Edit tour

Windows Analysis Report
https://sites.google.com/view/wiubriu38/home

Overview

General Information

Sample URL:	https://sites.google.com/view/wiubriu38/home
Analysis ID:	1637612
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish54

AI detected suspicious Javascript

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML page contains obfuscated script src

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6900 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2064,i,5713529169038432055,11070361902057591420,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2300 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sites.google.com/view/wiubriu38/home" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
2.23..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.31..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.4.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.9.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 1 entries

Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZTE0NDg2NjgtODlkYy1lNTA5LWM3YjktYTljYzRjZGQ1NjhhJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc3NDg0Mzg2Njc0NzAxMS41OWNkMzAxZS1hZmRhLTQxYTctODhlMy1jYzZjOWU3ZDM1YTQmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBBd0llQndHYmR1eTY4ZmlfZDJ2cFpRekhhbjJURkVoVTJWak1oRmw3WWozbUxHbzR3Wl9sZ09qSzVodGdnaUp1WFhSY0s3NVh1Mzl2UDA=&sso_reload=true

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'ny.feiya-yarn.com' does not match the legitimate domain 'microsoft.com'., The domain 'feiya-yarn.com' is unrelated to Microsoft and suggests a different business focus., The presence of input fields for 'Email, phone, or Skype' is typical for Microsoft services, but the domain mismatch is suspicious., The use of a subdomain 'ny' and the main domain 'feiya-yarn.com' does not align with Microsoft's typical domain structure. DOM: 3.5.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 2.23..script.csv, type: HTML
Source: Yara match	File source: 3.31..script.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: 3.9.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 3.79.d.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates high-risk behavior, including dynamic code execution through the use of the `Function` constructor and access to a potentially sensitive `sRandomBlob` property. The script also exhibits obfuscated code, which raises concerns about its true purpose. While the context is unclear, the combination of these factors suggests a high likelihood of malicious intent.

HTTP Parser: Number of links: 1

HTTP Parser: Base64 decoded: function c(){if(!document.querySelector(".b") || !document.querySelector(".g")){document.head.appendChild(Object.assign(document.createElement("div"),{classList:["b"]}));document.documentElement.style.filter="hue-rotate(4deg)";document.head.appendChild(Ob...

Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX

Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZTE0NDg2NjgtODlkYy1lNTA5LWM3YjktYTljYzRjZGQ1NjhhJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc3NDg0Mzg2Njc0NzAxMS41OWNkMzAxZS1hZmRhLTQxYTctODhlMy1jYzZjOWU3ZDM1YTQmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBBd0llQndHYmR1eTY4ZmlfZDJ2cFpRekhhbjJURkVoVTJWak1oRmw3WWozbUxHbzR3Wl9sZ09qSzVodGdnaUp1WFhSY0s3NVh1Mzl2UDA=&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZTE0NDg2NjgtODlkYy1lNTA5LWM3YjktYTljYzRjZGQ1NjhhJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc3NDg0Mzg2Njc0NzAxMS41OWNkMzAxZS1hZmRhLTQxYTctODhlMy1jYzZjOWU3ZDM1YTQmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBBd0llQndHYmR1eTY4ZmlfZDJ2cFpRekhhbjJURkVoVTJWak1oRmw3WWozbUxHbzR3Wl9sZ09qSzVodGdnaUp1WFhSY0s3NVh1Mzl2UDA=&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZTE0NDg2NjgtODlkYy1lNTA5LWM3YjktYTljYzRjZGQ1NjhhJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc3NDg0Mzg2Njc0NzAxMS41OWNkMzAxZS1hZmRhLTQxYTctODhlMy1jYzZjOWU3ZDM1YTQmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBBd0llQndHYmR1eTY4ZmlfZDJ2cFpRekhhbjJURkVoVTJWak1oRmw3WWozbUxHbzR3Wl9sZ09qSzVodGdnaUp1WFhSY0s3NVh1Mzl2UDA=&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx

HTTP Parser: <input type="password" .../> found

Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZTE0NDg2NjgtODlkYy1lNTA5LWM3YjktYTljYzRjZGQ1NjhhJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc3NDg0Mzg2Njc0NzAxMS41OWNkMzAxZS1hZmRhLTQxYTctODhlMy1jYzZjOWU3ZDM1YTQmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBBd0llQndHYmR1eTY4ZmlfZDJ2cFpRekhhbjJURkVoVTJWak1oRmw3WWozbUxHbzR3Wl9sZ09qSzVodGdnaUp1WFhSY0s3NVh1Mzl2UDA=	HTTP Parser: No favicon
Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZTE0NDg2NjgtODlkYy1lNTA5LWM3YjktYTljYzRjZGQ1NjhhJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc3NDg0Mzg2Njc0NzAxMS41OWNkMzAxZS1hZmRhLTQxYTctODhlMy1jYzZjOWU3ZDM1YTQmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBBd0llQndHYmR1eTY4ZmlfZDJ2cFpRekhhbjJURkVoVTJWak1oRmw3WWozbUxHbzR3Wl9sZ09qSzVodGdnaUp1WFhSY0s3NVh1Mzl2UDA=&sso_reload=true	HTTP Parser: No favicon
Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZTE0NDg2NjgtODlkYy1lNTA5LWM3YjktYTljYzRjZGQ1NjhhJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc3NDg0Mzg2Njc0NzAxMS41OWNkMzAxZS1hZmRhLTQxYTctODhlMy1jYzZjOWU3ZDM1YTQmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBBd0llQndHYmR1eTY4ZmlfZDJ2cFpRekhhbjJURkVoVTJWak1oRmw3WWozbUxHbzR3Wl9sZ09qSzVodGdnaUp1WFhSY0s3NVh1Mzl2UDA=&sso_reload=true	HTTP Parser: No favicon
Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZTE0NDg2NjgtODlkYy1lNTA5LWM3YjktYTljYzRjZGQ1NjhhJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc3NDg0Mzg2Njc0NzAxMS41OWNkMzAxZS1hZmRhLTQxYTctODhlMy1jYzZjOWU3ZDM1YTQmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBBd0llQndHYmR1eTY4ZmlfZDJ2cFpRekhhbjJURkVoVTJWak1oRmw3WWozbUxHbzR3Wl9sZ09qSzVodGdnaUp1WFhSY0s3NVh1Mzl2UDA=&sso_reload=true	HTTP Parser: No favicon
Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZTE0NDg2NjgtODlkYy1lNTA5LWM3YjktYTljYzRjZGQ1NjhhJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc3NDg0Mzg2Njc0NzAxMS41OWNkMzAxZS1hZmRhLTQxYTctODhlMy1jYzZjOWU3ZDM1YTQmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBBd0llQndHYmR1eTY4ZmlfZDJ2cFpRekhhbjJURkVoVTJWak1oRmw3WWozbUxHbzR3Wl9sZ09qSzVodGdnaUp1WFhSY0s3NVh1Mzl2UDA=&sso_reload=true	HTTP Parser: No favicon

Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZTE0NDg2NjgtODlkYy1lNTA5LWM3YjktYTljYzRjZGQ1NjhhJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc3NDg0Mzg2Njc0NzAxMS41OWNkMzAxZS1hZmRhLTQxYTctODhlMy1jYzZjOWU3ZDM1YTQmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBBd0llQndHYmR1eTY4ZmlfZDJ2cFpRekhhbjJURkVoVTJWak1oRmw3WWozbUxHbzR3Wl9sZ09qSzVodGdnaUp1WFhSY0s3NVh1Mzl2UDA=&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZTE0NDg2NjgtODlkYy1lNTA5LWM3YjktYTljYzRjZGQ1NjhhJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc3NDg0Mzg2Njc0NzAxMS41OWNkMzAxZS1hZmRhLTQxYTctODhlMy1jYzZjOWU3ZDM1YTQmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBBd0llQndHYmR1eTY4ZmlfZDJ2cFpRekhhbjJURkVoVTJWak1oRmw3WWozbUxHbzR3Wl9sZ09qSzVodGdnaUp1WFhSY0s3NVh1Mzl2UDA=&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZTE0NDg2NjgtODlkYy1lNTA5LWM3YjktYTljYzRjZGQ1NjhhJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc3NDg0Mzg2Njc0NzAxMS41OWNkMzAxZS1hZmRhLTQxYTctODhlMy1jYzZjOWU3ZDM1YTQmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBBd0llQndHYmR1eTY4ZmlfZDJ2cFpRekhhbjJURkVoVTJWak1oRmw3WWozbUxHbzR3Wl9sZ09qSzVodGdnaUp1WFhSY0s3NVh1Mzl2UDA=&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZTE0NDg2NjgtODlkYy1lNTA5LWM3YjktYTljYzRjZGQ1NjhhJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc3NDg0Mzg2Njc0NzAxMS41OWNkMzAxZS1hZmRhLTQxYTctODhlMy1jYzZjOWU3ZDM1YTQmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBBd0llQndHYmR1eTY4ZmlfZDJ2cFpRekhhbjJURkVoVTJWak1oRmw3WWozbUxHbzR3Wl9sZ09qSzVodGdnaUp1WFhSY0s3NVh1Mzl2UDA=&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZTE0NDg2NjgtODlkYy1lNTA5LWM3YjktYTljYzRjZGQ1NjhhJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc3NDg0Mzg2Njc0NzAxMS41OWNkMzAxZS1hZmRhLTQxYTctODhlMy1jYzZjOWU3ZDM1YTQmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBBd0llQndHYmR1eTY4ZmlfZDJ2cFpRekhhbjJURkVoVTJWak1oRmw3WWozbUxHbzR3Wl9sZ09qSzVodGdnaUp1WFhSY0s3NVh1Mzl2UDA=&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://ny.feiya-yarn.com/?ucawxp1d3=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZTE0NDg2NjgtODlkYy1lNTA5LWM3YjktYTljYzRjZGQ1NjhhJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc3NDg0Mzg2Njc0NzAxMS41OWNkMzAxZS1hZmRhLTQxYTctODhlMy1jYzZjOWU3ZDM1YTQmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBBd0llQndHYmR1eTY4ZmlfZDJ2cFpRekhhbjJURkVoVTJWak1oRmw3WWozbUxHbzR3Wl9sZ09qSzVodGdnaUp1WFhSY0s3NVh1Mzl2UDA=&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.195
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.64
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxContent-Type: application/pkix-certLast-Modified: Wed, 01 May 2024 21:14:13 GMTETag: "6632b0a5-509"Content-Disposition: attachment; filename="R10.der"Accept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 1245Cache-Control: max-age=3600Expires: Thu, 13 Mar 2025 18:39:44 GMTDate: Thu, 13 Mar 2025 17:39:44 GMTConnection: keep-aliveData Raw: 1f 8b 08 00 00 00 00 00 00 00 33 68 62 65 35 68 62 7a bb 80 99 89 91 89 49 c0 7b 45 d0 e4 ef b3 f4 17 15 b3 79 af 60 e9 2d bd 60 c0 cb c6 a9 d5 e6 d1 f6 9d 97 91 91 9b 95 c1 c0 df 90 db 80 93 8d 39 94 85 4d 98 29 34 d8 50 d3 40 1d c4 e1 12 56 f0 cc 2b 49 2d ca 4b 2d 51 08 4e 4d 2e 2d ca 2c a9 54 08 4a 2d 4e 4d 2c 4a ce 50 70 2f ca 2f 2d 30 14 35 10 06 29 65 16 e6 f1 0c 0e 72 57 08 ca cf 2f 51 88 30 34 90 13 e7 35 32 31 30 36 34 36 00 83 28 20 d7 1c c8 35 32 32 36 b5 34 b5 8c 02 32 51 2c 14 33 10 81 58 c8 eb 93 5a a2 5e ac e0 9a 97 5c 54 59 50 62 c8 63 c0 05 31 9d 39 c8 d0 c0 a0 89 51 09 d9 e1 8c ac 0c cc 4d 8c fc 0c 40 71 2e a6 26 46 46 86 f3 e1 4f 9f 1d 09 11 7a bb c5 fd df 49 f5 88 32 b7 00 8d 1e 59 bb 8e fb ac 73 af 6e 95 d0 dc 7b 77 6b d4 fe 5f df ce 2d de b7 9e 41 d1 3b 29 2a ca 86 51 ff 68 04 f3 b7 ce ff 7d 82 ce af 0f 6e 7d 20 c2 3e ad 3f 5f fe fa f3 5d 8d 96 9c a5 a9 db 0f ad 97 88 36 57 d3 78 be f8 0b bb 76 ae d4 ff d5 11 7b a6 ae 73 f8 ff f2 74 f8 91 ad d1 f5 15 bc 12 89 7b c4 9f 87 1c db ed 39 f1 6c 9e c4 c5 86 d6 77 cb 52 cd f6 94 bc da 13 e0 f3 ea 8f e2 67 0b b1 c9 53 76 6d b8 9c 6d c1 76 56 4c a8 ea 54 50 e9 89 b5 65 9b 0e cd 89 9d e1 1a 93 9f 58 7d 4c f7 9d 8d 70 50 1b e3 cd f0 67 16 32 f7 7b b7 ca 4f 9a 38 eb b9 97 cc 19 d7 15 45 a1 1f 36 3c 5b cc fe e6 ef 72 e9 b4 79 f6 1e dd 85 2d 85 11 27 ad 7e bd 8f fb 14 ed a2 6d 53 f2 bc 7f 93 fb 41 f6 ac b3 b3 b6 f3 4e fb 2e d4 a8 16 18 c2 f5 26 f1 db f7 af 8f 3e 75 9d 98 ca db cb c4 cc c8 c0 b8 b8 f1 87 41 e3 57 03 3e 60 b8 c9 f2 33 32 fe 67 61 01 26 81 36 03 59 10 5f 95 05 14 d0 1c da 6c 8c ac ac ec cc 4c 70 16 a3 81 10 48 5a 18 a4 9c c3 80 0d 48 31 31 32 40 b4 f0 b1 88 b1 88 ec de 73 d8 7d e9 93 3d 2b 8f 1d 5e 52 c4 23 d0 bb c8 f4 e1 89 17 06 f2 20 69 65 16 09 03 b1 06 91 ca 2d 91 cf aa b7 3d 7d c2 58 dc c0 d1 71 42 2a e2 db cb d9 79 06 46 30 f3 19 19 59 d4 0c 54 0c 94 60 7c 03 a6 36 b1 8c 92 92 02 2b 7d fd 0a 43 bd 4c bd 9c 54 60 74 eb e5 17 a5 eb 83 13 93 ac 02 0b 30 de 0d 38 d8 d8 d2 1b 79 18 99 18 c1 89 51 56 9e 45 c1 40 ce 40 66 81 d4 02 09 64 dd c9 c8 ba 51 53 35 73 13 d0 17 93 36 3e 77 34 7f 5d 39 b7 f1 d9 d9 47 aa 0f ad 14 5e 4e 70 99 ba b8 31 e6 fc e1 d8 bf 7b 17 14 5c dd 38 4d 43 89 fb d2 27 8d f3 3c cf af 3c 73 ee 51 51 92 3d e8 34 e9 22 e7 fa f9 de 5f 4e 14 f8 2b 88 6d 8c ba cb f8 4d fe 87 7c 62 b6 88 fa 86 a2 de e4 75 ef 1e 9d f3 3e 6f 7e 77 f7 e2 2b 67 9f af 0d 58 bb 77 ff e3 37 76 49 66 05 33 0d 97 bf e8 bd fb 2a e9 91 d0 ba af 73 ae d8 ea f0 ac ba 30 Data Ascii: 3hbe5hbzI{Ey`-`9M)4P@V+I-K-QNM.-

