Edit tour

Windows Analysis Report
https://aa1selfstorage.com/ioeloro/?wptouch_switch=mobile&redirect=//gamma.app/docs/Untitled-fw6wys6ubo63z1u?mode=present#card-wdvd2twm5f65uwl

Overview

General Information

Sample URL:	https://aa1selfstorage.com/ioeloro/?wptouch_switch=mobile&redirect=//gamma.app/docs/Untitled-fw6wys6ubo63z1u?mode=present#card-wdvd2twm5f65uwl
Analysis ID:	1632237
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

Phishing site or detected (based on various text indicators)

Creates files inside the system directory

Deletes files inside the Windows folder

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6832 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7024 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1948,i,3308070665447511035,9601468182166106016,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://aa1selfstorage.com/ioeloro/?wptouch_switch=mobile&redirect=//gamma.app/docs/Untitled-fw6wys6ubo63z1u?mode=present#card-wdvd2twm5f65uwl" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

HTTP traffic detected: POST /api/5776661/envelope/?sentry_key=824b9acd00f449f283554475ff8303bb&sentry_version=7&sentry_client=sentry.javascript.nextjs%2F7.8.0 HTTP/1.1Host: o698378.ingest.sentry.ioConnection: keep-aliveContent-Length: 490sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8sec-ch-ua-mobile: ?0Accept: */*Origin: https://gamma.appSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gamma.app/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 07 Mar 2025 19:16:24 GMTContent-Type: text/htmlContent-Length: 548Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 07 Mar 2025 19:16:30 GMTContent-Type: text/htmlContent-Length: 548Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 07 Mar 2025 19:16:31 GMTContent-Type: application/json; charset=utf-8Content-Length: 67Connection: closeX-Powered-By: ExpressVary: OriginAccess-Control-Allow-Credentials: trueETag: W/"43-VS8Zk4sa6WhQp4atvaFlfxregaw"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 07 Mar 2025 19:16:31 GMTContent-Type: application/json; charset=utf-8Content-Length: 78Connection: closeX-Powered-By: ExpressVary: OriginAccess-Control-Allow-Credentials: trueETag: W/"4e-zsIbJVw6xrpzOUC/ZlEdZPzWsAE"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 07 Mar 2025 19:16:32 GMTContent-Type: text/htmlContent-Length: 548Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 07 Mar 2025 19:16:37 GMTContent-Type: text/htmlContent-Length: 548Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 07 Mar 2025 19:16:37 GMTContent-Type: application/json; charset=utf-8Content-Length: 67Connection: closeX-Powered-By: ExpressVary: OriginAccess-Control-Allow-Credentials: trueETag: W/"43-tRn5gtlf1DvZQJH7tcLHAe4uZTY"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 07 Mar 2025 19:16:39 GMTContent-Type: text/htmlContent-Length: 548Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 07 Mar 2025 19:16:42 GMTContent-Type: text/htmlContent-Length: 548Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 07 Mar 2025 19:16:45 GMTContent-Type: text/htmlContent-Length: 548Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 07 Mar 2025 19:16:53 GMTContent-Type: application/json; charset=utf-8Content-Length: 67Connection: closeX-Powered-By: ExpressVary: OriginAccess-Control-Allow-Credentials: trueETag: W/"43-tRn5gtlf1DvZQJH7tcLHAe4uZTY"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 07 Mar 2025 19:16:55 GMTContent-Type: application/json; charset=utf-8Content-Length: 67Connection: closeX-Powered-By: ExpressVary: OriginAccess-Control-Allow-Credentials: trueETag: W/"43-tRn5gtlf1DvZQJH7tcLHAe4uZTY"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 07 Mar 2025 19:17:24 GMTContent-Type: application/json; charset=utf-8Content-Length: 67Connection: closeX-Powered-By: ExpressVary: OriginAccess-Control-Allow-Credentials: trueETag: W/"43-tRn5gtlf1DvZQJH7tcLHAe4uZTY"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 07 Mar 2025 19:17:27 GMTContent-Type: application/json; charset=utf-8Content-Length: 67Connection: closeX-Powered-By: ExpressVary: OriginAccess-Control-Allow-Credentials: trueETag: W/"43-tRn5gtlf1DvZQJH7tcLHAe4uZTY"

