Windows Analysis Report
https://m.exactag.com/ai.aspx?tc=d9886728bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Aempireglass.ae/real/60920//anJhZGtlQGdwYWxhYi5jb20=

Overview

General Information

Sample URL:	https://m.exactag.com/ai.aspx?tc=d9886728bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Aempireglass.ae/real/60920//anJhZGtlQGdwYWxhYi5jb20=
Analysis ID:	1438588

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

LLM detected suspicious URL

LLM detected suspicious webpage text

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

LLM detected suspicious URL

Source: https://gopowerssolutions.com/?abnhljlk&email=jradke@gpalab.com

LLM: Score: 7 Reasons: The URL in question shows signs of typosquatting, with the domain name 'gopowerssolutions.com' differing slightly from the legitimate domain 'gopowertools.com'. Additionally, the presence of a suspicious parameter 'abnhljlk' in the URL may indicate an attempt to obfuscate the true intent of the site. The email address 'jradke@gpalab.com' may also be a target of phishing or other malicious activities. It is recommended to exercise caution when accessing this URL. DOM: 1.1.pages.csv

LLM detected suspicious webpage text

Source: https://gopowerssolutions.com/?abnhljlk&email=jradke@gpalab.com

LLM: Score: 7 Reasons: The text contains indicators of a potential phishing site. The text mentions the need for email address verification and the modification of contact details, which is a common tactic used by phishers to trick users into providing sensitive information. The URL provided also has suspicious parameters and does not match the name of the company mentioned in the text. DOM: 1.2.pages.csv

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.7:443 -> 192.168.2.17:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.21.200:443 -> 192.168.2.17:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.208.109:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.208.109:443 -> 192.168.2.17:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49748 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.222.123
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.222.123
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.122.249
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.122.249
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.7
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.7
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88

Source: global traffic	DNS traffic detected: DNS query: m.exactag.com
Source: global traffic	DNS traffic detected: DNS query: empireglass.ae
Source: global traffic	DNS traffic detected: DNS query: gopowerssolutions.com
Source: global traffic	DNS traffic detected: DNS query: static.nc-img.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.namecheap.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.7:443 -> 192.168.2.17:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.21.200:443 -> 192.168.2.17:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.208.109:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.208.109:443 -> 192.168.2.17:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49748 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.win@16/22@16/148

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://m.exactag.com/ai.aspx?tc=d9886728bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Aempireglass.ae/real/60920//anJhZGtlQGdwYWxhYi5jb20=
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1872,i,16412441582020803288,5321101291447823665,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1872,i,16412441582020803288,5321101291447823665,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.16.99.56	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.14.227	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.217.99	unknown	United States	15169	GOOGLEUS	false
142.251.211.228	www.google.com	United States	15169	GOOGLEUS	false
74.125.142.84	unknown	United States	15169	GOOGLEUS	false
104.18.172.57	unknown	United States	13335	CLOUDFLARENETUS	false
85.14.248.91	tp-emea.exactag.com	Germany	24961	MYLOC-ASIPBackboneofmyLocmanagedITAGDE	false
198.54.126.64	empireglass.ae	United States	22612	NAMECHEAP-NETUS	false
142.250.217.110	unknown	United States	15169	GOOGLEUS	false
142.251.215.238	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
198.54.117.242	gopowerssolutions.com	United States	22612	NAMECHEAP-NETUS	true

Private

IP
192.168.2.17
192.168.2.4

Contacted Domains

Name	IP	Active
empireglass.ae	198.54.126.64	true
www.google.com	142.251.211.228	true
gopowerssolutions.com	198.54.117.242	true
tp-emea.exactag.com	85.14.248.91	true
www.namecheap.com	unknown	unknown
static.nc-img.com	unknown	unknown
m.exactag.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://empireglass.ae/real/60920//anJhZGtlQGdwYWxhYi5jb20=	false		unknown
https://gopowerssolutions.com/?abnhljlk&email=jradke@gpalab.com	true		unknown