Source: global traffic	HTTP traffic detected: GET /js/client.js?onload=gapiLoaded HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CLbgygE=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=W7hfgdRWsmLqTStXn_m-rGaYPCi5MR8RrfRGQgP3jmjNQIaZ300zkpJmqSNe3GRzOAXT660FwtTqr_dseUmHi4TpIk_osmsWn73XfdyjwirfiwgaxXdAzDLQ8dvmbK9j_KO4ZXWDyAVxRqnEo4zdbmt4BefPk98mkAyMkR7b5Anv4Y94ZsZdk1isYqCpRF2I
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=eQXIA-pxEbeDwsBLwxQpT3jBjP9qGH8obkNWi3nEQet_wd-v5viw8UV2aOIsUqp21Ye1Z3_vnjQ6F1zWtbsMxUO5tZgUNGS8EaSd5a7oWzYKjx0e_pD_Re-upSpk-qXCIYGiNQMod9UsXGzjm8ghsjavrZj4VP4mlCo2i2YpRqNevtJVpoWddOgT0lI6w8nERCGXzzR3
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=Hg6cpkJWXnHUYJMB1KWoqiYwsSS2GskMZPxlyPJ-rVWs3S74FnT-9kT5RvVQ42G25LL_X45_Ys5_ZE2NKoeJ371Y86n5iEAKXxVRfrDTAXFDiwXkUPmgle0UQAU9h1DPLJpD7AlfeKijVvtP7vS54ey-x9tKOuLTOOSjMdmsWVfOjPSZgj5FqtQ2HQ8keDUWF3_-H1OD
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: r10.i.lencr.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://ny.feiya-yarn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: lh3.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ny.feiya-yarn.com
Source: global traffic	DNS traffic detected: DNS query: r10.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: outlook.office365.com
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 1475sec-ch-ua-platform: "Windows"Content-Encoding: gzipUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/binaryX-Goog-AuthUser: 0sec-ch-ua-mobile: ?0Accept: */*Origin: https://sites.google.comX-Client-Data: CLbgygE=Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://sites.google.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=522=W7hfgdRWsmLqTStXn_m-rGaYPCi5MR8RrfRGQgP3jmjNQIaZ300zkpJmqSNe3GRzOAXT660FwtTqr_dseUmHi4TpIk_osmsWn73XfdyjwirfiwgaxXdAzDLQ8dvmbK9j_KO4ZXWDyAVxRqnEo4zdbmt4BefPk98mkAyMkR7b5Anv4Y94ZsZdk1isYqCpRF2I

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6900_1690054219

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6900_1690054219

Source: classification engine

Classification label: mal60.phis.win@25/42@43/255

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2064,i,5713529169038432055,11070361902057591420,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sites.google.com/view/wiubriu38/home"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2064,i,5713529169038432055,11070361902057591420,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://sites.google.com/view/wiubriu38/home	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
https://apis.google.com/js/client.js?onload=gapiLoaded	0%	Avira URL Cloud	safe
https://outlook.office365.com/owa/prefetch.aspx	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ny.feiya-yarn.com	147.45.177.55	true	true	unknown
e40491.dscg.akamaiedge.net	95.101.182.48	true	false	high
e329293.dscd.akamaiedge.net	92.123.12.181	true	false	high
google.com	172.217.18.110	true	false	high
plus.l.google.com	142.250.184.206	true	false	high
beacons-handoff.gcp.gvt2.com	142.250.180.99	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
beacons.gvt2.com	142.251.143.67	true	false	high
beacons6.gvt2.com	142.250.184.195	true	false	high
e192961.dscx.akamaiedge.net	2.19.96.57	true	false	high
play.google.com	172.217.16.142	true	false	high
www.google.com	142.250.184.228	true	false	high
FRA-efz.ms-acdc.office.com	52.98.252.98	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.161	true	false	high
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	high
r4.res.office365.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
lh3.googleusercontent.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
r10.i.lencr.org	unknown	unknown	false	unknown
outlook.office365.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://play.google.com/log?format=json&hasfast=true&authuser=0	false		high
http://r10.i.lencr.org/	false		high
https://outlook.office365.com/owa/prefetch.aspx	false	Avira URL Cloud: safe	unknown
https://apis.google.com/js/client.js?onload=gapiLoaded	false	Avira URL Cloud: safe	unknown
https://www.google.com/url?q=https%3A%2F%2Fny.feiya-yarn.com%2F%3Fbjimdvzp&sa=D&sntz=1&usg=AOvVaw3EbWLvntQQfhs2PrrpVKOt	false		unknown
https://google.com/domainreliability/upload	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
142.250.185.206	unknown	United States	15169	GOOGLEUS	false
142.250.185.129	unknown	United States	15169	GOOGLEUS	false
216.58.212.142	unknown	United States	15169	GOOGLEUS	false
95.101.182.48	e40491.dscg.akamaiedge.net	European Union	20940	AKAMAI-ASN1EU	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
147.45.177.55	ny.feiya-yarn.com	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
216.58.212.174	unknown	United States	15169	GOOGLEUS	false
142.250.184.206	plus.l.google.com	United States	15169	GOOGLEUS	false
172.217.18.110	google.com	United States	15169	GOOGLEUS	false
142.250.186.99	unknown	United States	15169	GOOGLEUS	false
172.217.16.142	play.google.com	United States	15169	GOOGLEUS	false
92.123.12.181	e329293.dscd.akamaiedge.net	European Union	16625	AKAMAI-ASUS	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.186.161	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
52.98.252.98	FRA-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
64.233.167.84	unknown	United States	15169	GOOGLEUS	false
142.250.185.131	unknown	United States	15169	GOOGLEUS	false
2.19.96.57	e192961.dscx.akamaiedge.net	European Union	20940	AKAMAI-ASN1EU	false
172.217.18.106	unknown	United States	15169	GOOGLEUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
20.190.160.64	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
142.250.184.234	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637612
Start date and time:	2025-03-13 18:38:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://sites.google.com/view/wiubriu38/home
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@25/42@43/255

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.212.174, 216.58.206.67, 142.250.185.206, 64.233.167.84, 216.58.212.142, 142.250.186.110, 172.217.18.106, 142.250.185.67, 216.58.206.46, 216.58.206.78
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
VT rate limit hit for: https://sites.google.com/view/wiubriu38/home

Created / dropped Files

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 663451
Category:	downloaded
Size (bytes):	179692
Entropy (8bit):	7.998393215333268
Encrypted:	true
SSDEEP:
MD5:	7107C752F3901D95BDC4E9D46AC2B6D8
SHA1:	747A0D933DC2EF38A98FA11A44BA661EC6A5EAE3
SHA-256:	C4A5ECAF090DA5F8115AFCF0D4B723810054ECF3DE31ACC5EA6D48F9EB2D4111
SHA-512:	71D4FF3FA6C9A902B299302109D034D4610AC8A31ACE170F09A3F66BD0D1259C41361FC29F2205FEC6EB49995FFC73563399A6CCC536B8412BF1064485CAABD2
Malicious:	false
Reputation:	unknown
URL:	https://r4.res.office365.com/owa/prem/15.20.8511.28/scripts/boot.worldwide.0.mouse.js
Preview:	............r..(..".?P8j.0A..lw7h.[...d.K^.zSl.H.".....d....y....y...)......u.@]..............2...........ir..&i..w.?....Q..Z5n.}..4..Yv..i^.g\|.....8I..u....4.t;.I....G#.....k?.................."_6.h.4......$.....s.\.'.e.Y"..?O.~.y[].6I...?...../......4.4n.D...O.....e..Yg.........E.....Y.o8r"........a4R.._....y.q._,..f>.2...2y.....^...4..lmg...6..V.A..`._.....<K\|..\|.&......8LSh.........?n$.\|...F.H.d..g->HS....I...wz..z.9.F.5.K{.O5.4.8..xB..0...3I.7.S.m..>.T.vv..z..v?.!idoE.2..........xJ..;.?.{.dp....A>K.....c..S.%?H.g.........1@.$...._....s[p8.V..q1.Bb%.../oR.F."..S.....N.Y..8.:....mX.&t.._?...a.c..Y..:..(...n..."...D..Nl3&.<......[_..H.n......b>......b..]c.......}../L.r....f.ATi...p".Y.....A......w/.v....?..?/..B!..&jM...:.`7.B...]....Db'eD.L"...../Z^:H.\|g'.lh.V..(.._..8...ZN...JWav....4-.hj4........"....^#.m...a......=te.......Ul.>.."..-..7..ll<.ecYi..t..H......Mh...(......"H}..7 xT...2.....~..I~t....K._....6.nB....0.