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6832_1966916570

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6832_1966916570

Source: classification engine

Classification label: mal48.phis.win@27/21@82/346

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1948,i,3308070665447511035,9601468182166106016,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://aa1selfstorage.com/ioeloro/?wptouch_switch=mobile&redirect=//gamma.app/docs/Untitled-fw6wys6ubo63z1u?mode=present#card-wdvd2twm5f65uwl"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1948,i,3308070665447511035,9601468182166106016,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://aa1selfstorage.com/ioeloro/?wptouch_switch=mobile&redirect=//gamma.app/docs/Untitled-fw6wys6ubo63z1u?mode=present#card-wdvd2twm5f65uwl	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://aa1selfstorage.com/ioeloro/?wptouch_switch=mobile&redirect=//gamma.app/docs/Untitled-fw6wys6ubo63z1u?mode=present	0%	Avira URL Cloud	safe
https://app.launchdarkly.com/sdk/evalx/61e83cfd8ac5a016e6f0d0b6/contexts/eyJraW5kIjoibXVsdGkiLCJ1c2VyIjp7ImtleSI6ImxkX2Fub255bW91c191c2VyIiwiYW5vbnltb3VzIjp0cnVlLCJpc0dhbW1hRTJFIjpmYWxzZSwiaXNHYW1tYVVzZXIiOmZhbHNlLCJvcmdJZCI6Im5vX29yZ19pZCIsImlzTW9iaWxlRGV2aWNlIjpmYWxzZSwiZGVwbG95VGltZSI6MTc0MTI5MzExOTg4OCwiZGVwbG95bWVudEhhc2giOiIxdjl4Y3JuMjIiLCJicm93c2VyIjp7Im5hbWUiOiJDaHJvbWUiLCJ2ZXJzaW9uIjoiMTM0LjAuMC4wIn0sImxvY2FsZSI6ImVuLVVTIiwibG9jYXRpb24iOnsiY2l0eSI6IkVsIFBhc28iLCJjb3VudHJ5IjoiVVMiLCJsYXRpdHVkZSI6MzEuOTAzMywibG9uZ2l0dWRlIjotMTA2LjQxN319fQ?withReasons=true	0%	Avira URL Cloud	safe
https://app.launchdarkly.com/sdk/evalx/61e83cfd8ac5a016e6f0d0b6/contexts/eyJraW5kIjoibXVsdGkiLCJ1c2VyIjp7ImtleSI6ImxkX2Fub255bW91c191c2VyIiwiYW5vbnltb3VzIjp0cnVlLCJpc0dhbW1hRTJFIjpmYWxzZSwiaXNHYW1tYVVzZXIiOmZhbHNlLCJvcmdJZCI6Im5vX29yZ19pZCIsImlzTW9iaWxlRGV2aWNlIjpmYWxzZSwiZGVwbG95VGltZSI6MTc0MTI5MzExOTg4OCwiZGVwbG95bWVudEhhc2giOiIxdjl4Y3JuMjIifSwid29ya3NwYWNlIjp7ImtleSI6ImFybGI5OXJtZGliNnoydiIsIm5hbWUiOiJEYXJyZWxsIEdhcnRuZXIncyBXb3Jrc3BhY2UiLCJwbGFuIjoicHJvIn19?withReasons=true	0%	Avira URL Cloud	safe
https://clientstream.launchdarkly.com/eval/61e83cfd8ac5a016e6f0d0b6/eyJraW5kIjoibXVsdGkiLCJ1c2VyIjp7ImtleSI6ImxkX2Fub255bW91c191c2VyIiwiYW5vbnltb3VzIjp0cnVlLCJpc0dhbW1hRTJFIjpmYWxzZSwiaXNHYW1tYVVzZXIiOmZhbHNlLCJvcmdJZCI6Im5vX29yZ19pZCIsImlzTW9iaWxlRGV2aWNlIjpmYWxzZSwiZGVwbG95VGltZSI6MTc0MTI5MzExOTg4OCwiZGVwbG95bWVudEhhc2giOiIxdjl4Y3JuMjIifSwid29ya3NwYWNlIjp7ImtleSI6ImFybGI5OXJtZGliNnoydiIsIm5hbWUiOiJEYXJyZWxsIEdhcnRuZXIncyBXb3Jrc3BhY2UiLCJwbGFuIjoicHJvIn19?withReasons=true	0%	Avira URL Cloud	safe
https://clientstream.launchdarkly.com/eval/61e83cfd8ac5a016e6f0d0b6/eyJraW5kIjoibXVsdGkiLCJ1c2VyIjp7ImtleSI6ImxkX2Fub255bW91c191c2VyIiwiYW5vbnltb3VzIjp0cnVlLCJpc0dhbW1hRTJFIjpmYWxzZSwiaXNHYW1tYVVzZXIiOmZhbHNlLCJvcmdJZCI6Im5vX29yZ19pZCIsImlzTW9iaWxlRGV2aWNlIjpmYWxzZSwiZGVwbG95VGltZSI6MTc0MTI5MzExOTg4OCwiZGVwbG95bWVudEhhc2giOiIxdjl4Y3JuMjIifX0?withReasons=true	0%	Avira URL Cloud	safe
https://app.launchdarkly.com/sdk/evalx/61e83cfd8ac5a016e6f0d0b6/contexts/eyJraW5kIjoibXVsdGkiLCJ1c2VyIjp7ImtleSI6ImxkX2Fub255bW91c191c2VyIiwiYW5vbnltb3VzIjp0cnVlLCJpc0dhbW1hRTJFIjpmYWxzZSwiaXNHYW1tYVVzZXIiOmZhbHNlLCJvcmdJZCI6Im5vX29yZ19pZCIsImlzTW9iaWxlRGV2aWNlIjpmYWxzZSwiZGVwbG95VGltZSI6MTc0MTI5MzExOTg4OCwiZGVwbG95bWVudEhhc2giOiIxdjl4Y3JuMjIifX0?withReasons=true	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=91cc6dee4a65238f&lang=auto	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/4z95c/0x4AAAAAAA_1kDLYPl1nWFxU/auto/fbE/new/normal/auto/	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/91cc6dee4a65238f/1741375014907/3e7588869bb11c227e4b351104f24f3feaea5a7f61723bb620db5bd7828bc923/JMxU_tRQrph--ZI	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/91cc6dee4a65238f/1741375014910/xx4qCpYMX669vy1	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1417883426:1741371408:ueQhlMj4mz_4rO0H59x6wkMMGtXZGM-UXzpd7MNBzxM/91cc6dee4a65238f/xwV81aZXAeRcZRWSiPiCd5Ahq.DKBcnYCMHzYMYw950-1741375009-1.1.1.1-mFfqeC0_IsKMpM.5KeswpCV9sVzm0m3o8Tt97vHLsWyQf8Y7alrKRl91nYs6XTs9	0%	Avira URL Cloud	safe
https://nexus-websocket-a.intercom.io/pubsub/5-nX3qUJ7tFqy2S_jQxObOf9WJiSyC1XYov5REaldvqxJ2veSWNIrOeVXM-GMaOyPdbmY8gmlVrJ-nHeJhFzoxKL71Np_g4EiZMZjd?X-Nexus-New-Client=true&X-Nexus-Version=0.14.0&user_role=visitor	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
static.cloudflareinsights.com	104.16.80.73	true	false	high
events.launchdarkly.com	184.72.183.168	true	false	high
a1874.dscg1.akamai.net	2.16.100.106	true	false	high
assets.churnkey.co	172.67.71.250	true	false	high
cdn.gamma.app	104.18.10.200	true	false	high
canny.io	18.66.147.27	true	false	high
gamma.app	104.18.10.200	true	false	high
www.google.com	142.250.186.68	true	false	high
nexus-websocket-a.intercom.io	34.237.73.95	true	false	high
aa1selfstorage.com	173.249.144.177	true	false	unknown
cdn.iframe.ly	108.138.7.117	true	false	high
c3.shared.global.fastly.net	151.101.130.217	true	false	high
js.intercomcdn.com	18.245.46.10	true	false	high
logx.optimizely.com	34.49.241.189	true	false	high
event-tracking-prod-1378027167.us-east-2.elb.amazonaws.com	13.59.10.43	true	false	high
widget.intercom.io	143.204.98.110	true	false	high
clientstream-ga.launchdarkly.com	15.197.213.252	true	false	high
o698378.ingest.sentry.io	34.120.195.249	true	false	high
api.gamma.app	104.18.10.200	true	false	high
api-iam.intercom.io	34.238.5.73	true	false	high
cdn.optimizely.com	104.18.65.57	true	false	high
test.geckoway.de	104.21.112.1	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
a187838077.cdn.optimizely.com	104.18.66.57	true	false	high
imgproxy.gamma.app	104.18.11.200	true	false	high
a1988.dscg1.akamai.net	88.221.110.26	true	false	high
use.typekit.net	unknown	unknown	false	high
clientstream.launchdarkly.com	unknown	unknown	false	high
app.launchdarkly.com	unknown	unknown	false	high
events.api.gamma.app	unknown	unknown	false	high
p.typekit.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015	false		high
https://gamma.app/docs/Untitled-fw6wys6ubo63z1u?mode=present#card-wdvd2twm5f65uwl	true		unknown
https://events.api.gamma.app/v1/user-context	false		high
https://api-iam.intercom.io/messenger/web/launcher_settings	false		high
https://events.api.gamma.app/v1/i	false		high
https://p.typekit.net/p.css?s=1&k=tiw2cwq&ht=tk&f=10870.10872.10873.10874.28201.28205.28208.28222.28225.28226.28227.28238.32157.32159.32163.32164&a=2326044&app=typekit&e=css	false		high
https://o698378.ingest.sentry.io/api/5776661/envelope/?sentry_key=824b9acd00f449f283554475ff8303bb&sentry_version=7&sentry_client=sentry.javascript.nextjs%2F7.8.0	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=91cc6dee4a65238f&lang=auto	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://clientstream.launchdarkly.com/eval/61e83cfd8ac5a016e6f0d0b6/eyJraW5kIjoibXVsdGkiLCJ1c2VyIjp7ImtleSI6ImxkX2Fub255bW91c191c2VyIiwiYW5vbnltb3VzIjp0cnVlLCJpc0dhbW1hRTJFIjpmYWxzZSwiaXNHYW1tYVVzZXIiOmZhbHNlLCJvcmdJZCI6Im5vX29yZ19pZCIsImlzTW9iaWxlRGV2aWNlIjpmYWxzZSwiZGVwbG95VGltZSI6MTc0MTI5MzExOTg4OCwiZGVwbG95bWVudEhhc2giOiIxdjl4Y3JuMjIifX0?withReasons=true	false	Avira URL Cloud: safe	unknown
https://use.typekit.net/tiw2cwq.css	false		high
https://events.api.gamma.app/v1/t	false		high
https://clientstream.launchdarkly.com/eval/61e83cfd8ac5a016e6f0d0b6/eyJraW5kIjoibXVsdGkiLCJ1c2VyIjp7ImtleSI6ImxkX2Fub255bW91c191c2VyIiwiYW5vbnltb3VzIjp0cnVlLCJpc0dhbW1hRTJFIjpmYWxzZSwiaXNHYW1tYVVzZXIiOmZhbHNlLCJvcmdJZCI6Im5vX29yZ19pZCIsImlzTW9iaWxlRGV2aWNlIjpmYWxzZSwiZGVwbG95VGltZSI6MTc0MTI5MzExOTg4OCwiZGVwbG95bWVudEhhc2giOiIxdjl4Y3JuMjIifSwid29ya3NwYWNlIjp7ImtleSI6ImFybGI5OXJtZGliNnoydiIsIm5hbWUiOiJEYXJyZWxsIEdhcnRuZXIncyBXb3Jrc3BhY2UiLCJwbGFuIjoicHJvIn19?withReasons=true	false	Avira URL Cloud: safe	unknown
https://api-iam.intercom.io/messenger/web/metrics	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/4z95c/0x4AAAAAAA_1kDLYPl1nWFxU/auto/fbE/new/normal/auto/	false	Avira URL Cloud: safe	unknown
https://a187838077.cdn.optimizely.com/client_storage/a187838077.html	false		high
https://cdn.optimizely.com/js/20579410255.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/91cc6dee4a65238f/1741375014910/xx4qCpYMX669vy1	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js	false		high
https://nexus-websocket-a.intercom.io/pubsub/5-nX3qUJ7tFqy2S_jQxObOf9WJiSyC1XYov5REaldvqxJ2veSWNIrOeVXM-GMaOyPdbmY8gmlVrJ-nHeJhFzoxKL71Np_g4EiZMZjd?X-Nexus-New-Client=true&X-Nexus-Version=0.14.0&user_role=visitor	false	Avira URL Cloud: safe	unknown
https://app.launchdarkly.com/sdk/evalx/61e83cfd8ac5a016e6f0d0b6/contexts/eyJraW5kIjoibXVsdGkiLCJ1c2VyIjp7ImtleSI6ImxkX2Fub255bW91c191c2VyIiwiYW5vbnltb3VzIjp0cnVlLCJpc0dhbW1hRTJFIjpmYWxzZSwiaXNHYW1tYVVzZXIiOmZhbHNlLCJvcmdJZCI6Im5vX29yZ19pZCIsImlzTW9iaWxlRGV2aWNlIjpmYWxzZSwiZGVwbG95VGltZSI6MTc0MTI5MzExOTg4OCwiZGVwbG95bWVudEhhc2giOiIxdjl4Y3JuMjIiLCJicm93c2VyIjp7Im5hbWUiOiJDaHJvbWUiLCJ2ZXJzaW9uIjoiMTM0LjAuMC4wIn0sImxvY2FsZSI6ImVuLVVTIiwibG9jYXRpb24iOnsiY2l0eSI6IkVsIFBhc28iLCJjb3VudHJ5IjoiVVMiLCJsYXRpdHVkZSI6MzEuOTAzMywibG9uZ2l0dWRlIjotMTA2LjQxN319fQ?withReasons=true	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1	false		high
https://test.geckoway.de/	false		unknown
https://api-iam.intercom.io/messenger/web/ping	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/91cc6dee4a65238f/1741375014907/3e7588869bb11c227e4b351104f24f3feaea5a7f61723bb620db5bd7828bc923/JMxU_tRQrph--ZI	false	Avira URL Cloud: safe	unknown
https://aa1selfstorage.com/ioeloro/?wptouch_switch=mobile&redirect=//gamma.app/docs/Untitled-fw6wys6ubo63z1u?mode=present	false	Avira URL Cloud: safe	unknown
https://app.launchdarkly.com/sdk/evalx/61e83cfd8ac5a016e6f0d0b6/contexts/eyJraW5kIjoibXVsdGkiLCJ1c2VyIjp7ImtleSI6ImxkX2Fub255bW91c191c2VyIiwiYW5vbnltb3VzIjp0cnVlLCJpc0dhbW1hRTJFIjpmYWxzZSwiaXNHYW1tYVVzZXIiOmZhbHNlLCJvcmdJZCI6Im5vX29yZ19pZCIsImlzTW9iaWxlRGV2aWNlIjpmYWxzZSwiZGVwbG95VGltZSI6MTc0MTI5MzExOTg4OCwiZGVwbG95bWVudEhhc2giOiIxdjl4Y3JuMjIifSwid29ya3NwYWNlIjp7ImtleSI6ImFybGI5OXJtZGliNnoydiIsIm5hbWUiOiJEYXJyZWxsIEdhcnRuZXIncyBXb3Jrc3BhY2UiLCJwbGFuIjoicHJvIn19?withReasons=true	false	Avira URL Cloud: safe	unknown
https://events.launchdarkly.com/events/diagnostic/61e83cfd8ac5a016e6f0d0b6	false		high
https://logx.optimizely.com/v1/events	false		high
https://app.launchdarkly.com/sdk/goals/61e83cfd8ac5a016e6f0d0b6	false		high
https://app.launchdarkly.com/sdk/evalx/61e83cfd8ac5a016e6f0d0b6/contexts/eyJraW5kIjoibXVsdGkiLCJ1c2VyIjp7ImtleSI6ImxkX2Fub255bW91c191c2VyIiwiYW5vbnltb3VzIjp0cnVlLCJpc0dhbW1hRTJFIjpmYWxzZSwiaXNHYW1tYVVzZXIiOmZhbHNlLCJvcmdJZCI6Im5vX29yZ19pZCIsImlzTW9iaWxlRGV2aWNlIjpmYWxzZSwiZGVwbG95VGltZSI6MTc0MTI5MzExOTg4OCwiZGVwbG95bWVudEhhc2giOiIxdjl4Y3JuMjIifX0?withReasons=true	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1417883426:1741371408:ueQhlMj4mz_4rO0H59x6wkMMGtXZGM-UXzpd7MNBzxM/91cc6dee4a65238f/xwV81aZXAeRcZRWSiPiCd5Ahq.DKBcnYCMHzYMYw950-1741375009-1.1.1.1-mFfqeC0_IsKMpM.5KeswpCV9sVzm0m3o8Tt97vHLsWyQf8Y7alrKRl91nYs6XTs9	false	Avira URL Cloud: safe	unknown
https://a187838077.cdn.optimizely.com/cdn-cgi/rum?	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
104.18.66.57	a187838077.cdn.optimizely.com	United States	13335	CLOUDFLARENETUS	false
172.217.16.138	unknown	United States	15169	GOOGLEUS	false
173.249.144.177	aa1selfstorage.com	United States	40819	VPSDATACENTERUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.71.250	assets.churnkey.co	United States	13335	CLOUDFLARENETUS	false
104.18.10.200	cdn.gamma.app	United States	13335	CLOUDFLARENETUS	false
151.101.130.217	c3.shared.global.fastly.net	United States	54113	FASTLYUS	false
104.16.80.73	static.cloudflareinsights.com	United States	13335	CLOUDFLARENETUS	false
15.197.213.252	clientstream-ga.launchdarkly.com	United States	7430	TANDEMUS	false
216.58.206.35	unknown	United States	15169	GOOGLEUS	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
142.251.168.84	unknown	United States	15169	GOOGLEUS	false
18.210.207.202	unknown	United States	14618	AMAZON-AESUS	false
34.237.73.95	nexus-websocket-a.intercom.io	United States	14618	AMAZON-AESUS	false
184.72.183.168	events.launchdarkly.com	United States	14618	AMAZON-AESUS	false
34.49.241.189	logx.optimizely.com	United States	2686	ATGS-MMD-ASUS	false
34.238.5.73	api-iam.intercom.io	United States	14618	AMAZON-AESUS	false
104.21.96.1	unknown	United States	13335	CLOUDFLARENETUS	false
108.138.7.117	cdn.iframe.ly	United States	16509	AMAZON-02US	false
142.250.186.99	unknown	United States	15169	GOOGLEUS	false
88.221.110.26	a1988.dscg1.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
2.16.100.106	a1874.dscg1.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
142.250.186.138	unknown	United States	15169	GOOGLEUS	false
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.18.65.57	cdn.optimizely.com	United States	13335	CLOUDFLARENETUS	false
104.21.32.1	unknown	United States	13335	CLOUDFLARENETUS	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
3.138.64.170	unknown	United States	16509	AMAZON-02US	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
13.59.10.43	event-tracking-prod-1378027167.us-east-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
143.204.98.110	widget.intercom.io	United States	16509	AMAZON-02US	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
104.18.11.200	imgproxy.gamma.app	United States	13335	CLOUDFLARENETUS	false
34.120.195.249	o698378.ingest.sentry.io	United States	15169	GOOGLEUS	false
18.66.147.27	canny.io	United States	3	MIT-GATEWAYSUS	false
18.245.46.10	js.intercomcdn.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1632237
Start date and time:	2025-03-07 20:15:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://aa1selfstorage.com/ioeloro/?wptouch_switch=mobile&redirect=//gamma.app/docs/Untitled-fw6wys6ubo63z1u?mode=present#card-wdvd2twm5f65uwl
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@27/21@82/346

