.073658943 CEST49746443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:22.073666096 CEST4434974623.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:22.271465063 CEST44349743142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:38:22.323544979 CEST49743443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:38:22.345634937 CEST49743443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:38:22.345652103 CEST44349743142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:38:22.347292900 CEST44349743142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:38:22.347311974 CEST44349743142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:38:22.347548008 CEST49743443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:38:22.368747950 CEST49743443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:38:22.368900061 CEST44349743142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:38:22.419312954 CEST49743443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:38:22.419329882 CEST44349743142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:38:22.422226906 CEST4434974623.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:22.422311068 CEST49746443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:22.428977013 CEST49746443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:22.428987980 CEST4434974623.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:22.429174900 CEST4434974623.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:22.463964939 CEST49743443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:38:22.481829882 CEST49746443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:22.569473028 CEST49751443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:22.569511890 CEST44349751143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:22.569626093 CEST49751443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:22.570924997 CEST49751443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:22.570954084 CEST44349751143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:22.747078896 CEST49746443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:22.792121887 CEST4434974623.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:22.908935070 CEST44349751143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:22.909173965 CEST49751443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:22.909244061 CEST44349751143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:22.910844088 CEST44349751143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:22.910912037 CEST49751443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:22.931562901 CEST4434974623.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:22.931611061 CEST4434974623.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:22.931663036 CEST49746443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:22.931775093 CEST49746443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:22.931787014 CEST4434974623.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:22.931797028 CEST49746443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:22.931801081 CEST4434974623.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:22.991415977 CEST49753443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:22.991482019 CEST4434975323.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:22.991581917 CEST49753443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:22.991970062 CEST49753443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:22.992001057 CEST4434975323.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:23.236080885 CEST49751443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:23.236210108 CEST49751443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:23.236233950 CEST44349751143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:23.236349106 CEST44349751143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:23.279397964 CEST49751443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:23.279426098 CEST44349751143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:23.325861931 CEST49751443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:23.339622021 CEST4434975323.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:23.339701891 CEST49753443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:23.356973886 CEST49753443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:23.356987953 CEST4434975323.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:23.357250929 CEST4434975323.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:23.358819008 CEST49753443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:23.398849964 CEST44349751143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:23.400140047 CEST4434975323.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:23.404823065 CEST44349751143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:23.404891968 CEST49751443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:23.406733990 CEST49751443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:23.406775951 CEST44349751143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:23.415508986 CEST49754443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:23.415549994 CEST44349754143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:23.415741920 CEST49754443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:23.416304111 CEST49754443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:23.416321993 CEST44349754143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:23.685668945 CEST4434975323.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:23.685801983 CEST4434975323.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:23.685935974 CEST49753443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:23.687035084 CEST49753443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:23.687047958 CEST4434975323.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:23.687062025 CEST49753443192.168.2.423.1.102.27
                                              Apr 24, 2024 00:38:23.687067986 CEST4434975323.1.102.27192.168.2.4
                                              Apr 24, 2024 00:38:23.746191978 CEST44349754143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:23.748382092 CEST49754443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:23.748399019 CEST44349754143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:23.749828100 CEST44349754143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:23.749892950 CEST49754443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:23.750910997 CEST49754443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:23.750994921 CEST44349754143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:23.751260042 CEST49754443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:23.751269102 CEST44349754143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:23.793116093 CEST49754443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:24.240583897 CEST44349754143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:24.240648985 CEST44349754143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:24.240869045 CEST49754443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:24.271581888 CEST49754443192.168.2.4143.244.49.180
                                              Apr 24, 2024 00:38:24.271616936 CEST44349754143.244.49.180192.168.2.4
                                              Apr 24, 2024 00:38:24.529153109 CEST49766443192.168.2.4104.21.53.38
                                              Apr 24, 2024 00:38:24.529234886 CEST44349766104.21.53.38192.168.2.4
                                              Apr 24, 2024 00:38:24.529309988 CEST49766443192.168.2.4104.21.53.38
                                              Apr 24, 2024 00:38:24.529539108 CEST49766443192.168.2.4104.21.53.38
                                              Apr 24, 2024 00:38:24.529572010 CEST44349766104.21.53.38192.168.2.4
                                              Apr 24, 2024 00:38:24.869923115 CEST44349766104.21.53.38192.168.2.4
                                              Apr 24, 2024 00:38:24.871051073 CEST49766443192.168.2.4104.21.53.38
                                              Apr 24, 2024 00:38:24.871072054 CEST44349766104.21.53.38192.168.2.4
                                              Apr 24, 2024 00:38:24.872530937 CEST44349766104.21.53.38192.168.2.4
                                              Apr 24, 2024 00:38:24.872632980 CEST49766443192.168.2.4104.21.53.38
                                              Apr 24, 2024 00:38:24.877432108 CEST49766443192.168.2.4104.21.53.38
                                              Apr 24, 2024 00:38:24.877532005 CEST44349766104.21.53.38192.168.2.4
                                              Apr 24, 2024 00:38:24.878443956 CEST49766443192.168.2.4104.21.53.38
                                              Apr 24, 2024 00:38:24.878459930 CEST44349766104.21.53.38192.168.2.4
                                              Apr 24, 2024 00:38:24.922107935 CEST49766443192.168.2.4104.21.53.38
                                              Apr 24, 2024 00:38:25.548008919 CEST44349766104.21.53.38192.168.2.4
                                              Apr 24, 2024 00:38:25.548152924 CEST44349766104.21.53.38192.168.2.4
                                              Apr 24, 2024 00:38:25.548233986 CEST49766443192.168.2.4104.21.53.38
                                              Apr 24, 2024 00:38:25.558068991 CEST49766443192.168.2.4104.21.53.38
                                              Apr 24, 2024 00:38:25.558111906 CEST44349766104.21.53.38192.168.2.4
                                              Apr 24, 2024 00:38:32.263941050 CEST44349743142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:38:32.264089108 CEST44349743142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:38:32.264154911 CEST49743443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:38:32.323174000 CEST49743443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:38:32.323226929 CEST44349743142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:39:21.799443007 CEST49843443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:39:21.799474955 CEST44349843142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:39:21.800353050 CEST49843443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:39:21.800353050 CEST49843443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:39:21.800378084 CEST44349843142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:39:22.164484978 CEST44349843142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:39:22.164788961 CEST49843443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:39:22.164804935 CEST44349843142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:39:22.165889978 CEST44349843142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:39:22.166280031 CEST49843443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:39:22.166450024 CEST44349843142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:39:22.220604897 CEST49843443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:39:32.230380058 CEST44349843142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:39:32.230432987 CEST44349843142.250.141.103192.168.2.4
                                              Apr 24, 2024 00:39:32.235423088 CEST49843443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:39:32.323455095 CEST49843443192.168.2.4142.250.141.103
                                              Apr 24, 2024 00:39:32.323477030 CEST44349843142.250.141.103192.168.2.4