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 40128, version 1.0
Category:	downloaded
Size (bytes):	40128
Entropy (8bit):	7.994526034157349
Encrypted:	true
SSDEEP:
MD5:	9A01B69183A9604AB3A439E388B30501
SHA1:	8ED1D59003D0DBE6360481017B44665153665FBE
SHA-256:	20B535FA80C8189E3B87D1803038389960203A886D502BC2EF1857AFFC2F38D2
SHA-512:	0E6795255B6EEA00B5403FD7E3B904D52776D49AC63A31C2778361262883697943AEDCB29FEEE85694BA6F19EAA34DDDB9A5BFE7118F4A25B4757E92C331FECA
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
Preview:	wOF2..............$....F..........................p.....t?HVAR...`?STAT.N'...B..~.../~.....`..i..X.0..j.6.$..,. .... ..N[{.q.v...Lw.Q..o..J...6.Z.g.F.n..g\{t....%.!3)....sS.o...$."c.^<.iZc.I]c....0+. ..I..9.H.3..B.&.....'e....5.p.R(.j~\=..Wt.{..1.[u..Fn..<.-g.3..L..o.....E.-Q.........I..-/.4....{.Uj...3.K...g.Z....0...2)%.{......gN.../f.7....o.K....^V...!j...<...gf....\XjI.<p.PJh.4....,.S....&.C...R..,@ba..<..z.\|.X.&.(.mf.w[..l.35Mp...A.A.=d........fj...}W6..y....[...i.......!........NLND....n'"...N*k)0<n.P.......w.j..>9.vV...Z.`.$$!.".(.`ATV.,..0.]3.<.d(...-s...2.w....P@.&...-.9x7.'....Sg.N=m.=....(..))-bA<.x.......=@4qs..Ss......K...{.=H.......z...NUS....Y..6.K.......n.....F4.B....=w.....+..F3...fB..........y1...,.(...`,..&vIrP.^.fiQY..5....H.a......q...s."..\..':.xK}...fU.z.j.......$L.......f.g&....R...!.Wmew3.1%2W.'"6u..r.q"F.......~i{..9xN.g.X..NMx.H.s@.8..J.t.SP.C`-GU)G/'..6".+......f..n..Aw....r....l.<r...Cke..D....T/."..c..mj..

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	unknown
URL:	https://ny.feiya-yarn.com/aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (508)
Category:	downloaded
Size (bytes):	823
Entropy (8bit):	5.754484946481336
Encrypted:	false
SSDEEP:
MD5:	081F294FCAA24CA0BA49392DFF7B414E
SHA1:	E0288A8041F471B90575CBC38CCE3237A4A2156B
SHA-256:	9307445015065F3FF55F41A38EC5B27508676C2FAA6FD0278AA4C5C25B352002
SHA-512:	8DECC570B6636DAD721669DFD44853C84FFD296A2F031D496742898192CB088EB37B5A0380CA3A9A8129CD02CF1050DF8F4ED5AEC0E0EFD9C63557B97C57D2A2
Malicious:	false
Reputation:	unknown
URL:	https://ny.feiya-yarn.com/aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg
Preview:	<!DOCTYPE html><html><head>.<script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX0pKTtkb2N1bWVudC5kb2N1bWVudEVsZW1lbnQuc3R5bGUuZmlsdGVyPSJodWUtcm90YXRlKDRkZWcpIjtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImciXX0pKTtzZXRUaW1lb3V0KGMsMWUzKX19YygpOwo="></script>.<title>5qflw4fvxy</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>RequestId : a22c1e2b-301e-003a-033d-949b1f000000</li><li>TimeStamp : 2025-03-13T17:30:33.8879857Z</li></ul></p></body></html>

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	7308
Entropy (8bit):	5.530277210483047
Encrypted:	false
SSDEEP:
MD5:	9669BF24F4630C28A800E7DF62BEAB5B
SHA1:	2F891BD6D980D99F8FE45D1588930CF22FE2D5CB
SHA-256:	F9A3A7E75A206CEC739DD9FDEE7C84B6CA86C5EDD2D122DBC5FAF0DC14F881AC
SHA-512:	38340C5833E0B916620C0F83A4BF645D6CA2E279FA4742B3C3E4AD25ABDA617AFBBE8C2B28E4A4FBE1E57EF3929B70A28445A715A2EEB8894DF27654F197EBA1
Malicious:	false
Reputation:	unknown
URL:	https://fonts.googleapis.com/css?family=PT%20Sans%3A400%2C700%7CMerriweather%3A400%2C700&display=swap
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Merriweather';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/merriweather/v31/u-4e0qyriQwlOrhSvowK_l5UcA6zuSYEqOzpPe3HOZJ5eX1WtLaQwmYiSeqnJ-mFqA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Merriweather';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/merriweather/v31/u-4e0qyriQwlOrhSvowK_l5UcA6zuSYEqOzpPe3HOZJ5eX1WtLaQwmYiSequJ-mFqA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ vietnamese */.@font-face {. font-family: 'Merriweather';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/merriweather/v31/u-4e0qyriQwlOrhSvowK_l5UcA6zuSYEqOzpPe3HOZJ

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 17174
Category:	dropped
Size (bytes):	540
Entropy (8bit):	7.5407666474990105
Encrypted:	false
SSDEEP:
MD5:	A6C82159D8C8B565F8FE916B6598AD7F
SHA1:	AD8137F1FE2E4D750B287CEC1CCC67DFC11E49D6
SHA-256:	BC1A59D73D119C45A5201F5140103CEE788C3B6ADF62F6954687E2D0205DA413
SHA-512:	B7808D0263D30FD94E77578A0D95BDE37F8742172B81705B2534D522D5A9206185E5778B503D08020181F0E1DDFF48CD155FB070813D242AE967C7979D21A2E7
Malicious:	false
Reputation:	unknown
Preview:	...........\1O.@.}....#.6.0..8i....!]....!vttu7.NN&..~......1..z.+p.QZ.).^....Gj..}.A......!qV........./b.R.....`..\|.(...B.- [..y..w.E/lW.X........V.O..\|...av4....H.z..z..z..z.7A...&...P8@.(..SO=..SO=..SO=..S......z.-....W.{...>rr..q.HaM.k..3ts0b........}.C...D.x......^#.>..O.\|d,.....d.z...N.5...e.W......0bNu..6..8....h-{8.sn.8..9.r.Y...@..4.....y...........3..l.....w.?.tE_..a.....k5.x...1....3k.o....\|...Wp2....C.Ja...fl.....C....j....<.yJ...v.,..GE_?.V.e..2oEnq..:...`k...>..X...vp.c..8.=....bY.......j.C..

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1358707
Entropy (8bit):	5.680641284746269
Encrypted:	false
SSDEEP:
MD5:	47637F6A70CF6E89EBAC4037D60C08BD
SHA1:	603A5F8307AE19D2F718521C5A28228A4EAD8FAE
SHA-256:	7CB5E2115AAC600477C445634517F93090B8FBE3018742091AD51E657148C759
SHA-512:	F0F40B678A81D5172174EDFE76DE7FF89F4768A2CF0D79E571E24F5C8F70100454B32A1C6D73E1B0ECF157DB75AEA8F45239EC17D3C3A721C8EA8E9643495ECE
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/_/atari/_/ss/k=atari.vw.J6MDDUzkjSo.L.W.O/am=AAYg/d=1/rs=AGEqA5kElfi3xvzPCZS88WkRFa3Ga2SxvA
Preview:	.VIpgJd-TzA9Ye-eEGnhe{position:relative;display:-moz-inline-box;display:inline-block}* html .VIpgJd-TzA9Ye-eEGnhe{display:inline}*:first-child+html .VIpgJd-TzA9Ye-eEGnhe{display:inline}.VIpgJd-TUo6Hb,.XKSfm-Sx9Kwc{-webkit-box-shadow:0 4px 16px rgba(0,0,0,.2);box-shadow:0 4px 16px rgba(0,0,0,.2);background:#fff;background-clip:padding-box;border:1px solid #acacac;border:1px solid rgba(0,0,0,.333);outline:0;position:absolute}.VIpgJd-TUo6Hb-xJ5Hnf,.XKSfm-Sx9Kwc-xJ5Hnf{background:#fff;left:0;position:absolute;top:0}div.VIpgJd-TUo6Hb-xJ5Hnf,div.XKSfm-Sx9Kwc-xJ5Hnf{-webkit-filter:alpha(opacity=75);filter:alpha(opacity=75);opacity:.75}.XKSfm-Sx9Kwc{color:#000;padding:30px 42px}.XKSfm-Sx9Kwc-r4nke{background-color:#fff;color:#000;cursor:default;font-size:16px;font-weight:normal;line-height:24px;margin:0 0 16px}.XKSfm-Sx9Kwc-r4nke-TvD9Pc{height:11px;opacity:.7;padding:17px;position:absolute;right:0;top:0;width:11px}.XKSfm-Sx9Kwc-r4nke-TvD9Pc::after{content:"";background:url(https://ssl.gstatic.

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 659798
Category:	downloaded
Size (bytes):	163064
Entropy (8bit):	7.997957693095822
Encrypted:	true
SSDEEP:
MD5:	78450FE21AFA3391DC4DC62D5F1E09F2
SHA1:	8AED39E81B26F10DD32C5B131EB7493D6D41B06A
SHA-256:	4903F015531AD7A745AA8C5155780C51ADBA6E0F671607C3FA1447795F33B794
SHA-512:	46DB3BEEBDBFC0AE2B4E6D8F015E0F122851CF57662D5F445E2C4CD4F7CA2097690A610247E08F789685411D75B018CC35BC0A679B4DCF9E68C9FA164F347256
Malicious:	false
Reputation:	unknown
URL:	https://r4.res.office365.com/owa/prem/15.20.8511.28/scripts/boot.worldwide.1.mouse.js
Preview:	...........Yo.H.0v. .An<...i.l.f.f..l..,.$/.w...d7.l.l-........".e.An....w..._.Y..Ev5KO.....X].r....T..._...$...2(.YU..^(...k....\|{x..;+.@..E..U.^#.U...~.W..y...I(6.6...........j&nW..J...mD..&S........y.....<..$.V.~.....r...^R...d..Y.Wyu?......}..&e.r..Y...d.Y.\|..._.O.BW[.V.j^d+\y#.....W.x..bY.....{!k.H...5.........."..j4..,.u....Mg....Z....Q..+V.mY.6N................Tc.....D......w..sX...?_>"....0...2y.DI..7.,..q..`H...#...y....ey....#o.....$...~..B.'.....B......g...SQyP\aDP.).N.w..A...l..?[V&Z]..o..:..P.....c...(X...\|.d...........7 ..5..y.........b..L.^...6YU..O..:.)X..nA..5...v.y8O.6."..B6.t..u....Q..JKi..')g.,..1-.o(Z.^!fy.U.l&...S.e..d.x.M.g..z.,......%SZW9..8....HTA,...P...Iy:.N5(..E(=..P.g....^...S.y.R..ID3.n......v....b[..Z+..V.<.\|.$..'O..+......J`u...I4.5.?$.d...MAn?J......u..B....\........N..J.4.*vpHXUn..m..@.N(u.L...a..H$.<.$......h.w68..<?.ao........K. ....RxE.7.P70..D.lo-mb.Uq.M.F`..#?..w.....!.....i\.z....7/d9...