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.238, 142.250.186.99, 142.250.186.78, 142.251.168.84, 142.250.185.174, 142.250.185.110, 142.250.186.174, 172.217.16.138
Excluded domains from analysis (whitelisted): fonts.googleapis.com, clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://aa1selfstorage.com/ioeloro/?wptouch_switch=mobile&redirect=//gamma.app/docs/Untitled-fw6wys6ubo63z1u?mode=present#card-wdvd2twm5f65uwl

Created / dropped Files

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 105351
Category:	downloaded
Size (bytes):	33278
Entropy (8bit):	7.992034055903402
Encrypted:	true
SSDEEP:
MD5:	B47D10466CE01B906CF4AAD2F912C4DC
SHA1:	2F541C0105CD35751414445905AEA7F11A62FB0C
SHA-256:	04A3218EA2975D53CCD1F38A1D47337D3E78CF44EAFF75DA8D765B0F1DE3A6A2
SHA-512:	49397727C26290243AB69F56A48CC9630DF609629DA36906FE137F610CC9CF09CDCFB8E88F3901E07AA05FA426534E3B4818A33FC503FD142725939F277C68F5
Malicious:	false
Reputation:	unknown
URL:	https://gamma.app/_next/static/chunks/d08a6a05-cd94e662b24272fc.js?dpl=dpl_AmRPMj9KKeW4g92pz9v8ABm9EUsU
Preview:	............w..(.WD.,..A...4%.......5..#s. .PD....JVD..o?...%9..w:....>....o+qT.e....W.l9....xq.b..~}..wQ....\|.6.j....<.{6......A..~tz...:-....w.qy.G.m..e......(.Gg..";>...k.....v.......<L.^/.....oGiE.=..v^....~....q?./D.TGb....^.w..'...qTE4..H.....a).m..U.4...~.T.F...]R.b.....$.......b0....0-...^......i.......weY.^.U....(.k...Guq...Gy....E&....\|!F..W0.2.%...G.H@.b\.....bQWG.mU...kq...V...^....qa. .z. .z..".j.Q>Z.Y....a}G..T{..\|.......(..SE.V3uy{..v.6."h...g.....J0.[..........J.>....>.{~i../G.R....-.hS.u..GuqF..GU....M0....}...F.\b.(`......`-..7.<^.?.7Ta.....F..,.5tF.<//.k..........t...k...n....S.~....F$.......U..;Sk.....]..:.g.F_kh..%.)/.8(">\|.j.I.._...H.?j...K...Wu"...2.5<>.?F...Y.G.i.x..9.l....o.;.g.km.......b#..Vn&.?>........H..V..0`...T..c.Z{).E.n`...+..%M....b..rQO...4.....~...&.u].p.Ui.d.....U..\j..^.0.#.iS....#..^.k@.X..........j.R.J./ku.;..w...7eZ#B.$.@.ez.-.3.5.-24.....u....1.*.-o.Y.~V.qV.~..y..u...+....._i ....