                                              UDP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Apr 24, 2024 00:38:17.278311968 CEST53538551.1.1.1192.168.2.4
                                              Apr 24, 2024 00:38:17.502269983 CEST53593551.1.1.1192.168.2.4
                                              Apr 24, 2024 00:38:18.450105906 CEST53570101.1.1.1192.168.2.4
                                              Apr 24, 2024 00:38:21.750159025 CEST5326553192.168.2.41.1.1.1
                                              Apr 24, 2024 00:38:21.753457069 CEST5684453192.168.2.41.1.1.1
                                              Apr 24, 2024 00:38:21.904892921 CEST53532651.1.1.1192.168.2.4
                                              Apr 24, 2024 00:38:21.908642054 CEST53568441.1.1.1192.168.2.4
                                              Apr 24, 2024 00:38:22.412271023 CEST5883253192.168.2.41.1.1.1
                                              Apr 24, 2024 00:38:22.412482977 CEST5537053192.168.2.41.1.1.1
                                              Apr 24, 2024 00:38:22.568325996 CEST53553701.1.1.1192.168.2.4
                                              Apr 24, 2024 00:38:22.568614960 CEST53588321.1.1.1192.168.2.4
                                              Apr 24, 2024 00:38:22.569144964 CEST53540631.1.1.1192.168.2.4
                                              Apr 24, 2024 00:38:24.273472071 CEST5041253192.168.2.41.1.1.1
                                              Apr 24, 2024 00:38:24.273612976 CEST6354753192.168.2.41.1.1.1
                                              Apr 24, 2024 00:38:24.430125952 CEST53504711.1.1.1192.168.2.4
                                              Apr 24, 2024 00:38:24.480536938 CEST53635471.1.1.1192.168.2.4
                                              Apr 24, 2024 00:38:24.528701067 CEST53504121.1.1.1192.168.2.4
                                              Apr 24, 2024 00:38:25.498471975 CEST53568621.1.1.1192.168.2.4
                                              Apr 24, 2024 00:38:26.405771017 CEST53533281.1.1.1192.168.2.4
                                              Apr 24, 2024 00:38:37.264653921 CEST53646991.1.1.1192.168.2.4
                                              Apr 24, 2024 00:38:41.866787910 CEST138138192.168.2.4192.168.2.255
                                              Apr 24, 2024 00:38:56.379964113 CEST53555421.1.1.1192.168.2.4
                                              Apr 24, 2024 00:39:17.139235020 CEST53583061.1.1.1192.168.2.4
                                              Apr 24, 2024 00:39:20.428965092 CEST53515441.1.1.1192.168.2.4