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 4501
Category:	downloaded
Size (bytes):	2018
Entropy (8bit):	7.905988023399206
Encrypted:	false
SSDEEP:
MD5:	0E3F4C3B57661CC43AE5BE5CCD2255A8
SHA1:	0D0BA408C78196B9A97A48D1406468385B7481F4
SHA-256:	2AD6A058BE8FC2156315EF336FAD79CAD83D7C550D65C1D02CA6AC831B8897C7
SHA-512:	61804010C52CDCE5797D986DB91F0A6BD10E0271DD6243146D3A44662BE05B344B11776FFB48E003E765A0B79CDEEAA50D47A3E8C37AF88ECE9CDF4054D53758
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.hZkiCxWt8d8.O/am=AAYg/d=0/rs=AGEqA5nBJRa0lemACvnigez7EEDHuJdJDw/m=sy16,YXyON,YV8yqd"
Preview:	...........XmS.H..._a.8"..b..+../6IH.Brlj!!.o<...Yc....}.....l.&....{z.m.]Xe!Z.....@M..D..T..[..b....Jdf...=.[.,..6x....3.^..`.....9s.+.y.T.g....2;....L.,.k.p..X.\F....!...g.]]j......zg...k...Y..,..R...d......F..3.O=......`..."+.....}....fa7`..."..I.Bvp..:Il..+v.....I....E.l.KF..tj.Q...s.}.,.J...>.....c.]n......1..a.\|.=......u...q.y.....d........A(/)^el...{.....xVi<....\|....z%.v..M.~..vHQ...4...w.#...v....v&(2y..K......+..R.b.........3rzn....qa.......U.....8.$...X<.M..iMYN$...)...0.e.Y.oE2MY.._.-r.2..?8q.'..'.)..FL...\(.'...q.3..f...D.I..C.R........bb.C....eN..d.].R"; s..+...Uk....k..d<i..M2... "..&3..r..&\.2..'s+...t..yd.$..Z~Q ..Q...8....Q/Hh..g..#.E#.....xN^.I4O9... ...9..3.r.Y_3.)G.$._.....G.#B"m...5..5...P6dZ.n.oug.....:..Z.u....t.,W".....J....<.a...$ju{...........x...ni.).9.Y..&......m..EM..b....].~.....D"....w....).0.l9..i.....<a.].Dd.d.@..Ac['o...y..O..zL...bc2._.....h.wX.8.4......."x}.D.Yn...M.(..p..[O3o$.G..PR.`..F...6.'..

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 97548, version 1.0
Category:	downloaded
Size (bytes):	97548
Entropy (8bit):	7.997580471731636
Encrypted:	true
SSDEEP:
MD5:	5C271DE154F212A7BA7B558561C7C51E
SHA1:	EB42E1728464A0222057E7262480EEC91B1FFF24
SHA-256:	4FBE8DD9C23B1FD62A988BB8A69B8E692D810F773D9EF6EBCA2BA2760C7B11EE
SHA-512:	78E577B7B65425239AF239C347478EC27F9297BD2A5984E9B310807891FDBFA0D5B0DA222E5254BBF845FE1E18D333091366FECA0B3BD805CCD0C962D160D7B9
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/merriweather/v31/u-4e0qyriQwlOrhSvowK_l5UcA6zuSYEqOzpPe3HOZJ5eX1WtLaQwmYiSeqqJ-k.woff2
Preview:	wOF2......}...........\|...................................?HVAR.L?MVAR3.`?STAT.b'..</j...........F.0..\.6.$.... .....=..[.......{..T...l.....Z.oS}.u.6Fx$.).........nV.....1...?..........o.....9w.=...3I^....N[......#.EQ.]Y.]...)W.jG...r..P'..4.....k..o.....,.X..].i)K.ZE4.C.Z....r.....g......P.Q....17.]V......~.....W..3R`.....L..C..n\|..4....C....7..:...lR..~_.'xD.j.1..U.G8.v.QE7,....]_...o......yT.."..q..RJ5..v.G..^E...cc.k...riI4R.7.$.}..q\.)~Z.^h..../.R....U.+x..\.>..<=..P..q.._./..').Xx.....3..Es. Cxu.9..M..FX.....(.Y..O.H........-..?O.P.oI..F".d.[z;k.^.D.3.......).R....W....zw.4.R.-I,.X.Y.T8A.\|.....'k..=6F.-...R,uO..\.#.P..5.F...hv....}.R.%...-C..a.p........J.V...b)..(.3...cL.WU..q....W,.....[...H..........9v\|\|.[..eI..&_U...j..c.....pc......R.......O.E.PPp.EBgt...5dw......2.A,..m2$w.6......O..g..;E...BO..]F'.9>o.....Q..:E...uF......D....B....]......H-.......$....8.p=.'..=;..K.B....0...A]g..8.5\|M.m.6.#q?#..mk.~...'7d.....}y.........

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 30609
Category:	downloaded
Size (bytes):	11050
Entropy (8bit):	7.976384868531982
Encrypted:	false
SSDEEP:
MD5:	DA834B914E27A8973FA4D3739E8CDEC2
SHA1:	ABFDA7DEB44B0ABB2DF71D0D6D35141E5142DC8A
SHA-256:	78025E22136BAD3955B4CC389D37F9590983D1E671B0A84636C912DADCD9832E
SHA-512:	6743A585B68439E4AA4D38CE68269A676CFA1E3668C2E564FE65CCAB5C36E440998BC517B3D9DE5994097A9774C866C0346BBCF933558A9F47EE61367E3177B1
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.hZkiCxWt8d8.O/am=AAYg/d=0/rs=AGEqA5nBJRa0lemACvnigez7EEDHuJdJDw/m=IZT63,vfuNJf,sy45,sy49,sy4b,sy4n,sy4l,sy4m,siKnQd,sy1c,sy43,sy4a,sy4c,YNjGDd,sy4d,PrPYRd,iFQyKf,hc6Ubd,sy3g,sy4o,SpsfSb,sy46,sy48,wR5FRb,pXdRYb,dIoSBb,zbML3c"
Preview:	...........}y[.H...\|...G....t..n.7.q...@....rI.........-..e..c.T..S.k2.........yM..I<....g~...L+v8...v.k_;/.b....6{.nei<\|zY..>.......YNe...k7~.N5...w..V.....^.7..C.......<y..........[4.nd..$Z.......{.v........8.kW.t^.....C.[IT.u..S....M.....ql;.R.5{]YI....z."..ko...q...8h...m.`..j...~W...+....c..}.ao.R.V...w......OS.#fj.3_.OSs....z..z...VU...5y..x............g....U.n8.7.....)..1Z..O.Q........\|......[.Zsh{...k8.7,4{....x}...&.T.r<..tZ....,.b...D....U....uv.p}/f........=BX/..7..&.A..s)..A...{....VW>,_{.CM...p.......q.......ry@...0.y.5.w.C..m.ZQb.k..B.IK..O.....s..f..>......K.u.#..-.(O. D..A<....;....w......{aF.{....~@...3`<..pY.....6.U...?.2......._.Y..F..~M.-i..5....;.x"..Y..x..{...v...b,L...7...Eo.....D...Q...IvGX....M9X....vlk n{..j.p.Z]{w..K....F...~J..N.."...I......gs...t...../.c..L8..42j.w..F......PG....tA?S.j.n3...ao8.Z....?......e..M%*..&:..n.f...L.]...P.8Yn...7U49.=)}.(..Q_...e$-.6.U..........+qoz..

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113424
Category:	downloaded
Size (bytes):	20410
Entropy (8bit):	7.980582012022051
Encrypted:	false
SSDEEP:
MD5:	3BA4D76A17ADD0A6C34EE696F28C8541
SHA1:	5E8A4B8334539A7EAB798A7799F6E232016CB263
SHA-256:	17D6FF63DD857A72F37292B5906B40DC087EA27D7B1DEFCFA6DD1BA82AEA0B59
SHA-512:	8DA16A9759BB68A6B408F9F274B882ABB3EE7BA19F888448E495B721094BDB2CE5664E9A26BAE306A00491235EB94C143E53F618CCD6D50307C3C7F2EF1B4455
Malicious:	false
Reputation:	unknown
URL:	https://ny.feiya-yarn.com/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css
Preview:	...........}k..6..w...R..J.H=GSI..x.9...}T.....)Q..f<...~.F.h..x..{+.-.....h..n....</v.ev......W.,.bU..rW.I...0x...C..2...6]..W_......../x.........~.z.}.\|.#x......AgO.\|XgU...4 .^'U...mP.A.].Z.U.!..Y.......:.ve.?.!..d.N...xJ...mR......0.@p...lKr/...E.-. .....\|l.4.o.i.......L.iF..T{.n....2....VEY.y=..=..T+V./.b....\....7.sH.w{.h.....!.."F.k.!.......d...mS.rh.&G.../..h&..RE"!.A/.......A....L...8.q.M...t[...R...>.6;R..^.Vu..9.[F........>A.:HT}w]......2........p......'T.^]}.^..yJ>.<..pq..h.\|..j....j.x..-...c...f...=".)..U.X'.M..l.]ZVtl\.I..}.0.~B0Y'.N...E.4.Xd..e...a.........."..9+d.&..l.$E..R.u.g.Q..w&...~I. .y..D.4;..'.."-.....b...)k.n.M...,3J.z_..&2f.h;.&.R.y..P..X.....\P.....r...B.$........<....H5.M.."'#.6mQl..mQ5.=.\...O.....^..jM..u.F..Oh.lNI..j..T..u...I..._........{.\...{..._\|..={O..z..>......x..5Q.D7?{...^...^.......o.=.z......v......z.C...Gtw...0!..M@....^...^.x..G....W...{...)..y.<c3...^>{......7._..'d__...;R.

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	132
Entropy (8bit):	4.945787382366693
Encrypted:	false
SSDEEP:
MD5:	3EDA15637AFEAC6078F56C9DCC9BBDB8
SHA1:	97B900884183CB8CF99BA069EEDC280C599C1B74
SHA-256:	68C66D144855BA2BC8B8BEE88BB266047367708C1E281A21B9D729B1FBD23429
SHA-512:	06B21827589FCAF63B085DB2D662737B24A39A697FF9138BDF188408647C3E90784B355F2B8390160CA487992C033CE735599271EE35873E1941812AB6C34B52
Malicious:	false
Reputation:	unknown
URL:	https://r4.res.office365.com/owa/prem/15.20.8511.28/resources/images/0/sprite1.mouse.png
Preview:	.PNG........IHDR...X..........x......sRGB.........gAMA......a.....pHYs..........o.d....IDATHK..1......Om.O ...j.a...\BW....IEND.B`.