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 49015
Category:	downloaded
Size (bytes):	18283
Entropy (8bit):	7.9862569179269505
Encrypted:	false
SSDEEP:
MD5:	4FCF94A4BABF752E62F139F9AB0AB9BE
SHA1:	F701851B8E5FF8587A4B584738D6BC7CCAFE55F9
SHA-256:	CCC7CC723AC45635530DB12C0D8F91E6997E3A57C54174E749C61011E8412C4B
SHA-512:	F7A32D7E32B41E0C35A89055588524CA7DD181AAB30A4C6A4F59B1F2A0C7D0C1F859D2B8282790C21B6A56FF6B10F940A7D6FECA9DB45654D5C6A90313ED26AB
Malicious:	false
Reputation:	unknown
URL:	https://gamma.app/_next/static/chunks/3059-8f807437b1210746.js?dpl=dpl_AmRPMj9KKeW4g92pz9v8ABm9EUsU
Preview:	...........ic..(....Y..C.!Z..'...:^.'..K6G.$HbL..I.V$..[..E........P(...B....e{.vnw......f.)M..[.5.....z...eKL.7..5..8.$^....Q%.N.4.V...I.u..N.H#1..L...s.:..8.d$.^.b2l...j5..b..%2r.0j...+....%...\|.;iu....w.m.q.....FQ..X..a...M..<.dbH...L...w.I.X&g....l..)..L..z..q..-c[Y.X:.a.z......8....n6.s.....lE....fKIV<p.&.....6...#y..B..$.....C_.A./....0b...........en.b.>.Ig.M.Jc>7...@DL..s..}.....Z.h.O........{.@U..^.UE$...V.G....(.....^..T..K.F..P.I...(G{yr.t.D.;...~!M...Bx...8.+.....8.za}.f3.S.?.G.V[./.......9M.Qx_.....(...a.S.u+n...(.$a%.E..V.0.Q'm_V<...t..-8.a...mC."...0TBZ.qe8.........4...e2..V...9...HR.B...3B.9.BI..@/.F...2.J.}.#....0i.p.h........B...C...;...Y.Br.R.S.;..T...4...7;4..B/f......]...d.lR#O.D.....3$q....3.%......L.>q..v..QT.....X.^%....].- .....9....Q.#.<.....N..(.)...).b.n...>.......;.7.4......).(....P.:@.....l.........Q.CL .....lf.99.dL..6..L......s.X....d...@..K.M..&.: .;;..dd...v..h.d..)..2._...r."....^F.n..._^..

Chrome Cache Entry: 266

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 1890
Category:	downloaded
Size (bytes):	559
Entropy (8bit):	7.620680650322193
Encrypted:	false
SSDEEP:
MD5:	965447827BAC76D7CBEEB15FA82042D8
SHA1:	353A0047DC336FD13238EAAA966B31045CEB4EB3
SHA-256:	6CE08A638EB15B424E4AD6180D9791B5AC12460F3C2B334C44DBCCB80C92FC2E
SHA-512:	01A1CBC1F8C55F8890D371F27530841F81D125E4DD306D11C63E0FBFFB36791B7DFCE791FC7070122B13F0C451CE4CC41EAB3EA76CE96593486878CCC991936B
Malicious:	false
Reputation:	unknown
URL:	https://gamma.app/_next/static/css/d87801e5487946cc.css?dpl=dpl_AmRPMj9KKeW4g92pz9v8ABm9EUsU
Preview:	...........]k.0....+.#...C.d6.mw...1v..'..,.II.....;..W;)[/va,$.G.....Aw.n....2.m...q...Vt&.....r.....v.8.. .0w..K.......T.Z..#O.2....,./.n?>.1,>.`774..i.K.g....;C..+...HP.?......H...p.3...RG.O.Z.r8.0..H.+..g.....G..j..&j...>..9.WU.3.V...).......m......Z'..NbR.=.U!Q.s..,\|[.MNb.di$.B...2/..":.X_;...kaa... k...WS..U}Q[.P.'.-.......d.M(.FD.2..L.\.?on.....^.a._>....>k.x....*...(M.w.8LZz.{.`.b8....U.v.p......aT....#\|.A(V;)..yE....[...3ob....6.....F...x...P])O".......)..n&.}.....g....+...}.....$.!.M..F....Z?....7....b...

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 29101
Category:	downloaded
Size (bytes):	9639
Entropy (8bit):	7.97609322959389
Encrypted:	false
SSDEEP:
MD5:	DE510C4F833BD1F84DB47F3CC264DF05
SHA1:	DD505ABF281F3F021422592C498A5FAE4622C2C7
SHA-256:	DA6CDBD860A20D023E034811534F93F5AB51038A58725B953EC7A4BD0A5DAFDF
SHA-512:	8B5E2AE6AE645C7E066CE25F5CEDD3343DC48BB0FBFDEE745A7983A401A959747F04A3C9568E27022C9047C60668843BD0836E3AB8B8800D1D0CB7B9EC301726
Malicious:	false
Reputation:	unknown
URL:	https://gamma.app/_next/static/chunks/1970-624d79be9fad65cf.js?dpl=dpl_AmRPMj9KKeW4g92pz9v8ABm9EUsU
Preview:	...........}.s..........z...,.rX..$&~..8......2B".0..........~uo.s....LOO..gV..l...C.....C.`...M..5._.[.....{....8sw..U..dU).ky%.G.....z.#...._.Z~..:{V...r.jI&.<.K.\|V&.>V....d.]g.=<...a.....,.o...=.(.1...[\Y.R..u..a..2Yb....3.u.J7..y.m).f..%.(.7V.\6..%2f.h.....u.7....Ch~.......i;.4r.%.V.h..o......3.....L......'.@"..HS.......0w=c.l..,.K....j.#......uf..hq..z.#....0...&.0W.xf0.~..\h..:.(U....n #.H..I..I.b....c.....an._. Z&..Gu:U.zL.....Q.~-....s..jO.0.Ib...h>.Y\j2k.....<....G/.r.G...FA..8....d....u......F{g..=Zx.....P.\ HU...-...v.+.....p..:.l.vY.I..-......M...J.j.(.....r..Ux.....A.......Lt...)...-...$.vq.~#gb.!-..$. z-.H..!.^.L.5.s6Vi>.#j.7.].d5.!.9..d.T.1...OL.H.m0.!0..l.l..T.d`{.=U...D..).j.:.......R>.7....g0..i.M....B..d...........i..9<.E ....{.S.pg...T...u=C.,.94.#.I.V.g..D}.J....bN%.r...T..Tr.H...v5.Z........l.b$..K9....(..mU7.Q......;.a.'\|6.+gt....^,...x..D.<..6.8T}.\|......G....\|..].q.#.>K..\|..3@(s..@.#.[...g......9..u9.DH.b-

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 22719
Category:	downloaded
Size (bytes):	9232
Entropy (8bit):	7.974927372107927
Encrypted:	false
SSDEEP:
MD5:	267959CFED09CA55B528705B19855988
SHA1:	F5F1C988C861295FDF9A4D006A6086747512143D
SHA-256:	01AB9A05AD17E633E87EBA0DBBE9EB3F8CE5E143EA9FCCBA719A3D66BD8EF6C3
SHA-512:	601E1DDF48E22FCAA288ABB338D76C8A6D8E12A6F64E151A24B43E361E889CF603DB770AB68926E68EF36F2B52803A8C807F12CC964BC73A915F969DC69E3A97
Malicious:	false
Reputation:	unknown
URL:	https://gamma.app/_next/static/chunks/2445-2cebfc2d3c10f6c8.js?dpl=dpl_AmRPMj9KKeW4g92pz9v8ABm9EUsU
Preview:	...........\{w.E...?E..u.I.#..K........b..<^..]..iu..m!..a...2,.Y`..5...0......8..._a.~I..........u..J.[>.....@.)>.....4u..\..\.\.\(.-..[.P.f.+...Ba\|.t...BI@\|.\|..k....vQ..VW-m..}e.0].T........J.x.......\n2..........1....P...d..U.+Y.h.T..r..r..]..4......z..}.p...6..C4Mku.t<j.....f..s.yOUT....P.w..._iR.Xe.<m..l.,..LHX.k...F].....0\..77.8..L!..{.....{{&.R....iR..oR........Y..I.hn..M......G..V....Z.#.3.b...VI...q..1.mz..ZW..-..o.z..).!.l.r.01..s.c.5.b.K......x.....0.zlrr..e=>U..rYO...Y.k!`&.B..SK.X%C.\..3W..-..U.e...IwA.......%...6-..}......_J ..,.e..!.......e.e.#.`ttd....f......TKMX..[.)U...cZ.[##.A..:.}i..Hu9!Y...aR.HA.:..F......IRNH...H..3R....\.....&u.R.%.P.82. ...h!.SjD.\|<.'..NH;.m#yV.qA.4i...y.G..6.k......d...$..N...mX....x.N.t..-.@.....Ca.\.W....uR.....n5...*.@WX.P.R#P.....T..K...h.MR......n.v...`.`....8.g...F1~..H..HW;..M.S......aqZ.,P....m.r..q...B..3.A.JPN#...4...2..h(6....gA.2.91.=::0TE.`8....l0.j...`.3..S.b....... ..n.