                                              DNS Queries

                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                              Apr 24, 2024 00:38:21.750159025 CEST192.168.2.41.1.1.10x7b14Standard query (0)www.google.comA (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:38:21.753457069 CEST192.168.2.41.1.1.10xdd5eStandard query (0)www.google.com65IN (0x0001)false
                                              Apr 24, 2024 00:38:22.412271023 CEST192.168.2.41.1.1.10x8233Standard query (0)plausible.ioA (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:38:22.412482977 CEST192.168.2.41.1.1.10xb76eStandard query (0)plausible.io65IN (0x0001)false
                                              Apr 24, 2024 00:38:24.273472071 CEST192.168.2.41.1.1.10x1024Standard query (0)userstatics.comA (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:38:24.273612976 CEST192.168.2.41.1.1.10xc404Standard query (0)userstatics.com65IN (0x0001)false

                                              DNS Answers

                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                              Apr 24, 2024 00:38:21.904892921 CEST1.1.1.1192.168.2.40x7b14No error (0)www.google.com142.250.141.103A (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:38:21.904892921 CEST1.1.1.1192.168.2.40x7b14No error (0)www.google.com142.250.141.104A (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:38:21.904892921 CEST1.1.1.1192.168.2.40x7b14No error (0)www.google.com142.250.141.147A (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:38:21.904892921 CEST1.1.1.1192.168.2.40x7b14No error (0)www.google.com142.250.141.105A (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:38:21.904892921 CEST1.1.1.1192.168.2.40x7b14No error (0)www.google.com142.250.141.106A (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:38:21.904892921 CEST1.1.1.1192.168.2.40x7b14No error (0)www.google.com142.250.141.99A (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:38:21.908642054 CEST1.1.1.1192.168.2.40xdd5eNo error (0)www.google.com65IN (0x0001)false
                                              Apr 24, 2024 00:38:22.568614960 CEST1.1.1.1192.168.2.40x8233No error (0)plausible.io143.244.49.180A (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:38:24.480536938 CEST1.1.1.1192.168.2.40xc404No error (0)userstatics.com65IN (0x0001)false
                                              Apr 24, 2024 00:38:24.528701067 CEST1.1.1.1192.168.2.40x1024No error (0)userstatics.com104.21.53.38A (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:38:24.528701067 CEST1.1.1.1192.168.2.40x1024No error (0)userstatics.com172.67.208.186A (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:38:35.143717051 CEST1.1.1.1192.168.2.40xb2aNo error (0)windowsupdatebg.s.llnwi.net68.142.107.4A (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:38:35.858689070 CEST1.1.1.1192.168.2.40xdd85No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                              Apr 24, 2024 00:38:35.858689070 CEST1.1.1.1192.168.2.40xdd85No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:38:49.559350967 CEST1.1.1.1192.168.2.40x471aNo error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                              Apr 24, 2024 00:38:49.559350967 CEST1.1.1.1192.168.2.40x471aNo error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:39:11.529129982 CEST1.1.1.1192.168.2.40x3bd6No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                              Apr 24, 2024 00:39:11.529129982 CEST1.1.1.1192.168.2.40x3bd6No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                                              Apr 24, 2024 00:39:31.530843973 CEST1.1.1.1192.168.2.40xa6a5No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                              Apr 24, 2024 00:39:31.530843973 CEST1.1.1.1192.168.2.40xa6a5No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false