ID:	1438588
Product:	CloudBasic
Start time:	21:39:17
Start date:	08.05.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 18:39:48 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	0E4A980A4071AF02FD2E85CD2A21A98B	61FD21C7749F6870FC3B1F5CADB206E586F6DA9D	B0FA4C829B3E35AD05D37E92A18DE8B351763CE98F82802DFAB3649CED6C0CC1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 18:39:48 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	B27A0A72ECECED5B5F601BA73E5DDF66	54376889C150EC921AAAC6347638F06CA01A6EDE	56ADDED660ECA4AE2E3C675F0B74A2DB8C8338A0C7A2DB4CDA0684ADF3A10C62
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	F321C152E93C91313191E049B8140398	8DC3BF7BD6AC67CD87117AE431FF6797A50A4BD6	7060EDA4AE337A3F84F8C7BA2BE425E63057732D68C4296367EF4EB9836CDD81
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 18:39:48 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	35C9A8E6658E21E5D81B75200776931D	AC2C808E914B1103F1A3EBEECAE6A1956C65E5A9	26EEB93E28BEF33235CCE4B992D903ADB80B160D1724A222A9999356EE972E85
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 18:39:48 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	CCA249F7F56936C413EB0809652D813A	89A334C5CE1CA57EB36E02F4481C661DB3412CFC	9F0B1D5BA28A3E4F06CA2C2CA30BEB3C4B3968B57CB9B67C5D2CB0B334FE3E8D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 18:39:48 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	399ED6FBB774F534DD27DCAD9A8DE321	32CC3E70514F8B5D42556FCE9193307EEAD469B7	BDA2E1CA77177FE71D425E526BB1EB43109B56A167121CDF7B4E4455E2214C0F
Chrome Cache Entry: 76	Web Open Font Format (Version 2), TrueType, length 20848, version 1.0	96DD56EBB50AA0150F6630360D8D69CF	8ADA6284514DB2F56A084733EED649B9C7D41F1F	93467F75842330C3502FC0268A7A62151F3744221CA7FFA6DC5057DAC4A64CEE
Chrome Cache Entry: 77	Unicode text, UTF-8 text, with very long lines (36846)	BBB0A7562A948CA06BCEBB419B7B31FA	C2BF2B3B01D60231D96D422FB1E93EB9871A1F78	9C0BD44B3D16140158EB5F52B28E48CBDFDB7215B06DFEEB2CD07078361E1016
Chrome Cache Entry: 78	Web Open Font Format (Version 2), TrueType, length 26180, version 1.0	C1D44D108721DDDBCC98281FE137CDA6	D98C5F9985A4DF573BF8E406E84152A5AC94B186	7BE1913E58996BC81CB052E9914CB492D0ACF125434ED1DDF0144D8A93189DFF
Chrome Cache Entry: 79	HTML document, Unicode text, UTF-8 text, with very long lines (34346)	A48BEA4C3F4EDA08651339E896681DF3	E15E530C98402D2209B5892208AEA6CBEC62C4F6	3DF613821B24AC57470CA4EAA3F494BBFF19FC6D0A28DE3950065FB1ABF9117D
Chrome Cache Entry: 80	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	168AA475EC312D6C7A976BA66EF4E982	32C327AE4CA72AAE61CF5FE5929A8950503F28D5	CBBDA36462BD705A3377CC1A607DB2382C033161E16C56A8AADFE93F292874E0
Chrome Cache Entry: 81	ASCII text, with very long lines (65536), with no line terminators	6EB4134F13E2F1D3B205B790D90ACBC5	DB4420C5EE3E21902BB620CF6897E46A31B6B630	9436E0161212285124586ACE8780B12FE73D8145F7D3D7B73EF2F352F0E934E4
Chrome Cache Entry: 82	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel	25BBCC12F8B02E6442D1BD713DEFB81B	CACE8A1C9B2D39718A2965F068982BBF5509C2B9	8625166490607FD513AEF4A7B29927F616B8537D2602CB6B4AA00935CD5639F6
Chrome Cache Entry: 84	PNG image data, 219 x 43, 8-bit colormap, non-interlaced	4072D8D7BFCA34BE693EB0E573C3B7FE	6B2D4C85693DAA99C1AB6B1D6134F10EC6C13A88	9B69072496FA454B46C2E91EA0BCFEEEDC8A47B268A07863C9EEE88082AA6937
Chrome Cache Entry: 85	Web Open Font Format (Version 2), TrueType, length 18128, version 1.0	B125DC012841FA8A23B98C37499CA5E8	2EA271A80F6A93B9888A34797DB75CEE3E627673	177C4F2826CBC2CC24A9D8018E6C9848ED73178A76FD3AABE99B44EE9458514C
Chrome Cache Entry: 86	Unicode text, UTF-8 text, with very long lines (28860)	0B789B1DA2AE8DAAFB7DBE161F39B121	0F6E5D831CCE369B5AB370C48C0CB94C59068D5C	1230AD30EA6BBCC22F8E08D8A496C66AAC8266DB7A4B72B2C465E0EC89C2C658
Chrome Cache Entry: 88	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	9C3B83FD37AB617BBE55D0FDC0222FA9	880E8419E745EA307CFD7B813B4C53590A893373	7307FF8FCE6BE70DBD3C6EC226910961F863B26F4ABCE662A7F757821E7B9B1F
Chrome Cache Entry: 90	Web Open Font Format (Version 2), TrueType, length 20920, version 1.0	5D9883D92E2EAA724E4E6BEB0EF6728A	3E36376942825AAAA32279175FDB34A4B7BC9435	9C0749DC1DEB3275E1846A462C0DCB83DF2B5FEC30112EACDF5530FA51E3160F
Chrome Cache Entry: 92	Unicode text, UTF-8 text, with very long lines (64880), with no line terminators	A0A0453DC621B1F8D016F838F8C5BFAE	843CEFD6F474940A2790EDC2B5F02A1374A9AD05	7593448EC6C3349C827AAAEB7FD5A8AFBD90B96BE204331C6EB85A31888E9DF8
Chrome Cache Entry: 93	ASCII text, with very long lines (31921), with no line terminators	AB29BFD164428D10F32BC34DF1CAD4ED	2429F345B1AF2501E68724A011BE327B63108EDB	1C4E83808BF28A02416BFB12EE9FAB3C5C55E075376A472D64FCFDBBFAB01A51
Chrome Cache Entry: 94	PNG image data, 1440 x 225, 8-bit/color RGBA, interlaced	369B97593FA5F939CFC8FD458C458737	1BA24E9DCCAD4820D7036D40849F3A3661882B6B	F9B75086BD476ABD93292B689DFF7EEF57D037834E7D0926107421492E22FA2C
Chrome Cache Entry: 96	Web Open Font Format, TrueType, length 35241, version 0.0	79D75C0208E298DCE66A21F77DE03EF7	14541A65F08834B16ACA7D79EB78300A65F1EDA2	6A382A283C77B7E93E7BB5B0B1902242082A4800DAC20DA3334D641093B33005

Windows Analysis Report
https://m.exactag.com/ai.aspx?tc=d9886728bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Aempireglass.ae/real/60920//anJhZGtlQGdwYWxhYi5jb20=

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://m.exactag.com/ai.aspx?tc=d9886728bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Aempireglass.ae/real/60920//anJhZGtlQGdwYWxhYi5jb20=

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://m.exactag.com/ai.aspx?tc=d9886728bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Aempireglass.ae/real/60920//anJhZGtlQGdwYWxhYi5jb20=