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:
MD5:	46DF3E5E2D15256CA16616EBFDA5427F
SHA1:	BE8F9B307E458075DA0D43585A05F1D451469182
SHA-256:	AF3248D0B278571EFF9A22F8ED1CEB54B70D202B44FD70ECA4CA13A5771CECC3
SHA-512:	88FBCC0A92317A0BADE7D4B72C023A16792F3728443075BF4B1767C8A55258836B54D56B24EABE36AE4EF240F796B58B8F1EA10C7E3C146BDE89882FC9ADE302
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIZCZGZeJi2WxS_EgUNkWGVTiGStty94f1gSg==?alt=proto
Preview:	CgkKBw2RYZVOGgA=

Chrome Cache Entry: 270

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.836591668108979
Encrypted:	false
SSDEEP:
MD5:	129ABF301E12DA2879ECA02A1BE6065A
SHA1:	EC9109C291BC83CF628BB091FFA8617CDDBB43E9
SHA-256:	6AEDD7F59ED412B7F9F89CBFFFA28DF97744A820B1B75A339E3A4F9F2AA1F9A9
SHA-512:	0E3AF1215284F47285A4AF248FC7ED85AA0FC461222E7504DB16F610BC81ED3685AFE443325A5DED2BF1CC0E3A1C804693B24116CEECB6D35E61AF65F0A5972F
Malicious:	false
Reputation:	unknown
Preview:	GET query missing.

Chrome Cache Entry: 271

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 6742
Category:	downloaded
Size (bytes):	2674
Entropy (8bit):	7.926462328359525
Encrypted:	false
SSDEEP:
MD5:	632DC3425571B37DFAF1E6EBE4C5C229
SHA1:	DD7EADBFF1382E69A39D00DB0B91F4EC88BD5625
SHA-256:	ECBAE36869E61D6497D01AD64464E597DF6B05410516DDD085A5ECA6150B7307
SHA-512:	160202DB02BDE567DE542072AE24F12E84797CEBBD619B2D1AE29E46F6BA143AD0E1EAE6E05A3E72D3846D01C2D0413B0C7F4DB36E447ABEB567DBB56D408A5C
Malicious:	false
Reputation:	unknown
URL:	https://widget.intercom.io/widget/ihnzqaok
Preview:	...........Y.s.8..+..&.........uK.....0{{Sz..V..-ye.i6...G.G.$.3.@k.z....xdZ.9....qW.DZ4X.x.?..:uW.....V..........".;9......$.XT....(.F..qEe(. lO.&T..0..q..QJ.l..-.......lF..F............:;.)....^,.....:..Os.F..#...T...."q<JDD...n.....(.[...YD......)yyJN.:=;{..=.=....Z....Y........4tg....[.d..].e.g.......2..]W.f...+..(.D..QB...T.`o....O.k`#...h.7......LD.;2.Q..[yw.&.`..k..p%Us.-Q...d.3X...j.9/.).......e...=..).Be..5.e.Lp.f)..CDk.#.g....T..Z.T.+a...M....[{.L1..........Qi{u...H.P,..Z..W........MXH..2.n.X.k...BD[.....Hh.p....f......"..1..mG.8.kE..L.)..]O..A...8\..s7.,.iWJ..M...s\.....^..$.....S....... ......H..n......H.....}G.[KP.7G..(miU.l}.............Oy.\|.Qa..V.K.f8T..d.?+.Zl..A....%%..8n=(H._Q.X.......\|...Q.......zW..&. %..k..n.w^..zH.&.$..Zm...n.........&.....:.m..a....<..S]k..r%.o7...\|...uvT..n...f..b.(F.L.q......&...C....GM!...h.Fv....Hg..B.....R..S..f.LIDe.]#5^.Lm.B&o."...y...3yJD".'...".......f.-e.9.jQ?$.SL._.)L

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 312591
Category:	downloaded
Size (bytes):	82597
Entropy (8bit):	7.997288367454523
Encrypted:	true
SSDEEP:
MD5:	CD7F502F43C956D4505C847B664C9023
SHA1:	31583CE0C1445BADE7A3EBD3BA33878D0FEC5322
SHA-256:	50735EDAD25C99A53ECFC3CC2947A33C7CF69D21CEB08C63994A4963BACE2CC1
SHA-512:	EEB718297C62E11F6D0EAE727CB2DD3F479D7CC1FD7CB1F5BC1A39BE2758DFBD8931C68EB96A195D96707D3DD215B895AAC1E0B34FCDCF326B39EF79D089C666
Malicious:	false
Reputation:	unknown
URL:	https://gamma.app/_next/static/chunks/b13ba9de-693ee4b2b0cb0b28.js?dpl=dpl_AmRPMj9KKeW4g92pz9v8ABm9EUsU
Preview:	............{.G./.>.EM.Z.n......%{..l.`...1.q..$.jU...%$..!....l.6.e$0 ..._<....y.;rK`....'"2...-{....xPWeFfFFFF."+.R-:...u..)G.W..m.-...Y4.....W6.~...-..B..Lm.xYM.......,jH..7c.._.nT.Rnf........Z.x3..G..2..t.n..Z.p.L....t4...p...VV.kd......p.].......w...h..4..W.-.IgL......Mg4..[..~Q:c..eK^Y........t&.....Kgrp.....%.L'V.J...t...5...Mg.p.t.bH,.U......Z.-[...Xk}}-T..K...3=....Y.:..........e.b.......].k..-.....k..J.Nfu<.[Z7........f.L....k.}...Ss$..(E..vV..n....zf}....b...Z.%l.=..?.d...nt...^.p.u../...t.....hd..N.v.N...X...G).q..t..:...)l...^..F..llI/7.S]i...t..tz[....E...i.m..o+..L`#.C5l..6`5.@Ww.wdV.BIas.CrW...........$..~...{...n..S)'cb....k.m.SF..osSz:.#...N..n..;`..dn.m....H.W.,S..I..4....r..;V.G.2.&.Li..D.J..F.V(..H>i..4..m..5.........EM...H....Q-s.af;[].v.t&....E..)o.}-V..N.T.......V........oY.q.".Sz.f.hN ..."4..0....FG..X..:...y]s......S+.I,D3}.b.....7@.v4y.......fP.+...K.YL..p\Q.8&.X.I.<.....~C3s.DY'.{.W...L.71..>...,&..+..}J.MR

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	548
Entropy (8bit):	4.660801881684815
Encrypted:	false
SSDEEP:
MD5:	4B074B0B59693FA9F94FB71B175FB187
SHA1:	0004D4F82B546013424B2E0DE084395071EEF98B
SHA-256:	25FB23868EBF48348F9E438E00CB9B9D9B3A054F32482A781C762CC4F9CC6393
SHA-512:	F928E9FAA0BC776FC5D8A0326981853709D437B7B1C2E238894BFB2ACBB627442C425CBB00D369C52D15876B6C795E67F7580341686696D569A908A6ADD4B444
Malicious:	false
Reputation:	unknown
Preview:	<html>..<head><title>403 Forbidden</title></head>..<body>..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	273630
Entropy (8bit):	7.998944062379399
Encrypted:	true
SSDEEP:
MD5:	29C186F1D728CE552BC5CFAC94814E16
SHA1:	F5FA7C27B33154C0A3D7538D98B7D4A8E29DA1A5
SHA-256:	D5BCE960EB87FA4938AAB71099A5516451D87DFD829DFA41F5479AC2A4D4C507
SHA-512:	409D5C46A9126003BE9F1442428AB406F799DF7D65D9ED2ACC00F66F57648B05ADFE4AB300417A58AD2178B2BCC18F3CFA7A2AD97728D8CA7FF9A1C41C818165
Malicious:	false
Reputation:	unknown
URL:	https://assets.churnkey.co/js/app.js?appId=7blc4aqmp
Preview:	...sA...?l....~..Q..a. ..k.....Jm....^..MU...~..?.....?/0.q.......l.....N...n...^.>.~.......r.rf...`.m6(....Z\.}>.@...h..l..o..z........??_X7WG..\.y.rS...M.4I..7K...1.+.$........OSQ....K.(;..e..h..Xr~4.....1.p@P."r.o..[..j._-..W[[....i.n.!.@yP........G.H.R............iio..o...#.)6.......^......A....}4^...K....wD....7.....F.....QY..VZ.".$TAB.I...Rl.....E.E<......`...A...).e..t-.....`..U..K.-.J.t.1..........\|...w..0yj.}....P`....w...t...HHB.........zj...\....c(.<..<.T..R..S..6I...I......Y_.....4.J..j.#w.....U..Q....}............\......c......#.{f....,s..2 "s9.....d.DDV.p.b.......J.y.A.j..E..".Z.Y.{.(...R.z0..i....}9....c.IA.......u..9.u.-....T........$..>..n........>.Q.IJ.....%=.-P.........V..]6...~..z...^?...d3...'.1\].".R...........!..mw..?.N............}?;...A$7f.O.....9...b...o.........B....B....\0k.. .".+J......]n.{...f.b....\|..n...z .........QJ...bfC.q.v,@......ch.]G..r...r,.....v&.l..b.....+..6Y3j..!.b@$..V...4C...p.....,..R.2,....{s.