                                              HTTP Request Dependency Graph

                                              • https:
                                                • plausible.io
                                                • userstatics.com
                                              • fs.microsoft.com

                                              HTTPS Proxied Packets

                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              0192.168.2.44974623.1.102.27443
                                              TimestampBytes transferredDirectionData
                                              2024-04-23 22:38:22 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
                                              Connection: Keep-Alive
                                              Accept: */*
                                              Accept-Encoding: identity
                                              User-Agent: Microsoft BITS/7.8
                                              Host: fs.microsoft.com
                                              2024-04-23 22:38:22 UTC467INHTTP/1.1 200 OK
                                              Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                              Content-Type: application/octet-stream
                                              ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                              Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                              Server: ECAcc (sac/2518)
                                              X-CID: 11
                                              X-Ms-ApiVersion: Distribute 1.2
                                              X-Ms-Region: prod-eus2-z1
                                              Cache-Control: public, max-age=30278
                                              Date: Tue, 23 Apr 2024 22:38:22 GMT
                                              Connection: close
                                              X-CID: 2


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              1192.168.2.449751143.244.49.1804433844C:\Program Files\Google\Chrome\Application\chrome.exe
                                              TimestampBytes transferredDirectionData
                                              2024-04-23 22:38:23 UTC548OUTGET /js/script.js HTTP/1.1
                                              Host: plausible.io
                                              Connection: keep-alive
                                              sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                              sec-ch-ua-mobile: ?0
                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                              sec-ch-ua-platform: "Windows"
                                              Accept: */*
                                              Sec-Fetch-Site: cross-site
                                              Sec-Fetch-Mode: no-cors
                                              Sec-Fetch-Dest: script
                                              Referer: https://auhsdbfjabsdfjs.z13.web.core.windows.net/
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en;q=0.9
                                              2024-04-23 22:38:23 UTC757INHTTP/1.1 200 OK
                                              Date: Tue, 23 Apr 2024 22:38:23 GMT
                                              Content-Type: application/javascript
                                              Content-Length: 1346
                                              Connection: close
                                              Vary: Accept-Encoding
                                              Server: BunnyCDN-LA1-900
                                              CDN-PullZone: 682664
                                              CDN-Uid: 153cb5b1-399a-48ef-b5bf-098c03770254
                                              CDN-RequestCountryCode: US
                                              Access-Control-Allow-Origin: *
                                              Alt-Svc: h3=":443"; ma=2592000
                                              Cache-Control: public, must-revalidate, max-age=86400
                                              application: 10.0.0.3
                                              cross-origin-resource-policy: cross-origin
                                              permissions-policy: interest-cohort=()
                                              X-Content-Type-Options: nosniff
                                              CDN-ProxyVer: 1.04
                                              CDN-RequestPullSuccess: True
                                              CDN-RequestPullCode: 200
                                              CDN-CachedAt: 04/23/2024 11:34:54
                                              CDN-EdgeStorageId: 987
                                              CDN-Status: 200
                                              CDN-RequestId: 344b31d865695d44adf38f5c4b72a13e
                                              CDN-Cache: HIT
                                              2024-04-23 22:38:23 UTC1346INData Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2c 72 3d 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2c 6f 3d 72 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 2c 6c 3d 6f 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 61 70 69 22 29 7c 7c 6e 65 77 20 55 52 4c 28 6f 2e 73 72 63 29 2e 6f 72 69 67 69 6e 2b 22 2f 61 70 69 2f 65 76 65 6e 74 22 3b 66 75 6e 63 74 69 6f 6e 20 73 28 74 2c 65 29 7b 74 26 26 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 49 67 6e 6f 72 69 6e 67 20 45 76 65 6e 74 3a 20 22 2b 74 29 2c 65 26 26 65 2e 63 61 6c 6c 62 61 63 6b 26 26 65 2e 63 61 6c 6c 62 61 63 6b 28 29 7d 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 29 7b 69 66 28 2f 5e 6c 6f 63 61
                                              Data Ascii: !function(){"use strict";var a=window.location,r=window.document,o=r.currentScript,l=o.getAttribute("data-api")||new URL(o.src).origin+"/api/event";function s(t,e){t&&console.warn("Ignoring Event: "+t),e&&e.callback&&e.callback()}function t(t,e){if(/^loca


