IOC Report
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 102
PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 103
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 104
PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 105
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 106
JSON data
downloaded
Chrome Cache Entry: 107
HTML document, Unicode text, UTF-8 text, with very long lines (5348)
downloaded
Chrome Cache Entry: 108
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
dropped
Chrome Cache Entry: 109
ASCII text, with very long lines (34102)
downloaded
Chrome Cache Entry: 110
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 111
Unicode text, UTF-8 (with BOM) text, with very long lines (59783), with CRLF line terminators
downloaded
Chrome Cache Entry: 112
Unicode text, UTF-8 text, with very long lines (65530), with no line terminators
downloaded
Chrome Cache Entry: 113
JSON data
dropped
Chrome Cache Entry: 114
ASCII text, with very long lines (6543), with no line terminators
downloaded
Chrome Cache Entry: 115
ASCII text, with very long lines (31463), with no line terminators
downloaded
Chrome Cache Entry: 116
ASCII text, with very long lines (6543), with no line terminators
dropped
Chrome Cache Entry: 117
ASCII text
downloaded
Chrome Cache Entry: 118
ASCII text, with very long lines (402)
downloaded
Chrome Cache Entry: 119
Unicode text, UTF-8 text, with very long lines (46216), with no line terminators
downloaded
Chrome Cache Entry: 120
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
downloaded
Chrome Cache Entry: 121
ASCII text, with very long lines (32089)
downloaded
Chrome Cache Entry: 122
ASCII text, with very long lines (994), with no line terminators
downloaded
Chrome Cache Entry: 123
Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
downloaded
Chrome Cache Entry: 124
RIFF (little-endian) data, Web/P image, VP8 encoding, 1600x829, Scaling: [none]x[none], YUV color, decoders should clamp
downloaded
Chrome Cache Entry: 125
Unicode text, UTF-8 text, with very long lines (50878)
downloaded
Chrome Cache Entry: 126
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 127
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
downloaded
Chrome Cache Entry: 128
ASCII text, with very long lines (45571)
downloaded
Chrome Cache Entry: 129
ASCII text, with very long lines (61177)
downloaded
Chrome Cache Entry: 130
ASCII text, with very long lines (64612)
downloaded
Chrome Cache Entry: 131
Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
downloaded
Chrome Cache Entry: 132
ASCII text, with very long lines (62385), with no line terminators
downloaded
Chrome Cache Entry: 133
Unicode text, UTF-8 text, with very long lines (28792)
downloaded
Chrome Cache Entry: 134
PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 135
ASCII text, with very long lines (65407)
downloaded
Chrome Cache Entry: 136
Unicode text, UTF-8 text, with very long lines (65520), with no line terminators
downloaded
Chrome Cache Entry: 137
ASCII text, with very long lines (32047)
downloaded
Chrome Cache Entry: 138
PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 139
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 140
Unicode text, UTF-8 text, with very long lines (32153)
downloaded
Chrome Cache Entry: 141
Web Open Font Format, TrueType, length 35900, version 0.0
downloaded
Chrome Cache Entry: 142
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
dropped
Chrome Cache Entry: 143
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 144
Web Open Font Format, TrueType, length 33556, version 0.0
downloaded
Chrome Cache Entry: 145
Unicode text, UTF-8 text, with very long lines (64241)
downloaded
Chrome Cache Entry: 146
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
downloaded
Chrome Cache Entry: 147
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
dropped
Chrome Cache Entry: 148
Web Open Font Format, TrueType, length 41280, version 0.0
downloaded
Chrome Cache Entry: 149
Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
downloaded
Chrome Cache Entry: 150
JPEG image data, baseline, precision 8, 1920x1080, components 3
dropped
Chrome Cache Entry: 151
ASCII text, with very long lines (1245), with no line terminators
downloaded
Chrome Cache Entry: 152
ASCII text, with very long lines (55494), with no line terminators
downloaded
Chrome Cache Entry: 153