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 147052
Category:	downloaded
Size (bytes):	42585
Entropy (8bit):	7.994651806228447
Encrypted:	true
SSDEEP:
MD5:	B1D722A0ACF08C1653C76619A2422A4F
SHA1:	933A5389C2EB44074D635D4DCCEF88F9A2F44142
SHA-256:	15B2FF8B18C88A50CE2B8A879ED2E0DF4207D8B479DCA13368E8A3D4BF593434
SHA-512:	ADD40CB5A1D65F9615ED0A399ED0C0065E0CEF84C4FA0EDE2D143FF235D8AEC95ABBB189E5E2AACD2C946196CE8AC7475932AE9E3FAD5C89A15B9F8EEA16DF0A
Malicious:	false
Reputation:	unknown
URL:	https://gamma.app/_next/static/chunks/3d35b88c.89c8cbcdea31a14b.js?dpl=dpl_AmRPMj9KKeW4g92pz9v8ABm9EUsU
Preview:	............~.6.0......&G.....iM...L.2........Y.)R!)_bk.c.e.h.d..WR...d.9../3m. P(....B..V9k.E.M.k`.,..o..2.\.......o.......i/W.........p.?...v.27q.....M.h..3.9n...}.....kv.9M..!k.q3.HoX9..v.7a...>:e}.........qCx...;.g0[%."J...v...m..8..4.....%....d.0.3.X..F.K...y...?Lm....'6)......U......hC.o...^.....%.. (.,..H.p.%.{A1dA.\|x...c.lZ).`.~\|....+GB 9Y.fW..K......I...{..w........ ;c...r.Q.u..(....5.j.$..Pm...M.M..3...5~M......I.]2..n'C.^%..:.L..?.Y`c. ..yn..3..v\....n.>y.&.S...s....G.<..9..<QK..P.gF...:k]T.Q=7..l.tjO..v.G.h...6......rW...C...\|.r.0.S8..hO...w$%......H.......b.^.w.(+. ..0.D.fA.. .&..0r......Sd.5.....V.t#oe#Q4PC.v1.....A.^.[".5.....Q=.../....=...R@C..f6...3....u](......)...c1..h6m.%...G.T`~2...-C........R.%...(.!i.....?d...^!;~.Nhp.8.E....i.>..a..FS.No..}-.H.M..9H.j.5T....!.71...."...>.V^......s.v...iR@. q_.Y{....c..0........7z.FI..+..g.....a.3...0...f.\|k.).S.0.}]...5..B0. .@...v.7>..)...A.RU.....6/.....{{....j...t.

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 132751
Category:	downloaded
Size (bytes):	39126
Entropy (8bit):	7.9925890716450745
Encrypted:	true
SSDEEP:
MD5:	A61099870400FA2FDECE02D8261A5358
SHA1:	1185393AEDA3CB680CCCC70772A231AE4D686E16
SHA-256:	A9231D4DCDD2F9C324408788A7196AE2B7D29C133AF4DC3752A04DED2EE67DB3
SHA-512:	2A1CFAD0A98E2D676786F9587C9E72DFA318841A9D715166FA7E7102917CD9773934B19657125F41F26CC9566809F674B1EF1532FE1B252DD945A760F0805A3D
Malicious:	false
Reputation:	unknown
URL:	https://gamma.app/_next/static/chunks/main-3f84fac257f7c9f5.js?dpl=dpl_AmRPMj9KKeW4g92pz9v8ABm9EUsU
Preview:	............c.H.(.W.v>.t....j.~..3~-8."^....DH.$.x0..VUwK-!..'9w..=.#..]]].2c........?.M....^.)}......i<2.....;6...?<.M....afLc^....'Fc8.......f.O.Q`4....z......G?....}8..u....d\|.z..5.....~R....(..(y4.f.z<...S..l.....^..-....O......<H.......:j.'.c...<@;<..y.........z:.J4.[s..T..M...w.7J./.....(L..q....jZ.).t.....V0..F.xy.m.a.m.x.....}....n......b.~.......F..l.3...Y....f2..j.......[..?..R..f.Q.>j...n.+P..I{E8T[.8.....&Uw2........?...j...l...L.M.o.-;.....,..{...z).`...c/.z+^...#Lh.7..k..MC=.k.....n..&#...V..>.>..i?...'.Wc.V.U.M...8.?p..6..i......NFQ..*[.....Z....a]._..D.#v...K.s0.s.tkx7........9.Q...-......N.K7..)......-J.Y[_7....>.........S.C.u...[..._.......x....;...Z..@[Q.F.q..A.T`.?.9.L.q...0.`.J.VBj.H...+...U.j. R....#...}7.q..#Ry..!.U..0.$zT[...X..3..p>..lS.....w...ja.....n.w08qc~.......5\|.T.'2.....-.......z..}f... ....E}.F......n<.L(.Ta(..&.A~...aX.\;..:.4.w....r+.....n.....Z_....^V.%..].N.......h.`.9..I.%.6.9..;..........pw..\|.f.M.

Chrome Cache Entry: 279

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 9207
Category:	downloaded
Size (bytes):	3917
Entropy (8bit):	7.946006965039788
Encrypted:	false
SSDEEP:
MD5:	3C7E53CEC5A6115844D2C1F132E31379
SHA1:	4D59506E59CA44163B09BD825E81F0B3752742C1
SHA-256:	541512F97A4CE9725A0766BD62BB192CD9F391B0337AC53F0DDC879657ECF6C0
SHA-512:	D75F1F34D503A33B68BC945A7901FF54E76E28D0A8C7A83D99C7859FD1E1733FD48EAC8D5F99D2213228C909A8137797E8536193B335A5422FEEE219CC4A9828
Malicious:	false
Reputation:	unknown
URL:	https://gamma.app/_next/static/chunks/8c469d57-125fc4e271dbee1b.js?dpl=dpl_AmRPMj9KKeW4g92pz9v8ABm9EUsU
Preview:	...........Yio....._A(_......b.l&.$.....$k...=...p4.l.....Wd..'....M..bU...9y.m....r.?...n{u>\|.={...-/.n.....O....^.1...]<{..._/~..g....\l...?l.7...?\|...<...z.p-...o._Kk....W.]....:[...?H.f..o.(....$.......6Jc...C..~...FZ..C.;_....Z....6v..._.7w......m./....\|sv...oo..\o..\_.w.....6..U.e..[.z.89...dqrj.w..!..2k.....CPf.%}\F..K\.Ch...........}<y..b{....7...L..`..&sN^c.CQ..v......Y..\..(k.....!..3.Q.,.?<.b.C...=........ ....I......>..&..\.UNC..fk........Bm.p5.S.<..w....q...../..b.R..Xs(.$z.=....o..3......V1...CY......B....B...fh- .....^.."..R;..1..-..Ja.PM...K....j.wk...I.[I.....l.8..E...t6...`@[.....^.h..y...H.a....P.F.....vy.7W.6......!.`.../\.P.....d.......Wl..i.+.ct.9.<..!n....m.@#N...U......ymqb..-.[......T.KC..\|RE.j.ftL......A.l%4A%..DQ........U...<n....=)..Pv3j.C.\|&2d.L....bGZ..i@Ec.8.......-C.:..6`g....@.Pi.*D.I......+[.._...IP.........v0...Q$<..._mv......Q..1..l...tV.j.~.c.L]y@......]x7M#....#W.\...........8;.a......T....\4t.5N@.

Chrome Cache Entry: 280

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 492497
Category:	downloaded
Size (bytes):	143288
Entropy (8bit):	7.998011328654053
Encrypted:	true
SSDEEP:
MD5:	E089E4AD41E728E1429F58DC3015F123
SHA1:	5E397A2ECBD07637BA112A458E6C3EC87C5D091C
SHA-256:	E1824A806BB2D2C9EF1580A7E072C25A0F1C415209853AF6BB4045A487BEDB50
SHA-512:	19B8928FF2465EFF321243A5B6B5A731A3450FC192B42CB058E8B20549866616EB00BAD23FE3EDB90CEE00D354C4C82F4E8AAB22B80554FB43154931B8566CEC
Malicious:	false
Reputation:	unknown
URL:	https://js.intercomcdn.com/app-modern.6f0a0d11.js
Preview:	............r.H. .+.;JEV:.\.P........X..d..H8EH$..@-A..>...<...Y?..<..\|.....9.....".n.j.u3(.....g.......N....?.>.,..0.x2.g.W...&..g.uo.H'...N..=g...V..q...>.nY]...fI8.{...2..[....,......T.AX....u..B/.Eu...^....sgk....(....d.wp_.U.....\._.I..N...^[F..........K..)O..t...ic...Q#...Vs~.w.....&<..d..za.'.kY...:;...-......n.......0...x..E....ox2...........:.....x.]..x1......x<Na>...]...I.:..~r9.a...?.].d...s?.Q....a..K.>.>4..~.G\B.{_..od..l....\&."....7...'....E.X..tV.....f...4........s...&.`...M.x......z..'...z..X=....ZX.Kx.H.J...N..2..x<.1.ZM.[..\.......:...."~[......7Ly..R.q.\|.'5...+........ ZL..A-...<.......9k...o.0.4..7..k\|..g.1....ZT.>....<..Vu....`..z.i...u.-;....,\.....4;.:[...N....Q.E.]"q..tw.....I8.`.UV.._&.O.......(..G..;....y.'.!}.5.O..w}....t .....N.3..-\|{....`=...T;......l.....W..F.mT.W.q..>...9..O...../.....'v?0.!....&[..5......v3..nq......z6.A.......F..Q.....O.........8.TW..]E..@..P.b.E.J....X\|..4...).!.,.9.