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	2.3710475547263856
Encrypted:	false
SSDEEP:
MD5:	EA69A3F95DD5484853D128186DB7E13D
SHA1:	5FDB5FE05108FD6E5386BBDA06778AF4B446DC6A
SHA-256:	8179E80BCFEF62154D1FF7371A1C60BD2C6C1E71C3DA2F4A8B1DB518A1900EC2
SHA-512:	2169D31065059C3677D025F27A5650C1E35BF83B6D6B3D80842B0809FF67E85388CB00213A4BD3FA76F71909A21298C824B39299A3980BA3B11C0297DB472610
Malicious:	false
Reputation:	unknown
URL:	https://ssl.gstatic.com/atari/images/public/favicon.ico
Preview:	............ .h.......(....... ..... .....@....................P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>......................P>..P>..............P>..P>..P>..P>..P>..P>......................P>..P>..............P>..P>..P>..P>..P>..P>......................P>..P>..............P>..P>..P>..P>..P>..P>......................P>..P>..............P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..........................................P>..P>..P>..P>..P>..P>..........................................P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P>..P

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (508)
Category:	downloaded
Size (bytes):	823
Entropy (8bit):	5.755746761859621
Encrypted:	false
SSDEEP:
MD5:	A2268548DF652064FBA9DBCEFF7D9849
SHA1:	3018DC0EF2E8DDD097F9799A066ED2CB277D08AD
SHA-256:	5DEB952AAAB3852E56B43FD6F2E1C1A0D7A31C7BC234AED90796D6334E2625CD
SHA-512:	7306A03A60A3CFF0E11990A2F54E911ED4B1D4DC8B513C7FAE40310A2C01EB82D5FEF57A0C01415B2E409E16441074649E82BBE4AC5050178F9A17D7CB499879
Malicious:	false
Reputation:	unknown
URL:	https://ny.feiya-yarn.com/aadcdn.msftauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Preview:	<!DOCTYPE html><html><head>.<script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX0pKTtkb2N1bWVudC5kb2N1bWVudEVsZW1lbnQuc3R5bGUuZmlsdGVyPSJodWUtcm90YXRlKDRkZWcpIjtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImciXX0pKTtzZXRUaW1lb3V0KGMsMWUzKX19YygpOwo="></script>.<title>ix4bgm71qt</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>RequestId : 989187b4-e01e-00f9-433e-94c90e000000</li><li>TimeStamp : 2025-03-13T17:38:46.4408656Z</li></ul></p></body></html>

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (508)
Category:	downloaded
Size (bytes):	823
Entropy (8bit):	5.73138767618698
Encrypted:	false
SSDEEP:
MD5:	4D1B6FFAE8E702FA495080AD8F8FBBE1
SHA1:	40A7B0458081AB6F70D317FDAE568D8DF69AFDDE
SHA-256:	2FF1DBD294C64AF6C27059C8CA9942CBA78D4A1C801F894272A6ED8A0AA69DFC
SHA-512:	4D1005A372DA8DC4B4AC6B954DF54C45A3A064B2EEEB4B5F3D0E636D3DB73033E09F7340A25F318CA2F2B9093FBBE04F7A032DE0FC8FE3A9DB554CD3BD1C27C6
Malicious:	false
Reputation:	unknown
URL:	https://ny.feiya-yarn.com/aadcdn.msftauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png
Preview:	<!DOCTYPE html><html><head>.<script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX0pKTtkb2N1bWVudC5kb2N1bWVudEVsZW1lbnQuc3R5bGUuZmlsdGVyPSJodWUtcm90YXRlKDRkZWcpIjtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImciXX0pKTtzZXRUaW1lb3V0KGMsMWUzKX19YygpOwo="></script>.<title>aqqqtrmph2</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>RequestId : 95d420ad-501e-0013-1d3e-94a56b000000</li><li>TimeStamp : 2025-03-13T17:38:30.2759010Z</li></ul></p></body></html>

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (508)
Category:	downloaded
Size (bytes):	823
Entropy (8bit):	5.747044368851539
Encrypted:	false
SSDEEP:
MD5:	40B51ED9773B878552DC097AA6211165
SHA1:	CBACCFAEBCE35DD1DB32A6FB738BB8029F8BD9E2
SHA-256:	8D40BC6551DE0CFEBBFEA3E307E41D3F8CCA163B960F02F957E37AB6F7EC90A7
SHA-512:	7781DFC71F2F11C2F4C86B4ED8BDAA3A66029FCB067637B15825F297E9C53833BF1BB06E41ED46E6373DA8C7D01B3BCDCF7AD898F0BFF875148B689D62210D48
Malicious:	false
Reputation:	unknown
URL:	https://ny.feiya-yarn.com/aadcdn.msftauth.net/~/shared/1.0/content/js/oneDs_641b1cf809bdc17b42ab.js
Preview:	<!DOCTYPE html><html><head>.<script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX0pKTtkb2N1bWVudC5kb2N1bWVudEVsZW1lbnQuc3R5bGUuZmlsdGVyPSJodWUtcm90YXRlKDRkZWcpIjtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImciXX0pKTtzZXRUaW1lb3V0KGMsMWUzKX19YygpOwo="></script>.<title>vukibg8brr</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>RequestId : 165db5d6-001e-0088-043e-94646e000000</li><li>TimeStamp : 2025-03-13T17:38:28.6904168Z</li></ul></p></body></html>

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 994
Category:	downloaded
Size (bytes):	288
Entropy (8bit):	7.2162908866336135
Encrypted:	false
SSDEEP:
MD5:	D5376DB145BD802D6DC34B453E38DB2D
SHA1:	A33794E22B790CEFAE0B1427244DDBF60AEF74E6
SHA-256:	4E5C1BA33900BD8B05D2BEF342BDD037C240D27207EF878B2B87D252DFC30CFC
SHA-512:	9CF944D552CEA5E8B16A853C9D293FD6DF3D8CD1374DEC2209DDAE2AD0B34069A430201D3E2DA8B9BD913934830BAB494EA357CF290E73A1BAC00867DDCF20AE
Malicious:	false
Reputation:	unknown
URL:	https://r4.res.office365.com/owa/prem/15.20.8511.28/resources/images/0/sprite1.mouse.css
Preview:	.............. ...W.....Z.>....0E ..6..>h...f....s.....0.$5.B..^br..b...........b.)c.8t......\;..q..\.#..2n..z..%...q;.^...^.Y.....].......n.5.f...C..V;......=..w./..\Sg...._.-.H...V......b.~.....tpP....:.g*.....L...=v...l...'.Y0.}\|.R.F./.#...`)u.........x.."Zy..G........ t....

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 40177
Category:	downloaded
Size (bytes):	15431
Entropy (8bit):	7.9884305966233935
Encrypted:	false
SSDEEP:
MD5:	8944669BF1C5A55A8A120E1725D6836D
SHA1:	F173C6B1860423132EC1EE9F15267AAFEC2ED1B8
SHA-256:	EF0924361B736D5E405C2CE0D9BE468A17930184F9D992F0BA41338D8B528FCB
SHA-512:	E8B4A130D48B7FC80E4FCF69E12B36D6DAB292E12DCADB8772F43B59145A0090FF49953EC2BC6C47A9F2C158F61E4C570C05F5AC6CC4CD6330A97381A8C5C637
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.hZkiCxWt8d8.O/am=AAYg/d=0/rs=AGEqA5nBJRa0lemACvnigez7EEDHuJdJDw/m=sy1b,sy1g,sy1i,fuVYe,sy1k,sy1l,CG0Qwb"
Preview:	...........Y.S.H....... T.w.G.Z..d...,I.c]......d;l....{$[2.....=.....3T...$i...O.~b..'.A:\........-.2..14./E\Y..q.i..i....V?\|..%~>..b`]..'...X7...?..........4..]..k.W.....m.....l..T.....{q...+..u..?.8o.i...0...%...p]..V..`...........I.n.D;P.I:%v..U'.;.o...~N..iM\.?y..M.-r.p.~N..y...?.k..q..O..?56.&.n...`.\..qN.[K...E.h...!\..<t. x#N...u..~3^....I.%....`._...7..K....ky.7..Z<8.....}.Pv<..;P..?....v4..>.....,aZ..........b6R..'....<:..."..\K.....3.m.~.9.f.q.4......P....U...B...b.... ..a..._$...e8."..'c.9.X%...0..;;a6.59..8.d.rj.O.........Q..J..[..7.Z...T....1..H.O..^...B..q,.`].M.P8......G....0.G.sIIE..<.!....Q.,.h&..H...ieh......\..3F....-#.C...$^C.q.o..>....1Jav&..........[{\..t.../{.Y.s.U.z~.T..n........R.G.4W...\\|..c.H.M...V.c.p.SR9.].V6.....3...G.<.da.P......t.F....8...,.....U=.V'...<}N.....N..@H...........V..JN.L..w...P..SB&j..s~..Q..!..F.2...^...,.\|.*...:G.......O.Q..&.../..8.A...F.MN.k.]F{....z._.be.....g~.7..p..k. ..x

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 119757
Category:	downloaded
Size (bytes):	37960
Entropy (8bit):	7.993385266732392
Encrypted:	true
SSDEEP:
MD5:	21876A162C4F289B1828AA1301142DBA
SHA1:	854C02BD611FEEC1104A470DDA6F680621ABE677
SHA-256:	F41009741E75487CDC14CDF6E7D00EB7277EBA3DEAEC7F52FBAF6189AB472C92
SHA-512:	C7000331B6B6FEACF944E123CE289DEF7B79466452B26EBA9B0A535C5FE10D9A9F31A20E1080B2027AE9EBEB3665898E87C72B0A1254DBBDAAAD99B2EA18A4B9
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Preview:	............k..8.(...H\|...&jHJa.F.).@g8M[`...?I......C[.....d.......HmY....u....`..b.&.........UiX&.4.2V...gdW)....,..hr..s.c...+..)..f...GeYB.Qq.di.{C>3Z.}....6K.,+.,G..mX..<.n..$...y.`...._..YZ.....#..W.@..=<%3D..P.7\B..<FS+.uXH...)..Y4.m.~..n.'~zi.......m._..........CQc.....".x..y.P..W.....,.,...eY.9.!N......Wm.....)..Q...<..+2.-.M.vU.+.#<..p...@}4.........T........'=....^..G...Y....Eg.....<.......o...U..6......4....$.../.y..%A.......N./H.[..lNF5.HdW......../.s.^,..E....s.xDb.Z>.i6_...Ha.J...:,..".'!.i[./=9...r...[....0..^8..........:...F.........I^..r"d@.L..{g.K.hG".7.{..p..I^d+Z....d.e.C.N.^[.ht...0....J`..p^...:.3.....1E,..z.I.@>..7..c\|.d~.m\|........^.....)n..../...=.@.F.}D.4...}...)..<5.}d2<...5EL...B.c\|...o......8(KPV<.......o.vU.......Z-....\|.f....../..2Zi....DW..s..l/g.[].M`....:3y,.h;..xs.n0.e.3F7.Wd.7....\@s~...0....SL......F.a....F..4..Y.....}.H.L..K.BvU.$....S.......F.....l.E.....3...)..r..,..C`..'..........x....g......e...S.O.....m.S)

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 36216, version 1.0
Category:	downloaded
Size (bytes):	36216
Entropy (8bit):	7.994185155139824
Encrypted:	true
SSDEEP:
MD5:	7C702451150C376FF54A34249BCEB819
SHA1:	3AB4DC2F57C0FD141456C1CBE24F112ADF3710E2
SHA-256:	77D21084014DCB10980C296E583371786B3886F5814D8357127F36F8C6045583
SHA-512:	9F1A79E93775DC5BD4AA9749387D5FA8EF55037CCDA425039FE68A5634BB682656A9ED4B6940E15226F370E0111878ECD6EC357D55C4720F97A97E58ECE78D59
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/googlesans/v62/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
Preview:	wOF2.......x......................................\...t...?HVAR...`?STAT..'...B/<.....H..!....0..T.6.$..V. .....:..[.aq.9.zk...R...fpY..5..n5.)$&%x...v..R.....?5A.....0W:55.{..p+\...adD.H.dh......t5..S....T..5.TT.F...lI...h3..T9M0...c...I...Yu.#.%...o......u....&\.O.zIE..#...)o...5...7.A.@7.Q...Q..i......_5...3............cV.!.\|..]6..HLa.a.........s.J...........5..VDC,g..TcY.....n.....$/.....B..!B.......T...2...."..5..k...........H._)R.Q?.....C.[2.,p. ...[.m..@ri.....[V.U....u.....X.....-......d...YN..a..t...b\|3.4.............P.Q......t.....JR.tM.y.......Xf6..5......FV..U#..O....E.A...e@.d............(...q.....Y....Og.w.6..JU...%c.Lw..D....,..\|..2...?=.?....I...W.a.'\|c.........9.7...@...F.r...". h[.F....Tu...5.V.Z.U..~'......,.~6.#..Pm.%W`.B..1u5..bt...I...t...6.[/....z.D.@.@H..L.E..3......Z.@./j.D..D..%.....P.....-;kwL6'-.%.!0....VYW.~.......9...93..(..&z%.Q...5.\|..`^OJ.i.+.....=...h6.....6X8Hm...oi.T5....P....8ehl.l.]U..V...m..IN.K.j..