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 154
PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 155
ASCII text, with very long lines (1067), with no line terminators
downloaded
Chrome Cache Entry: 156
Web Open Font Format (Version 2), TrueType, length 16708, version 1.0
downloaded
Chrome Cache Entry: 157
JPEG image data, baseline, precision 8, 1920x1080, components 3
downloaded
Chrome Cache Entry: 158
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 159
Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
downloaded
Chrome Cache Entry: 160
Web Open Font Format, TrueType, length 2576, version 1.0
downloaded
Chrome Cache Entry: 161
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 162
ASCII text, with very long lines (1051), with no line terminators
downloaded
Chrome Cache Entry: 163
PNG image data, 1600 x 829, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 164
ASCII text, with very long lines (4281), with no line terminators
downloaded
Chrome Cache Entry: 165
PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 166
PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 167
ASCII text, with very long lines (32960)
downloaded
Chrome Cache Entry: 168
Unicode text, UTF-8 text, with very long lines (65516), with no line terminators
downloaded
Chrome Cache Entry: 169
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 170
Unicode text, UTF-8 text, with very long lines (65456), with no line terminators
downloaded
Chrome Cache Entry: 171
HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
downloaded
Chrome Cache Entry: 172
ASCII text
downloaded
Chrome Cache Entry: 173
ASCII text, with very long lines (42133)
downloaded
Chrome Cache Entry: 174
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped
There are 64 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1960,i,14094271168223606634,4990610382076165336,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/"

URLs

Name
IP
Malicious
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/
malicious
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/
malicious
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/_next/static/chunks/main-19baf03bc40e2456.js
76.76.21.164
https://fonts.bunny.net/inter/files/inter-cyrillic-ext-400-normal.woff2)
unknown
https://outlook.office365.com/owa/prefetch.aspx
https://fonts.bunny.net/inter/files/inter-latin-ext-600-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-cyrillic-ext-700-normal.woff2)
unknown
https://fonts.bunny.net/inter/files/inter-cyrillic-ext-600-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-greek-ext-600-normal.woff)
unknown
https://onedrivewscxcm.top/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_76bb127b5869a5c6b8b3.js
5.230.35.28
https://fonts.bunny.net/inter/files/inter-greek-600-normal.woff)
unknown
https://js.monitor.azure.com/scripts/c/ms.analytics-web-2.min.js
unknown
http://www.json.org/json2.js
unknown
https://fonts.bunny.net/inter/files/inter-vietnamese-400-normal.woff2)
unknown
https://fonts.bunny.net/css2?family=Inter:wght@400;500;600;700;800;900&display=block
156.146.43.65
https://vitals.vercel-insights.com/v1/vitals
35.82.213.187
https://fonts.bunny.net/inter/files/inter-greek-800-normal.woff2)
unknown
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/_next/static/css/1047985ea5c7eeba.css
76.76.21.164
https://assets.popsy.co/rails/active_storage/blobs/proxy/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBMEFiQVE9PSIsImV4cCI6bnVsbCwicHVyIjoiYmxvYl9pZCJ9fQ==--7248df95722704f634bd40512ebc07b8bdfd61e0/content.png
195.181.163.202
https://fonts.bunny.net/inter/files/inter-latin-ext-900-normal.woff)
unknown
https://onedrivewscxcm.top/aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
5.230.35.28
https://fonts.bunny.net/inter/files/inter-greek-500-normal.woff2)
unknown
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/_next/data/NMEE0wbXugyxvsgarKfDI/index.json?domain=herofargwsmnncmwsrcnmwsncmwscnm.popsy.site
76.76.21.123
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/_next/static/chunks/d2cec0cb-11e53867a8f5b280.js
76.76.21.164
https://fonts.bunny.net/inter/files/inter-cyrillic-900-normal.woff)
unknown
https://cdn.jsdelivr.net/npm/@tabler/icons@1.86.0/iconfont/tabler-icons.min.css
151.101.193.229
https://fonts.bunny.net/inter/files/inter-cyrillic-500-normal.woff2)
unknown
https://fonts.bunny.net/inter/files/inter-greek-ext-400-normal.woff2)