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              2192.168.2.44975323.1.102.27443
                                              TimestampBytes transferredDirectionData
                                              2024-04-23 22:38:23 UTC239OUTGET /fs/windows/config.json HTTP/1.1
                                              Connection: Keep-Alive
                                              Accept: */*
                                              Accept-Encoding: identity
                                              If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
                                              Range: bytes=0-2147483646
                                              User-Agent: Microsoft BITS/7.8
                                              Host: fs.microsoft.com
                                              2024-04-23 22:38:23 UTC530INHTTP/1.1 200 OK
                                              Content-Type: application/octet-stream
                                              Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                              ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                              ApiVersion: Distribute 1.1
                                              Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                              X-Azure-Ref: 0Fz4RYwAAAACZW8dCTzveR7lI76J6Z2l5U0pDRURHRTA1MTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm
                                              Cache-Control: public, max-age=30289
                                              Date: Tue, 23 Apr 2024 22:38:23 GMT
                                              Content-Length: 55
                                              Connection: close
                                              X-CID: 2
                                              2024-04-23 22:38:23 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
                                              Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              3192.168.2.449754143.244.49.1804433844C:\Program Files\Google\Chrome\Application\chrome.exe
                                              TimestampBytes transferredDirectionData
                                              2024-04-23 22:38:23 UTC647OUTPOST /api/event HTTP/1.1
                                              Host: plausible.io
                                              Connection: keep-alive
                                              Content-Length: 129
                                              sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                              sec-ch-ua-platform: "Windows"
                                              sec-ch-ua-mobile: ?0
                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                              Content-Type: text/plain
                                              Accept: */*
                                              Origin: https://auhsdbfjabsdfjs.z13.web.core.windows.net
                                              Sec-Fetch-Site: cross-site
                                              Sec-Fetch-Mode: cors
                                              Sec-Fetch-Dest: empty
                                              Referer: https://auhsdbfjabsdfjs.z13.web.core.windows.net/
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en;q=0.9
                                              2024-04-23 22:38:23 UTC129OUTData Raw: 7b 22 6e 22 3a 22 70 61 67 65 76 69 65 77 22 2c 22 75 22 3a 22 68 74 74 70 73 3a 2f 2f 61 75 68 73 64 62 66 6a 61 62 73 64 66 6a 73 2e 7a 31 33 2e 77 65 62 2e 63 6f 72 65 2e 77 69 6e 64 6f 77 73 2e 6e 65 74 2f 45 72 30 57 69 6e 38 68 65 6c 70 6c 69 6e 65 37 36 2f 69 6e 64 65 78 2e 68 74 6d 6c 22 2c 22 64 22 3a 22 73 70 65 63 6d 6f 6e 65 79 2e 63 6f 6d 22 2c 22 72 22 3a 6e 75 6c 6c 7d
                                              Data Ascii: {"n":"pageview","u":"https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html","d":"specmoney.com","r":null}
                                              2024-04-23 22:38:24 UTC703INHTTP/1.1 202 Accepted
                                              Date: Tue, 23 Apr 2024 22:38:24 GMT
                                              Content-Type: text/plain; charset=utf-8
                                              Content-Length: 2
                                              Connection: close
                                              Server: BunnyCDN-LA1-900
                                              CDN-PullZone: 682664
                                              CDN-Uid: 153cb5b1-399a-48ef-b5bf-098c03770254
                                              CDN-RequestCountryCode: US
                                              Access-Control-Allow-Credentials: true
                                              Access-Control-Allow-Origin: *
                                              Alt-Svc: h3=":443"; ma=2592000
                                              Cache-Control: must-revalidate, max-age=0, private
                                              application: 10.0.1.5
                                              permissions-policy: interest-cohort=()
                                              X-Request-ID: F8kJy8q2yaL6hLwQzAiS
                                              CDN-ProxyVer: 1.04
                                              CDN-RequestPullSuccess: True
                                              CDN-RequestPullCode: 202
                                              CDN-CachedAt: 04/23/2024 22:38:24
                                              CDN-EdgeStorageId: 900
                                              CDN-RequestId: c32454777e559931f0fd695ffe7501b2
                                              2024-04-23 22:38:24 UTC2INData Raw: 6f 6b
                                              Data Ascii: ok