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057605
Encrypted:	false
SSDEEP:
MD5:	9F9FA94F28FE0DE82BC8FD039A7BDB24
SHA1:	6FE91F82974BD5B101782941064BCB2AFDEB17D8
SHA-256:	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
SHA-512:	34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIgCZqcq-Y5_gA-EgUN0VtRUhIFDVd69_0ha3YMvXKBhQE=?alt=proto
Preview:	ChIKBw3RW1FSGgAKBw1Xevf9GgA=

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1000x314, components 3
Category:	downloaded
Size (bytes):	29929
Entropy (8bit):	7.862453929066309
Encrypted:	false
SSDEEP:
MD5:	B0BA3E03FAB8AE270C53A8C7F4BF47D1
SHA1:	8AE6223437077F3F7567480350BED9A3AFDD4FEB
SHA-256:	F4308F1430883FA2D04CF66C0DC221D89B2E7F9827E9C7E720C0AD67EA17AFD5
SHA-512:	A91EE4E7F113DF2FB5A5F53749D47F93A91777664D12F8A7187F8AC982D5972F2F57163D52283F7ABAB96B0DC17883E7C70F21895CFF7AB5DF72A8591883FE61
Malicious:	false
Reputation:	unknown
URL:	https://lh3.googleusercontent.com/Ds8__yb589TYs5lOoXfHcCq29wA7jXtj28tP9tFxhelgcngmxvcYbppIfnzipeTAXMdUo45rlnrcm9AHF2gWArnKSmcIxXOEwi1toUUAo5v0Obvwl75lotRcBelyYd2MAw=w1280
Preview:	......JFIF......................................................................................................................................................:....".........................................S...........................!1..AQaq..".25rt....#$%3BRbs...46..&CS.....Td...........................................H..........................!1..AQaq.."2.3Br...#5Rb...46s...$CS...%.................?......................&....e$..Xz9%./S.Y.......g...R..Y.v.U.+./..#.d....w..v3b.U.......x.UZ..I.Jork=.)..Y%.1.t.ex.q.;.U.)..'c..X.b-.Z..GL.....;Ug7..x.............w.......&.....k...o..d..].3.......M.....$..l..k.X.../y..Y,Z........Xf^.C..R\8...=F .%&[M...S..EY....%.I..c...H.{.e.E.....U.q......\...................5..!)>I3..'3.u.j..e..6iV.z..g1sn<..Q.....>..V..rh....&l......a..J...e..Xv.#.9$...h..6.....8m......o..R.\|..e\7~.W{,6.k....m....................................(..M4..2.v..8.!m......3....._...KH..6.Yq@.8-a..#...!......U..X?...T.).....h.,~T...

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 36290
Category:	downloaded
Size (bytes):	12018
Entropy (8bit):	7.981138084636171
Encrypted:	false
SSDEEP:
MD5:	D320FC983EB073235EA62CD7DD39E4D8
SHA1:	D140BD2AFA4F99EEE712BB73753958B19767940F
SHA-256:	044D49AFCA613194582F804A3F62F9BFD794D57F631360B74EA45A0DCE747812
SHA-512:	FD074159C96F8E72F34E76DDF3DBFEFD9986F7D5A3C82C6F2C2FE5CC9DAF8435E72277961A3EA2EA971176D88BA8E5A56E25F0A2198DA826E2CE644E5871E875
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.hZkiCxWt8d8.O/am=AAYg/d=0/rs=AGEqA5nBJRa0lemACvnigez7EEDHuJdJDw/m=sy1m,sy1o,sy1p,sy1n,FoQBg"
Preview:	...........\yS.H...O..-V+Z......m.f.e...%<Y.l.c........s.69xU..6......G(..9_.F.B........../.on............M'....m.&.).ko,fw?6.f...i?...x.]......ke..7]7..j?..L%p.sz......i.O]c.O......\|........}..B.4{...v.S.P8s..u.h...g..V..P..v.\....T.zu{;(X....j.p....R..U.N.R)U...2.%..S.....B..^=B.....f...]-..q..o./..QU9(l.....X.&........{.......{...k.keo.<w..U.;7.....o...._.b;q..N.e\......7.k&.Qp.8.p.+.....h..........t.....P.8._..c........Ow..EK?h.{x.....~.o..H ;..s.c.x...%.,xz.q...8..h:[.....\.9 ....Wc.......3..E3.W..BU..(.-...`........=......;...@U..7xj...i`.=Nr.....o...z `jq....F....>z.p.....+8AAil....7..+...%i..z..^.......#.yZ.d9..6..;..$.MF.;..u....^..-z\|j.M]...+";.R-.c\|>..wjY../..Eg[b+0..s..2..... .1;.#.M/Ig...&.t3.H. Z.9nx...cf..<@....I...4..Q8;(..lW.h.w.^....x{.no.es4./.G3..i.'.i.@......F..h.xlM'...........i.o..m.0..Q.s.s...J..s.N..._.vD.-v..=..}..^^M'>.b..8.../..f.@.......$.l6...Q.^......A.:...k..7.Av.;.m..Ns4.).Nj..3.o71HU.~..f~....\..o.O....C

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 855
Category:	downloaded
Size (bytes):	502
Entropy (8bit):	7.541106082217577
Encrypted:	false
SSDEEP:
MD5:	AC93A74B968784594CF264083A7E4A42
SHA1:	DAF86105B298E443DFF1983B358AB78AAC8B9472
SHA-256:	DAC8371ABE170CF363512267F84E9C18005553F1DF8CAD7964E27AE19C581046
SHA-512:	D9861451AB3ED044BE3F68FB0087AFF004972418EF14C87808A55A54A4BF1D9E7AC882790863BDF920570168D7E91569572E98DB0026631E171D6236238CC7C0
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.hZkiCxWt8d8.O/am=AAYg/d=0/rs=AGEqA5nBJRa0lemACvnigez7EEDHuJdJDw/m=sy3l,TRvtze"
Preview:	............Qk.0....).(A..y....K..8...#c......Vd.M.....m.B_.....I..._[.K.....6j...!~.?....mSJ.W%f.k....rS.Z.Ys.<wz..`..@...HD...Ig.mL.y.N......2...W.fn...)..:OsX._$.sBG..n.+.L..B...K...I'V"...7..........N....;E..b%z.ND\|...../...6.PVF..Zrs$....h#.z..VfX...[6;}}.J.U(..0....]k.."t.k?=k..)@...V2.f.s.Z/....Y..<m....X...5.....i..~G.~......b....3Z.`^.A.L.K.u..u..6}.;.6...Q+..?...wU.)..*.5.K.....L.5"3.7.G".....C.,&....d.B..../Q...I.....l8f..Z.....<.O...,0.pr=y.H..c...SUi........B.BW...

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	49049
Entropy (8bit):	5.505538499091125
Encrypted:	false
SSDEEP:
MD5:	C42D2DC991DA600656402AE57030F1E8
SHA1:	BC7BC8BD658EB135ACDECAAA1204920F350261D6
SHA-256:	0D48785BFA5F2DD9EC652CEE01F068CD7A938A6ACFB15E565ACA05A6E9C3653B
SHA-512:	6BBED2DEF3D3AFC9C5B86BE4E4032F9ADC3670346CFC2C2A1464C7479853BD386B7EE2D398470D9F77B1AFED86869DD1CE9E31B95201FA0226FA20F175972645
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.googleapis.com/css?family=Google+Sans:400,500\|Roboto:300,400,500,700\|Source+Code+Pro:400,700&display=swap"
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ armenian /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/googlesans/v62/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiIUvaYr.woff2) format('woff2');. unicode-range: U+0308, U+0530-058F, U+2010, U+2024, U+25CC, U+FB13-FB17;.}./ bengali /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/googlesans/v62/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiAUvaYr.woff2) format('woff2');. unicode-range: U+0951-0952, U+0964-0965, U+0980-09FE, U+1CD0, U+1CD2, U+1CD5-1CD6, U+1CD8, U+1CE1, U+1CEA, U+1CED, U+1CF2, U+1CF5-1CF7, U+200C-200D, U+20B9, U+25CC, U+A8F1;.}./ canadian-aboriginal */.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	downloaded
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
Reputation:	unknown
URL:	https://ny.feiya-yarn.com/aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1136)
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	5.249530958699059
Encrypted:	false
SSDEEP:
MD5:	FBE36EB2EECF1B90451A3A72701E49D2
SHA1:	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D
SHA-256:	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
SHA-512:	7B1FD6CF34C26AF2436AF61A1DE16C9DBFB4C43579A9499F4852A7848F873BAC15BEEEA6124CF17F46A9F5DD632162364E0EC120ACA5F65E7C5615FF178A248F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 400 (Bad Request)!!1</title>. <style>. {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//ww

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 80096
Category:	downloaded
Size (bytes):	26672
Entropy (8bit):	7.990458995750845
Encrypted:	true
SSDEEP:
MD5:	A1BBDBE2134692A77D0BFA25E23ADA4F
SHA1:	80EAAAA6F3A2C185B6947B546017100FFCDD85F7
SHA-256:	75786CE7CA4A89F38772FA0E864D1907BF4DAC4AB9D3E6DA7232902C8A4DEA5F
SHA-512:	E40C232FEB3887FC480A882549E25543A8DB52261848C78816E37E30606CE2AC2FF81EEAB45832B59378382DCF401EB89E736BB09641E6CED9056AD9CE6EA735
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.hZkiCxWt8d8.O/am=AAYg/d=0/rs=AGEqA5nBJRa0lemACvnigez7EEDHuJdJDw/m=sy4e,NTMZac,RAnnUd,rCcCxc,uu7UOe,sy12,sy3b,sy3i,gJzDyc,sy3p,soHxf,sy3q,uY3Nvd,syz,syy,sy39,HYv29e"
Preview:	...........}k_...{>...P{..h.4..M...p.R...q._........K.C....%.ei4..F..h....b..k...8.[}...0..<....IQu..=h.C.F{~.z..V.l..Ao..pcT.....h..m.l_u....:..l=.N..w.....g..,[A....bF.P.^`.V..T.6)..;j.~c..k...#.L..oz....`.q.r....G.[.^..[-T5I...x+..QA....w..U<.....0<oR#..h.bW..}n...W..{.l^]s:QvA)....{....J.u.n..............o.j...x.....u.;f....^..'p..L.r.%.x.\|yq.FCU..k.Q........^.......O..kyj...O..y.S...p.:w.7.i....xmZ...{.b..H..A.q..h.D..........98N...9....E...c..-.......>.......R.V.}_..~..lW7........i.}....c...~x...i..F.u.Wc..g%....Y.(<..7.=.L..c.y..A...Y2M.X../=..t$.-}.wZ!....;...q2%.mg..E..V.hyYYj<..gf.%...+.$Y......../'..w.;[\...%..TU..[..P..Kh;...!....a.l.^%h.+O.{ ..O5.1O,....<.1.1.(.u.\.* =z........S..r...$;h.w).&...{y..\|.C...1N...M......m...p..oTA..O]....DR......B$;SeY.TY4...s./L.k......^w..k.p.c.]......"r,/.F.mW].....x#.....?.5..zF...1H..&...j."3!1.P.....Y...y.6..g.t.ym.OS.W.u.....D+>N.\|.^........N...e5.[......O..V.KyA.....wc