unknown
https://fonts.bunny.net/inter/files/inter-latin-500-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-vietnamese-600-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-greek-ext-900-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-greek-900-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-greek-ext-700-normal.woff2)
unknown
https://fonts.bunny.net/inter/files/inter-cyrillic-800-normal.woff2)
unknown
http://github.com/jquery/globalize
unknown
https://fonts.bunny.net/inter/files/inter-latin-600-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-vietnamese-500-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-cyrillic-700-normal.woff2)
unknown
https://onedrivewscxcm.top/favicon.ico
5.230.35.28
https://fonts.bunny.net/inter/files/inter-greek-500-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-latin-700-normal.woff2)
unknown
https://onedrivewscxcm.top/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
5.230.35.28
https://onedrivewscxcm.top/aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
5.230.35.28
https://onedrivewscxcm.top/common/instrumentation/reportbssotelemetry?hpgid=6&hpgact=1800&client-request-id=70163191-abdc-3103-cf54-b3d6bd0ace89&hpgrequestid=45fe0349-92b5-44dc-bfab-bd6cb72c0100
5.230.35.28
https://fonts.bunny.net/inter/files/inter-cyrillic-400-normal.woff2)
unknown
https://onedrivewscxcm.top/
5.230.35.28
https://fonts.bunny.net/inter/files/inter-latin-400-normal.woff2)
unknown
https://github.com/douglascrockford/JSON-js
unknown
https://onedrivewscxcm.top/aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js
5.230.35.28
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/_next/static/NMEE0wbXugyxvsgarKfDI/_buildManifest.js
76.76.21.164
https://fonts.bunny.net/inter/files/inter-vietnamese-700-normal.woff2)
unknown
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/favicon-popsy.png
76.76.21.164
http://www.opensource.org/licenses/mit-license.php)
unknown
https://fonts.bunny.net/inter/files/inter-cyrillic-ext-500-normal.woff2)
unknown
https://fonts.bunny.net/inter/files/inter-cyrillic-ext-800-normal.woff2)
unknown
https://fonts.bunny.net/inter/files/inter-vietnamese-800-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-cyrillic-500-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-latin-800-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-greek-ext-900-normal.woff2)
unknown
https://fonts.bunny.net/inter/files/inter-greek-ext-600-normal.woff2)
unknown
https://onedrivewscxcm.top/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js
5.230.35.28
https://fonts.bunny.net/inter/files/inter-greek-ext-400-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-cyrillic-ext-800-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-latin-ext-400-normal.woff)
unknown
https://lea.verou.me
unknown
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/_next/static/NMEE0wbXugyxvsgarKfDI/_ssgManifest.js
76.76.21.164
https://fonts.bunny.net/inter/files/inter-latin-ext-800-normal.woff2)
unknown
https://fonts.bunny.net/inter/files/inter-latin-ext-500-normal.woff2)
unknown
https://fonts.bunny.net/inter/files/inter-cyrillic-700-normal.woff)
unknown
https://cdn.jsdelivr.net/npm/
unknown
https://fonts.bunny.net/inter/files/inter-vietnamese-800-normal.woff2)
unknown
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/_next/static/chunks/pages/%5Bdomain%5D-176dce6523939524.js
76.76.21.164
https://fonts.bunny.net/inter/files/inter-greek-ext-800-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-greek-900-normal.woff2)
unknown
https://opensource.org/licenses/MIT
unknown
https://fonts.bunny.net/inter/files/inter-vietnamese-400-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-greek-600-normal.woff2)
unknown
https://fonts.bunny.net/inter/files/inter-latin-700-normal.woff)
unknown
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/_next/static/chunks/289-b426069dbd9da4ac.js
76.76.21.164
https://fonts.bunny.net/inter/files/inter-cyrillic-900-normal.woff2)
unknown
https://fonts.bunny.net/inter/files/inter-greek-ext-800-normal.woff2)
unknown
https://login.windows-ppe.net
unknown
https://fonts.bunny.net/inter/files/inter-greek-ext-500-normal.woff2)
unknown
https://fonts.bunny.net/inter/files/inter-cyrillic-400-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-greek-700-normal.woff)
unknown
https://fonts.bunny.net/inter/files/inter-latin-ext-400-normal.woff2)