Chrome Cache Entry: 281

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 55379
Category:	downloaded
Size (bytes):	9399
Entropy (8bit):	7.977548376800718
Encrypted:	false
SSDEEP:
MD5:	A0012A012EB5763FCDC33C87A0F8416F
SHA1:	D951D83C9250244D72BCD9892BBF9A6031558A75
SHA-256:	1F585C47B4DF14719842058862D14735807C87CB3FA4C817643530A292B808F4
SHA-512:	C7F71BAF178B64F204F62114951D89D2CDDE7A13CF658D2C3F7E38B1C48BFA49DBA80E88E93D5AB8B76702C471EBC20CFE8ED1A0B4AB8971EADEDA1AA0D5926E
Malicious:	false
Reputation:	unknown
URL:	https://gamma.app/_next/static/chunks/1786-a1cc54383f32c7ea.js?dpl=dpl_AmRPMj9KKeW4g92pz9v8ABm9EUsU
Preview:	...........]yw....>...i.Y......v.%.8....PHXlf.b..}n..!.Y...~O.>2...u..Bb..3a.Xz./..6.>.\|.w.:...y.s.UX...+N..S..C..W..$.j...G\._wH0J...h......8b..]..Mv.....z......lXh.....m..9(..H..r.....f.....).U.o.Q.^iv.l..]..6Y......x.Z..P......yr..?...w\|v..h.K.q..q...o..J....../G.r_.......92...+Z........wt..l..>l..._..?....n...x..i.......u.w.......0.n.on......no.....yg..................}.......#..{_O..............]..\....G.=.L..Cow......$v..].o.....o{.[..Y=.S.../g...v.r...%..x...;......#.N/.._N+............ix...}.....m..`C...\|..84.j-.~..N....[}.r...?.7...'?>8..n_.7..h.a......kc..=....-...W..uz...\|....k..2+b'T.l....@.PI.........Ld.n.j..h.c..Ogy.s#.F.......GQ...;(80....et...CTq.. ....x.k4...b.....6jCS...!.zq..H....M.IL.I.e.Y0..a..j...Ray?.=....nl... .#..A..n..3....(.ab6%..j.c..[L..CQB.A..1}pC..h.">P.dy...({'.....N.B!vC.FaG.=g..x.W...R..ZE.5.e.UuIDH.u..k`..#.?89o..o..G.....l...p......A].#_s.;.....Z?...M.w\|....]...H].......\.DAY..R[.i.*.....~&.z..-......a

Chrome Cache Entry: 282

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 63730
Category:	downloaded
Size (bytes):	19595
Entropy (8bit):	7.986136355238715
Encrypted:	false
SSDEEP:
MD5:	02202CD1FDF861C28745C14DB1A3ED78
SHA1:	AC3AA14A5E74D5578C33D1C238C29883F1010E28
SHA-256:	2B256F76E83AA70E65D9F4E24336A30890BD9D757874EECDE13BEB60596888D2
SHA-512:	C1CE724F9990898EDC21283B3E468D91893930C772C8B735755DE73E1B1DC84F1BA2C298B083C6493E862A556F9B25B7E0690D6BFB9654D7287795E059E0F892
Malicious:	false
Reputation:	unknown
URL:	https://gamma.app/_next/static/chunks/1035ef44-a82a0e0646431fa5.js?dpl=dpl_AmRPMj9KKeW4g92pz9v8ABm9EUsU
Preview:	...........}.v.V...z...V.%...tu5...EN..K.N-..c...P....m+...w.s.]...........IO....rD.}....N6...M.-..<.U~>........M...?.....'..t../........h{..?......5Q..../.....4U.Y.^V.ZU.U.D..~P..2..j.m.'.F..m8..T...?.....1.J.y...?..0.......~.F5.<...Ga...{....C.......<.R.........b.de1Z.....M.Y.5UR..e.6V......j."..rV..)+.>K.w.,..y..MUl..i.%.u~5k..wz..i.....C.8I..:.\dE.E.WT//.....UjY......O./.FS~...s...&.B5#g.A.......mN.90}.VrZS9..bjj.VM....../.].I].6[.5@.f....eVOU..g..GD.U..Q.Z%EZ.N.......%Er...RJq...z^.....i.[..eR?.Yf..q.V....u.\_.#.....f..f...u.}.o...~.> .5....2...&.S<2uP..o#9O.U.:...:.$%....u....<.#....R....5...ZNa..T...u..CS..z.4..I(..W.....R.F.{\|.....If!).^y....q&.Lv....s...u-..V.....pR!#>9.41.+..0.r.T. ..~z5.....jV....../re..fT....jE......z.\_.?..2..9`.)........q.`Kt.ik.V......T..U.&XE.#=..-b..$5,bCe.g3{_f......A.l..h(m......AeKr.TX.B8J.p.6..n.8L.....+..8..\...Sn...O/w.+...5.^{.Z..2..3 ..>m[.}.........0.z.\|...i.*k.e....S..z...^1=/......]1a..a

Chrome Cache Entry: 283

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	38680
Entropy (8bit):	7.983547356119883
Encrypted:	false
SSDEEP:
MD5:	46FC2A0AC728CB95BAE25D86EAF165E9
SHA1:	DBD926966728DECF2C1F0E35A1440CF65014DD26
SHA-256:	601BF00AE6AF1AEA1352CB1DDB74373F2534FAE5F3B1A00839AB731C6A718727
SHA-512:	61E3EA3DB46A0E7C0719E66A9894B18CEEE4549BAA351D6485FC954DD24FF374E89F6A5C69A2C73E02E5F502301A7637AB52B3258FF04B1802E86F93FE11EBCC
Malicious:	false
Reputation:	unknown
URL:	https://imgproxy.gamma.app/resize/quality:80/resizing_type:fit/width:1200/https://cdn.gamma.app/arlb99rmdib6z2v/b9463a264fe7403aab5dacea46387a38/original/5816644471075490829.jpg
Preview:	....ftypavif....avifmif1miaf...+meta.......!hdlr........pict.................pitm.........4iloc....D@.........O.................Z.............8iinf..........infe........av01.....infe........Exif....jiprp...Kipco....colrnclx...........av1C........ispe................pixi............ipma...................iref........cdsc..........mdat.....f........2........!@...8..tuM.....X.X.(.e.....>...h..l.......$..u... .....c~W...?6.(N.H...m^`.........R_T... ..R..(.}......O.B..S.....}...z.\..B[.....T.]V.X...Qt....~..i..1D....k..H.../M...3?0E..n<.N...Fx(._.:...vK.........(..JQ.^w_Sc=)....s,b...d.. ...8.......'.H.7r..v...[.?j.2..S.."..Q..1.,.7.\|P....JKAh..?Q...wV.Tj..o:@..d..\|...c.o....I'.......HNj.@$Kd.....VB...}.....FazsT..B..=....../E.2^w...V.z.q~zf.w.^.U.;...S".65....C"<."z..R.........-.!.tYt.zO.\.L....OP9...R..77j........1^.R.H..w...\|.E`.....5.}1.o~....^v%..YFK%..kJ..._...G..:.t.......t....uF...s.,......)..G.Q......".I.f...}...tm.....<n.(../<. ..,._...d.A.R5...