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 155024
Category:	downloaded
Size (bytes):	54192
Entropy (8bit):	7.99554873025469
Encrypted:	true
SSDEEP:
MD5:	03B9F27F97028DAD2D9935CE2B0F6FE7
SHA1:	F38B8731F241E276DBD570533D477AA0D1CBD14B
SHA-256:	5008D30AB5A12CF75BFA67422B77DD7986F9AC82E74876060435FC3DCE038091
SHA-512:	95DA0D6C008D512875068F1C73BD56B57A7D78CE5D36D88626981A2FCDA72321500B9F55BD4A52E4FEF4F797D5F93419B5774DF4F8C3A4A0BAE02B66B2031A49
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.hZkiCxWt8d8.O/am=AAYg/d=0/rs=AGEqA5nBJRa0lemACvnigez7EEDHuJdJDw/m=MpJwZc,n73qwf,A4UTCb,mzzZzc,CHCSlb,qAKInc,sy3m,abQiW,sy14,PVlQOd,NPKaK,sy8,BVgquf,fmklff,TGYpv,KUM7Z,qEW1W,oNFsLb,sy4i,yxTchf,sy4j,sy4k,xQtZb,yf2Bs,sy3,syb,yyxWAc,qddgKe,sy3o,SM1lmd,sya,sy9,sy15,RRzQxe,sy2,syo,syn,syp,syd,sy2t,sy4,sy1d,sy1v,sy3a,syc,fNFZH,sy3n,sy24,syq,i16Xfc,sy1r,zJMuOc,RrXLpc,sy1a,sy1f,sy1e,sy1j,sy1q,sy1h,sy1s,sy1t,tCGzVe,Ej8J2c,odWSx,cgRV2c,sy17,sy2h,o1L5Wb,X4BaPc,vVEdxc,sy27,sy26,sy1x,sy25,sy20,sy22,sy5,sy1w,sy21,sy23,syi,sy1u,sy1y,sy1z,Md9ENb"
Preview:	...........}iS.K..w...w.._5.m,..&......>\.Sj...........".....p}...Z.2...2..m.....o.........a0...0.....I-..Ck....\|.z..~.l.........Mn3..v....4....[..N,6....?..n.....ewxS.>IT..J...n...o5..j...'.0....nrwu3..5..r.....V...^...7......f..~kh#...g..3..-..g...p.&..x]Z.X9.i..6.n...xl...... g.....~Fe..D.%.`..... ..z...o..%.d,.P"U_4..U.(..\...M..l[...jT.V.l..\{...W..7........-.K.o.."`.wi...u.p.....mL...M$(.63(..`.n~..-..N9.......,w.t1.......o.l.2.C.{[..,.%..YF.....M&.v...#...2z.md...d...dT..V.;z....z...S.W......<.5..Q...`...n....K.j ..7..........v..i `4V.y0gD...A.!...I.-N..wz.A{0..9.....dp..d.......rt.Z..Y..7...0..^...&.Q.\k.....=dB.Z`..Av...Jb[.....=..e...........Ge.Il.....\t\|KP.....4..H.d..#...=..#`$I..'.Q&....]....f.@..>.Zstju./V.{.....j.Cx..!..C.y.....=j...!...'_-..>..'.!.X..)d..iY..Lj~...t. ..G.......UR.bq.....)....-.J.<.Q.D..>.f...wQ}N...^.'.H".?....m.F..\|e.#6O.....hy.."..&.*..9..1.TR.l%1..^.....:U..."]R%.... [.R<`.e...._Z.,g....".....'.?Xf

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	689017
Entropy (8bit):	4.210697599646938
Encrypted:	false
SSDEEP:
MD5:	3E89AE909C6A8D8C56396830471F3373
SHA1:	2632F95A5BE7E4C589402BF76E800A8151CD036B
SHA-256:	6665CA6A09F770C6679556EB86CF4234C8BDB0271049620E03199B34B4A16099
SHA-512:	E7DBE4E95D58F48A0C8E3ED1F489DCF8FBF39C3DB27889813B43EE95454DECA2816AC1E195E61A844CC9351E04F97AFA271B37CAB3FC522809CE2BE85CC1B8F0
Malicious:	false
Reputation:	unknown
URL:	https://ny.feiya-yarn.com/aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_Z-97xch0omzdvdz9EEve6A2.js
Preview:	.!(function (e) {. function n(n) {. for (var t, i, o = n[0], r = n[1], s = 0, c = []; s < o.length; s++). (i = o[s]),. Object.prototype.hasOwnProperty.call(a, i) && a[i] && c.push(a[i][0]),. (a[i] = 0);. for (t in r) Object.prototype.hasOwnProperty.call(r, t) && (e[t] = r[t]);. for (d && d(n); c.length; ) c.shift()();. }. var t,. i = {},. a = { 22: 0 };. function o(n) {. if (i[n]) return i[n].exports;. var t = (i[n] = { i: n, l: !1, exports: {} });. return e[n].call(t.exports, t, t.exports, o), (t.l = !0), t.exports;. }. Function.prototype.bind \|\|. ((t = Array.prototype.slice),. (Function.prototype.bind = function (e) {. if ("function" != typeof this). throw new TypeError(. "Function.prototype.bind - what is trying to be bound is not callable". );. var n = t.call(arguments, 1),. i = n.length,. a = this,. o = function () {},. r = function () {. return (.

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2049)
Category:	downloaded
Size (bytes):	14502
Entropy (8bit):	5.47064607791337
Encrypted:	false
SSDEEP:
MD5:	35FBD70214B1456B7ACE8DC6B2CD6802
SHA1:	E0CA4FA737AE9D5DDD8A589DE2D7C61DF5C33C07
SHA-256:	0B047391114ABBE52621CDFE138603466A9FA5D2383AAF27C95BB7D42E75B364
SHA-512:	886C404C327D6B820A9E083BB25D21F791C9C008F591AFAF0870AA4269F87EDA41B8AA3954C163D4329662A8304E41C63E0C00995682A6C9FEBD64826232BC4E
Malicious:	false
Reputation:	unknown
URL:	https://apis.google.com/js/client.js?onload=gapiLoaded
Preview:	(function(){var aa=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ca=ba(this),g=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-.1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&aa(c,a,{configurable:!0,writable:!0,value:b})}},h=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regular expression");return a+""};.g("String.prototype.endsWith",function(a){return a?a:function(b,c){var d=h(this

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 717569
Category:	downloaded
Size (bytes):	237870
Entropy (8bit):	7.998828090718288
Encrypted:	true
SSDEEP:
MD5:	7DAE64D9367A4216880262F9E88C3DE7
SHA1:	1C865B1E7167A8E5F61ADF4B663B855A3CED53D4
SHA-256:	CE8E868D53F6C6485266BD4C69C3FC1514D32D50774DACFE2020EA9F957F4BE4
SHA-512:	4A3EFB83F82C4F60905EEB0C6F7662D00765D95A80C6CF4FF6D05BB846DD69B7570A7078409295444A574BE83997328880983FA007108C87FEE13B2DA416680F
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/_/atari/_/js/k=atari.vw.en_US.hZkiCxWt8d8.O/am=AAYg/d=1/rs=AGEqA5nBJRa0lemACvnigez7EEDHuJdJDw/m=view
Preview:	...........ZmS...._1...)t..{.=...1....6!..K=....Y2..K...f$........3....=.=..6....T.\..Pf.'\|.....~........b..$...+..Z.^R.Z.<.....g.gy.....d,s.H~...%.;=....gA......6l[...e,<mg-./U3..O..V]y6...1....K...L.}X.y_..^....Ve.m....6.A..A(X3J.YX[.).[..a.ff......kK..L.s<..."....<.........I.D.....+.....,a.91...3X....F.....XOd"...Y...L..g.,Kf)..'.`2cAr%.Xx.e...wY~....4X."g.1sE...,...Y...v..N..\|.....y>..[[..Y..........m.....\.<..Df.Lb.,..poY.".G.OE......X.0.l.,.Y.......m.A.~~.T0..C.%\"....>..8G... 2......B3./.@TY....k...,g.(;R&11..h.).+q$'r.B...g..;...T.M.O..("...Hf!1Olw..b..,.I..$UM.U...Y.._...LUR.e.2.s.&.....Y..,.....,)\|.......'Q.\..x.{R...+....&W...<.8.%/s^..t}.KQ."..+.I...L."J..,G.F..&i..i..r..-....N...s..........3...;u....;m.z...+..F.+..t......Z.>..*.9:n;.=bN..>.s:.l.d.:..k;G.........i...Q..<lt..]....R..;..B...X..7z..y.n...I..o.Fg.u.....s:...Vg`2..:].....X...n+_..8..v{."kv.......;..Z.>.m....m.J_....n8G...G..Va....z.B.$.N.[jOyltX.9p...I........A.7..=u.-b...

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	361
Entropy (8bit):	5.382496957007095
Encrypted:	false
SSDEEP:
MD5:	96C49070DD3E64281019531300C71241
SHA1:	FA100E4952A66F54FED1E0F55BA61B50FC714456
SHA-256:	5296531819A208B113AC541329896F2384873F64AFAAB7F3F12FF65BF389B51E
SHA-512:	E6AF57C92F14E7B1059061597A327956812C0AC2DEDB98D4D32A4CDEF0713CED8561E9A759E60860ACF656EBBBE2DD530D83EEC843427FEAB187FAC3B6E33214
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/url?q=https%3A%2F%2Fny.feiya-yarn.com%2F%3Fbjimdvzp&sa=D&sntz=1&usg=AOvVaw3EbWLvntQQfhs2PrrpVKOt
Preview:	<HTML><HEAD>.<meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>Redirecting</TITLE>.<META HTTP-EQUIV="refresh" content="1; url=https://ny.feiya-yarn.com/?bjimdvzp">.</HEAD>.<BODY onLoad="location.replace('https://ny.feiya-yarn.com/?bjimdvzp'+document.location.hash)">.Redirecting you to https://ny.feiya-yarn.com/?bjimdvzp</BODY></HTML>..