unknown
https://login.microsoftonline.com
unknown
https://fonts.bunny.net/inter/files/inter-latin-ext-700-normal.woff2)
unknown
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/manifest.json
76.76.21.164
https://tabler.io
unknown
https://fonts.bunny.net/inter/files/inter-cyrillic-ext-400-normal.woff)
unknown
https://onedrivewscxcm.top/aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg
5.230.35.28
https://fonts.bunny.net/inter/files/inter-latin-400-normal.woff)
unknown
https://onedrivewscxcm.top/aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js
5.230.35.28
https://fonts.bunny.net/inter/files/inter-latin-800-normal.woff2)
unknown
https://assets.popsy.co/rails/active_storage/blobs/proxy/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBMEFiQVE
unknown
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/_next/static/chunks/pages/_app-b1d245b62b0e72dd.js
76.76.21.164
https://github.com/tabler/tabler-icons/blob/master/LICENSE
unknown
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/_next/static/css/ed87e102031a9b52.css
76.76.21.164
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/_next/static/chunks/b78f9965-471ff0e9eea1005d.js
76.76.21.164
https://fonts.bunny.net/inter/files/inter-greek-800-normal.woff)
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
jsdelivr.map.fastly.net
151.101.193.229
onedrivewscxcm.top
5.230.35.28
popsyapi.b-cdn.net
195.181.163.202
bg.microsoft.map.fastly.net
199.232.210.172
vitals.vercel-insights.com
35.82.213.187
part-0013.t-0009.t-msedge.net
13.107.213.41
cs1100.wpc.omegacdn.net
152.199.4.44
herofargwsmnncmwsrcnmwsncmwscnm.popsy.site
76.76.21.164
www.google.com
192.178.50.68
bunnyfonts.b-cdn.net
156.146.43.65
fp2e7a.wpc.phicdn.net
192.229.211.108
LYH-efz.ms-acdc.office.com
52.96.104.50
fonts.bunny.net
unknown
cdn.jsdelivr.net
unknown
r4.res.office365.com
unknown
aadcdn.msftauth.net
unknown
assets.popsy.co
unknown
assets.onestore.ms
unknown
i.s-microsoft.com
unknown
ajax.aspnetcdn.com
unknown
outlook.office365.com
unknown
c.s-microsoft.com
unknown
There are 12 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
151.101.193.229
jsdelivr.map.fastly.net
United States
195.181.163.196
unknown
United Kingdom
192.168.2.7
unknown
unknown
52.96.104.50
LYH-efz.ms-acdc.office.com
United States
156.146.43.65
bunnyfonts.b-cdn.net
United States
195.181.163.202
popsyapi.b-cdn.net
United Kingdom
192.178.50.68
www.google.com
United States
76.76.21.123
unknown
United States
76.76.21.164
herofargwsmnncmwsrcnmwsncmwscnm.popsy.site
United States
152.199.4.44
cs1100.wpc.omegacdn.net
United States
5.230.35.28
onedrivewscxcm.top
Germany
239.255.255.250
unknown
Reserved
35.82.213.187
vitals.vercel-insights.com
United States
There are 3 hidden IPs, click here to show them.

DOM / HTML

URL
Malicious
https://onedrivewscxcm.top/?dso62rnpj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NzAxNjMxOTEtYWJkYy0zMTAzLWNmNTQtYjNkNmJkMGFjZTg5JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzU2OTQyODU0NDQ2OS40YTYwZWE4Yy01OGVjLTRkNmItYWU1Ny0xMDNlNzRmNTMyNTkmc3RhdGU9RGNzN0ZvQWdEQURCb01falJGRHlQUTVpYkMyOXZpbG11eTBBc0tZbGxaWUJsVzdreXVKMEdoT1ItRTVEV2d5YnlCWVQ2WllMUjdEaTBYb29QZHhQOXBMdlZ0OXYxQjg=
 malicious
https://onedrivewscxcm.top/?dso62rnpj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NzAxNjMxOTEtYWJkYy0zMTAzLWNmNTQtYjNkNmJkMGFjZTg5JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzU2OTQyODU0NDQ2OS40YTYwZWE4Yy01OGVjLTRkNmItYWU1Ny0xMDNlNzRmNTMyNTkmc3RhdGU9RGNzN0ZvQWdEQURCb01falJGRHlQUTVpYkMyOXZpbG11eTBBc0tZbGxaWUJsVzdreXVKMEdoT1ItRTVEV2d5YnlCWVQ2WllMUjdEaTBYb29QZHhQOXBMdlZ0OXYxQjg=&sso_reload=true
 malicious
https://onedrivewscxcm.top/?dso62rnpj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9NzAxNjMxOTEtYWJkYy0zMTAzLWNmNTQtYjNkNmJkMGFjZTg5JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODQ5NzU2OTQyODU0NDQ2OS40YTYwZWE4Yy01OGVjLTRkNmItYWU1Ny0xMDNlNzRmNTMyNTkmc3RhdGU9RGNzN0ZvQWdEQURCb01falJGRHlQUTVpYkMyOXZpbG11eTBBc0tZbGxaWUJsVzdreXVKMEdoT1ItRTVEV2d5YnlCWVQ2WllMUjdEaTBYb29QZHhQOXBMdlZ0OXYxQjg=&sso_reload=true
 malicious
https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/
https://outlook.office365.com/owa/prefetch.aspx
https://outlook.office365.com/owa/prefetch.aspx
https://outlook.office365.com/owa/prefetch.aspx
https://outlook.office365.com/owa/prefetch.aspx
https://onedrivewscxcm.top/owa/
https://onedrivewscxcm.top/owa/