Chrome Cache Entry: 285

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 7679
Category:	downloaded
Size (bytes):	2514
Entropy (8bit):	7.917207578750428
Encrypted:	false
SSDEEP:
MD5:	474B881E3D4BFABED233A4FBA8AF24A7
SHA1:	98370DA5049A614369EBCF414F5C16455CA4028E
SHA-256:	B8322BEE3B808FA6A22D134B68C9FABA523C8A084A526AF148DA9B16F9B9A4CB
SHA-512:	5325D112544284D053332BADB9FFFF190B3BAAC2913DF3639F5E10F45F28B500A61BE0E3E38D2B623F459A5DCF2271CE622CD5112AEEAB2336DC229948353F9A
Malicious:	false
Reputation:	unknown
URL:	https://gamma.app/_next/static/chunks/4483.b1e22900348e682f.js?dpl=dpl_AmRPMj9KKeW4g92pz9v8ABm9EUsU
Preview:	...........Yms........(D..R.KR.&..7...M...#.8..I.).%..>I....A..e.....I......]..D...Y....V.....]....n<..d.........)..x....W[...I...o.T(..S#5\l.@.8r..t..O[.E,c+.2.]..qGr..m..'........nw.2..P......Kap....2...:..a.'. l......}.a48......m..0.....WJ..P.'.d.....<..X.J.h./.....\.N...l.O8..H.3.l._~......p.f.?q.R....$...~.....k....-.(_...\......S..`5..+\|....>~...2e....k.6.[..&.Zj%.^.g...W.......M....pdN>\|.\|s....S..-..!..A........_.!!.r....Q...zJ.+...~.<-..]N..m..(..$w+.>./.C2.&.Z..%.T.!.e2Z.B...Y.d.l..et..B..l..H...L.......l..;.....L..Lf..lt...X....U.Fl.K........fC........;_.uX[)#.OS.. N0..X.}W\.^(..Z...r.(.N>.S..y.w......R@..i....!.P....L.K........`y...%.[d[\|^.K.d.$-#.H...2B...........2us..a..[.._Q.y.z.w....=.>.5Z.......m...>m.....m..$..y...g7...s@..#.5...l.eq...B.].n.....I..hI.&....a&Z.O.4...q.{C...1I....d.%......I...g..[.......!..:d2.^^!.-.'...G.&nx.Zq.......1.FQ........]f`hi.....\..Yn..]..HE..s......@.{c8H.l2.5.v:.a>`.p....r.'.t..%.f...!v8..I.........

Chrome Cache Entry: 286

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 33785
Category:	downloaded
Size (bytes):	11537
Entropy (8bit):	7.980159351328313
Encrypted:	false
SSDEEP:
MD5:	22D00E8E987254A1B82E1518C9A3C29B
SHA1:	7A8172D17F35DED69584BA1BD521E945C7B3FE72
SHA-256:	E4EF8BFCDFBCBC64D267E37B44F1078707DB9ED7EF9DD5317B669810194D0769
SHA-512:	E263F4B0B1F896C5885D300284ABBB5F2C4A7EAEF0F01CB0A6FE39D6254754C4CCD7E40F3B85621D365D551A513EAB6197B3F940EE79269D668B47AC5F904694
Malicious:	false
Reputation:	unknown
URL:	https://gamma.app/_next/static/chunks/995-984ec3894744e0be.js?dpl=dpl_AmRPMj9KKeW4g92pz9v8ABm9EUsU
Preview:	...........}kC.F.....F..R...I..)4!.......a...YrGc.5....s.lC...........3._..".....eg8...=.....t.A8..C..y..I.M.<...i.s&.....R..'.....d...*~.%'...,h_&....K...#.I..>.f..V...d.......+...'....LU_.&.q..I...L...:]v...Mg3V."...H......=......P^.y.I.U..N..].0.%..T^.^9L.={.`m.....7.?.........W...^.g.7....~{.a.....}vyq..yr2..rt~t\|..p...Wk8jO.ey$.A..^.......X...y/^..R.bo(...{...\.+F.Yz^........Q......4X.gE.-.....PL..M..._..........b.{.m......Q.WL.~+/d.Gn....V.9.. /e......R..`F'....Z..\|y}...&#^.Cg..6Km..@...cQ....#..N......0-..4....&.%..."..:.e...nI....Lh.l#...#.fi8N...-`.i^r!_.Bp.`i.'.w.-_B..Fc.$.xI..1/..y....'b;..q,..,.T.....i...hq@+......{].7..I..\| ....ZP..K:.n...>.$...3....,\|...%..E...z...$0..V...!s.x./y>.._U...........:..._L.B..>.t.P=B.'....30......u35.{..Y.>;.)`...D....%.g.`..%i...%l...yr..S..-......8O...R.[s.....(&...?<.....`A...l{P.Z..u.....i:.@V.q..&.....J..^+p.j..95H!.t.9.....U.........B.`6......&..;y.....8.z.[<....E2..Y..zA(.7...;I.\..

Chrome Cache Entry: 287

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 17123
Category:	downloaded
Size (bytes):	5742
Entropy (8bit):	7.967887798300837
Encrypted:	false
SSDEEP:
MD5:	3B145725709199D4E79D4CA60264BAC7
SHA1:	01150E3665905D08ECA26A491D64B9BFF9ECA0C3
SHA-256:	6541F09B99D0B8D9BFFAE624F8BECD6A4D3A5C6D977AA345A7BC9E5240EC9718
SHA-512:	788B4AFDC7921E26EF1BD71A96B6D78ABFF5EA6E6B2080DEE4BAA34C80957013787DF26F8B1AF991A84409D4BC12DCFBC092AD7259427C13033D04338F86F1DD
Malicious:	false
Reputation:	unknown
URL:	https://gamma.app/_next/static/chunks/3251-aaf5b0bce8b53fa3.js?dpl=dpl_AmRPMj9KKeW4g92pz9v8ABm9EUsU
Preview:	...........\.r...?O.uk.(:.B..V]....Rv..p.....T.0`.3...5.1.3/0.0.v.T...FuQ....\|g....r....O..w..c..........z.....'..#...\|.K...$.W.3..]..1..w...o......\..:9...e.X...f.R..E.@.,....`^..\|.....y...Cu.3u...;2....X..u.d.@...(.$......i.2=fz..O..z.lyl...:}...f.R....\..U..J.T.....- Q.I..R.R...C.k.jY$.l...,..hVK.....~..<..[rU$64kR..\.!..."..b.b.....%....mmK%.4..]...m\|Z."5S\L.m.... U."..\@..{.uK.e ....E.q..V...u.......H.b~..m.S..w.c.f.fl.:.).M.NK2..mR.I..j...T..Uh.".).R.I..j....)..]...$....e4..$..-.dU".?.{.n........-V.$../.b..B.T#.'.W.v.>.U..[..?)..5.".qx.;W...........g..... .Er..R.%.q..R....C..K. .S.Me..zp..+.%.{.OK."......;C)mW.0...P-..v.p.-.v.KT.e...>l....P...}O.Y.."9.fi..4\|.....p...0.1.P.....\.U.y.....\|...2NW..72.'J..S.h[...E(..k....K.....:p.B.2,.-8L+T.EQ.._..>...j..\|.....J.../.A.`..3 ..n-.Of]..k..T.......I'[d..b.w..+ .<...u......b:.K.3p......j.1x....5..q.u..a..1....d.z...s...&.W...Z.....!.....).........9....0.....N.A.=...t.u<.2..,c44.gZ

Static File Info

⊘No static file info

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: aa1selfstorage.com
Source: global traffic	DNS traffic detected: DNS query: gamma.app
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: use.typekit.net
Source: global traffic	DNS traffic detected: DNS query: cdn.iframe.ly
Source: global traffic	DNS traffic detected: DNS query: p.typekit.net
Source: global traffic	DNS traffic detected: DNS query: o698378.ingest.sentry.io
Source: global traffic	DNS traffic detected: DNS query: cdn.optimizely.com
Source: global traffic	DNS traffic detected: DNS query: events.api.gamma.app
Source: global traffic	DNS traffic detected: DNS query: app.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: cdn.gamma.app
Source: global traffic	DNS traffic detected: DNS query: api.gamma.app
Source: global traffic	DNS traffic detected: DNS query: a187838077.cdn.optimizely.com
Source: global traffic	DNS traffic detected: DNS query: logx.optimizely.com
Source: global traffic	DNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: clientstream.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: imgproxy.gamma.app
Source: global traffic	DNS traffic detected: DNS query: test.geckoway.de
Source: global traffic	DNS traffic detected: DNS query: assets.churnkey.co
Source: global traffic	DNS traffic detected: DNS query: widget.intercom.io
Source: global traffic	DNS traffic detected: DNS query: events.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: canny.io
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: js.intercomcdn.com
Source: global traffic	DNS traffic detected: DNS query: api-iam.intercom.io
Source: global traffic	DNS traffic detected: DNS query: nexus-websocket-a.intercom.io

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://aa1selfstorage.com/ioeloro/?wptouch_switch=mobile&redirect=//gamma.app/docs/Untitled-fw6wys6ubo63z1u?mode=present#card-wdvd2twm5f65uwl

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

Chrome Cache Entry: 264

Chrome Cache Entry: 265

Chrome Cache Entry: 266

Chrome Cache Entry: 267

Chrome Cache Entry: 268

Chrome Cache Entry: 269

Chrome Cache Entry: 270

Chrome Cache Entry: 271

Chrome Cache Entry: 272

Chrome Cache Entry: 273

Chrome Cache Entry: 276

Chrome Cache Entry: 277

Chrome Cache Entry: 278

Chrome Cache Entry: 279

Chrome Cache Entry: 280

Chrome Cache Entry: 281

Chrome Cache Entry: 282

Chrome Cache Entry: 283

Chrome Cache Entry: 285

Chrome Cache Entry: 286

Chrome Cache Entry: 287

Static File Info

Windows Analysis Report
https://aa1selfstorage.com/ioeloro/?wptouch_switch=mobile&redirect=//gamma.app/docs/Untitled-fw6wys6ubo63z1u?mode=present#card-wdvd2twm5f65uwl