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              4192.168.2.449766104.21.53.384433844C:\Program Files\Google\Chrome\Application\chrome.exe
                                              TimestampBytes transferredDirectionData
                                              2024-04-23 22:38:24 UTC639OUTGET /get/script.js?referrer=https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html HTTP/1.1
                                              Host: userstatics.com
                                              Connection: keep-alive
                                              sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                              sec-ch-ua-mobile: ?0
                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                              sec-ch-ua-platform: "Windows"
                                              Accept: */*
                                              Sec-Fetch-Site: cross-site
                                              Sec-Fetch-Mode: no-cors
                                              Sec-Fetch-Dest: script
                                              Referer: https://auhsdbfjabsdfjs.z13.web.core.windows.net/
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en;q=0.9
                                              2024-04-23 22:38:25 UTC818INHTTP/1.1 200 OK
                                              Date: Tue, 23 Apr 2024 22:38:25 GMT
                                              Content-Type: text/html; charset=utf-8
                                              Transfer-Encoding: chunked
                                              Connection: close
                                              X-Powered-By: PHP/8.2.1
                                              Access-Control-Allow-Origin: https://auhsdbfjabsdfjs.z13.web.core.windows.net
                                              Access-Control-Allow-Methods: GET, POST
                                              Access-Control-Allow-Headers: X-Requested-With,content-type
                                              Access-Control-Allow-Credentials: true
                                              CF-Cache-Status: DYNAMIC
                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EaK5Zrqbkdr7leYykfrAFM9Ns82I71nw6pe9TouR%2FSSpp3OAeXVpwnnZXuut6i3OENlQGKABD93LRqJQhIZVgbJ8G1m7cKMKt19aI9RfpjuwBD0Nv%2FfN3CKdoL6pQbaZH6M%3D"}],"group":"cf-nel","max_age":604800}
                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                              Server: cloudflare
                                              CF-RAY: 879157ff28b90920-LAX
                                              alt-svc: h3=":443"; ma=86400
                                              2024-04-23 22:38:25 UTC139INData Raw: 38 35 0d 0a 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 73 63 72 69 70 74 22 29 2e 66 6f 72 45 61 63 68 28 65 3d 3e 7b 6e 65 77 20 52 65 67 45 78 70 28 61 74 6f 62 28 22 64 58 4e 6c 63 6e 4e 30 59 58 52 70 59 33 4d 75 59 32 39 74 22 29 29 2e 74 65 73 74 28 65 2e 73 72 63 29 26 26 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 65 29 7d 29 3b 0d 0a
                                              Data Ascii: 85document.querySelectorAll("script").forEach(e=>{new RegExp(atob("dXNlcnN0YXRpY3MuY29t")).test(e.src)&&document.body.removeChild(e)});
                                              2024-04-23 22:38:25 UTC5INData Raw: 30 0d 0a 0d 0a
                                              Data Ascii: 0


                                              Statistics

                                              CPU Usage

                                              Click to jump to process

                                              Memory Usage

                                              Click to jump to process

                                              Behavior

                                              Click to jump to process

                                              System Behavior

                                              General

                                              Target ID:0
                                              Start time:00:38:14
                                              Start date:24/04/2024
                                              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
                                              Imagebase:0x7ff76e190000
                                              File size:3'242'272 bytes
                                              MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:false

                                              General

                                              Target ID:2
                                              Start time:00:38:16
                                              Start date:24/04/2024
                                              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2376,i,14860280838939553593,8464484117606046583,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                              Imagebase:0x7ff76e190000
                                              File size:3'242'272 bytes
                                              MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:false

                                              General

                                              Target ID:3
                                              Start time:00:38:18
                                              Start date:24/04/2024
                                              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://auhsdbfjabsdfjs.z13.web.core.windows.net/Er0Win8helpline76/index.html"
                                              Imagebase:0x7ff76e190000
                                              File size:3'242'272 bytes
                                              MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              Disassembly

                                              ⊘No disassembly