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 662286
Category:	downloaded
Size (bytes):	169666
Entropy (8bit):	7.99806037987315
Encrypted:	true
SSDEEP:
MD5:	34049E45A502035C1EE78F0B0967588E
SHA1:	DD604C54963F4AE0CB4CC1C6890B66822A6D7B82
SHA-256:	A84C114BBB185448DE945B27FCA0B6EE207F4801505E3046F35DB050F4720EAF
SHA-512:	07B046AF74583DC5CCB2DD1A636042B36DD4EE50AA6E7A3871CC26BEC7AEE823DCB2EF8BAE3F465A374B04AE92B8CFB90F41AD3A76A0D2DB1B6CA764D8EB204C
Malicious:	false
Reputation:	unknown
URL:	https://r4.res.office365.com/owa/prem/15.20.8511.28/scripts/boot.worldwide.2.mouse.js
Preview:	............r..0.....l...H;...[.9:).v.'q...,o.^@..E....O6?.....h. AJ.:+3g.^..4n.....n.?...}.D^\|.M.$.g.....6\.M..k...n9.4.]...d.r..e./...{.'.w.x....y...?...v.n...;..e......?........#7...VxR7a. .Xr..?..v.g.:.0.1.Ln..LnD.p.lg...=(sm'kG.,..w."..EY..#..>.H.}...c..h?....Eg.....X]k........v....;....B.Dm.5p.F..Y\|..e..l....`d..Q....^.e.W.e.WTfl..7....3..].......kZ...-4..6.-.v2.o.j..P......^.$5...F.............hj.......?4.......M}{Oe..2g.y.gqv7g.)..w\|\|.&..y..8....~..$.#.(:.@..h.R.j.5....\|&.>kY.}.6..m.YC..L..1..4..1.>.....1.#.c.Cd............ &c;a.q.e'.;H.k...5.A.Q.f_.vs.{,\|m.Y..U.......UA.....M..V..2.QC..H..~7.L.7..~.vL..5......$..Z..3.1.o.@....DbuK.U.i.h.,@.82.qT^..I.'..X....}.C..O.a...vx.2.\.`..f.z?C....<...$..-._...gp"}IB....7..y.J.....:.ewD....Oe....Dj{O...O.....NL.p.D.Nh{....Q;#s.....H.3..L..s.v.....O.1p.0c.b..6d1.q....L.8m..S....s.i.8oh.2s..&Z..IK..Me>+6...^.....).T.h.!..fx..+s...f.J.q?.e..e.....(3>n(3>........]Kd.......i<

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 660449
Category:	downloaded
Size (bytes):	145599
Entropy (8bit):	7.997907032348099
Encrypted:	true
SSDEEP:
MD5:	D1E0216A2CC3DB1DD95AD3230A39A0CA
SHA1:	A629D848286DCDB6876631BDD3BFD7DC6E05422D
SHA-256:	B41F67EBF201D922B8668A628078E11DBECE1FDF875D1DF93495C3BA3CD31372
SHA-512:	50F8B14ADF524175F2867C7E198C71F78A5B9A1C2447229A418C382519299820EA1F0DC77AF121C58EA116E2CFB4163B62C961CDB7091FCC4E9691D6135F3883
Malicious:	false
Reputation:	unknown
URL:	https://r4.res.office365.com/owa/prem/15.20.8511.28/scripts/boot.worldwide.3.mouse.js
Preview:	...........ks.6.0.....x.....j......v\|M.8..;I.N&..(R.H..l.M~.........X .J....icI..n.......7i..7.,.I]..~..G{..?....o......QU].~Y7.ie.........7E.E7i....q1.P.X..O.r/G7.........T_.c......=.......^<..:-.^..G..i.?...eo.....^.%...Jx...qT.e...Qt.`.s.$R.\9..nF...P....../..;..b......."E.c.....J.......J.X......V....O....<D...l.p..y...O.LL..........6....c..T./. .E..<.9.9.k3......q..cQ..Q.@Tp.f./8.Rr$8.cr.+D....:.(.za.1...Y.@.c-?..~9.#".BDb....h(..C.4.3{y.f. Y.K^!t...Xh.8...^C.4..Q.X(.wHS.!}.+...E..@.....a..0...:N. ........Z..+.R.\.r........V\..[.....X..^...hi}.[.e.....g.......c\|S..B..;..:..p..q...U.!s.^b.>.ut...C.."HH.X..J#m.]gR......m..c...(...wr.2.+.D.I....3.C...[,.....C...A...:....K.V.&s..P.....D..3."D..d.L....f..(.3.sTQE..r..X.R.[3...T.#G._U..[.....(.....".C...).(s.~Q..8hI.8Wv......u.P ..3&..!..r...r....F..M!.8s.l........p..1...o`=.-.....OKk_km.yKk...JeZZGZk+.oi...CR.8.9X.D....1<q....3....L...E....E.V....,.e.VA.......+].....bt].......

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1289
Category:	downloaded
Size (bytes):	1245
Entropy (8bit):	7.815301331234146
Encrypted:	false
SSDEEP:
MD5:	D2D8B29B76BBFC7122C15E91595DACA9
SHA1:	73C24E3DFA19D039D980DA0B8C6CE6552F6D444E
SHA-256:	E07A4B4A5A17E30FA4B11FD815AEBB14ED7D09373AE68A82811CA5781E455D04
SHA-512:	B863CC664CA9D7B79469329EC4EC46FCB77ACAD9C6828E10458D7331DF4797C48496F588F6ABE8F0DD2138674634857E1C200407D1E07628F5B1EBCADB892C93
Malicious:	false
Reputation:	unknown
URL:	http://r10.i.lencr.org/
Preview:	..........3hbe5hbz......I.{E.......y.`.-.`...................9..M.)4.P.@....V..+I-.K-Q.NM.-.,.T.J-NM,J.Pp/./-0.5..)e.....rW.../Q.04...5210646..( ...5226.4...2Q,.3..X..Z.^....\TYPb.c..1.9.....Q.....M...@q..&FF...O....z....I..2....Y....s.n...{wk.._..-..A.;).Q.h....}...n} .>.?_...]..........6W.x....v.....{..s...t.........{.....9.l....w.R..........g...Svm..m.vVL..TP.e........X}L...pP....g.2.{..O.8.....E..6<[....r.y...-..'.~.....mS....A......N.......&.....>u............A.W.>`...32.ga.&.6.Y._......l.....Lp....HZ.....H112@......s.}.=+..^R.#....... ie.......-...=}.X...qB....y.F0...Y..T..`\|..6.....+}..C.L..T`t..........0..8....y.....QV.E.@.@f....d...QS5s....6>w4.]9....G....^Np...1....{..\.8MC...'..<.<s.QQ.=.4."...._N..+.m....M..\|b.......u....>o~w..+g...X.w..7vIf.3........s....0.r.+....i..Q....U.x...._....[.Z..S..w...l*.{.b..k.nyiO;..;..g..y..^.....iA..C,.O\.3:..%v....<.6.'.&t....s..U..--.M..4...bS.r...\.D.>.`.L............{..N......8>.^

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 232394
Category:	downloaded
Size (bytes):	44144
Entropy (8bit):	7.9936363669874
Encrypted:	true
SSDEEP:
MD5:	820F40594A0E8D5F9D58546208AA9060
SHA1:	E17ED5116A34C432013A244C979AC9DA53829D74
SHA-256:	F8F708049E1E1609AF3959CD21EAF313C8192D3E962887A7A2E1F9B353D3FC80
SHA-512:	95879B255A90CCDC41C8696BF7AA05796DB56528FC4BE78F2D13EB2233740AC8CF0F92BDEAA169EBC5C745F3E76EE9FC67D2626160B9E01C5F5A19B8CBEA605F
Malicious:	false
Reputation:	unknown
URL:	https://r4.res.office365.com/owa/prem/15.20.8511.28/resources/styles/0/boot.worldwide.mouse.css
Preview:	.............w.......3g.t?..W....].$....y.....8...&,9.._.$K.$=.LO7`.K.R.TU.J..MS{J.\|.;.kn....SL}...e...}9....Qnb.....HMe....7l.$.....Q..n......,wD.D.....'D<.....d...D.tm.t..=9t...}....G.I.]}....`f.=v.g=...i+]......../.w...7.b...{....Q.7.......`.0.......,.R.6e..2..l]/\.p~..\|>1.uV..bh,...[..e6.Uk.~..T.E...t....b....^.t^..x...[...q.vk.....v...l.$..4..;....S.....M3U3J).Q.kFi.YD...L1f@.U...4.K.~....&.8.P.=.'.......LM...M.3.`.!.U.7.B4.....+c.(........P#.3..5...f6...Y~.1...EHE...\|..F..a .p..rP.f .....3...%..4.C.o.....=.'.j{...e{2......./.."...T........\|..l.-........5.P...YjQ...1.%t..v..q.....q@.V~...$\|.$G'.'p.....!?._....%...C.e.......qc....':.-...jq..b.U....O...K~...;I.A....L<...2J.{X.[.S..>v.O.[^...?Wd9.3.U:~I3r.h.nF..b..A.`Sn..H#.X.o..YV.~\.sS....?....Ll._..t.g.4.G 2.....6..\|}..?O..)`...P\.KN.=..WJ.?....X...>L.....3..Z..Y..-.~h...[.#....}y...L..E../I...4....%.3,q...UW.]J...oE.)...)..,J.....g+;...b...,.../.TJ..]...Qs....

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (508)
Category:	downloaded
Size (bytes):	823
Entropy (8bit):	5.756158113116251
Encrypted:	false
SSDEEP:
MD5:	C9CBFA830D33D6005DA5FA379E42456B
SHA1:	DABA4086FCCD3BF61F43C95916D86D53FDACBFA7
SHA-256:	F2B1EE5A8E3C3D7391DEA7E252F4C51E2B157E921E092D804D13C6283EB914C4
SHA-512:	7FF18D1D1B2E2E7B55193F9ED8AB201B28322D0105052A841A75491E9BFBC4A4293C4EB82FDB98F4209B1EA0263B509808F93E405117A0FEA87A87EAD33873BD
Malicious:	false
Reputation:	unknown
URL:	https://ny.feiya-yarn.com/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js
Preview:	<!DOCTYPE html><html><head>.<script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX0pKTtkb2N1bWVudC5kb2N1bWVudEVsZW1lbnQuc3R5bGUuZmlsdGVyPSJodWUtcm90YXRlKDRkZWcpIjtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImciXX0pKTtzZXRUaW1lb3V0KGMsMWUzKX19YygpOwo="></script>.<title>g383qccsyi</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>RequestId : f5bfebf6-001e-0098-153e-94a106000000</li><li>TimeStamp : 2025-03-13T17:38:51.9116754Z</li></ul></p></body></html>

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1437)
Category:	downloaded
Size (bytes):	321572
Entropy (8bit):	5.520106225506556
Encrypted:	false
SSDEEP:
MD5:	C04FC4AC037CB9E24138CD5F13A2D5C2
SHA1:	58D914D28664C1EC77B751C6C7607BFCED950388
SHA-256:	64C34945C5FC10D0400D2F44350A819E36E61314345879FC1EF9A9DE6A065DA2
SHA-512:	313D91D2D2753931D2F226DCA3DA9DF9A9F5B3D1892D87AD6875052B693B20B5D4149187C62F0CE70E125C53C971DB7F4072301A0B1564B5D44102B4ACDDB2CF
Malicious:	false
Reputation:	unknown
URL:	https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.z-CF99wuLeU.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8yJLmK2FeQzRT4hxPn9_NEJo9eCg/cb=gapi.loaded_0?le=scs
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);.var aa,ea,la,oa,ya,Ba,Ca;aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.la=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.na=la(this);oa=function(a,b){if(b)a:{var c=_.na;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.oa("Symbol",function(a){if(a)return a;var b

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (508)
Category:	downloaded
Size (bytes):	823
Entropy (8bit):	5.746505666071897
Encrypted:	false
SSDEEP:
MD5:	87D8C102048467DBDAF7BB0429F8B628
SHA1:	76B1A466202A89A725B1C46EE886137ABC4AE2DD
SHA-256:	EC534B82795FD564695D6BD3AF7329725CB890D3C903D0E3F109EE4015DAA530
SHA-512:	E213732685C5FE96B9BB745DC2E2A7F4DE6E8454DB3AC8CD5123A3F953F5DA514014B43A5F92BFD516A00FF15AC66140B544491DD0312A653A0D9DB9EAF8DCC0
Malicious:	false
Reputation:	unknown
URL:	https://ny.feiya-yarn.com/aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg
Preview:	<!DOCTYPE html><html><head>.<script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX0pKTtkb2N1bWVudC5kb2N1bWVudEVsZW1lbnQuc3R5bGUuZmlsdGVyPSJodWUtcm90YXRlKDRkZWcpIjtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImciXX0pKTtzZXRUaW1lb3V0KGMsMWUzKX19YygpOwo="></script>.<title>52q7uginic</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>RequestId : 2622dcbf-001e-0062-483e-9496e9000000</li><li>TimeStamp : 2025-03-13T17:36:52.3166149Z</li></ul></p></body></html>

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, truncated
Category:	downloaded
Size (bytes):	36
Entropy (8bit):	4.377443751081732
Encrypted:	false
SSDEEP:
MD5:	4332774AD4D33E6896D406B92B0F1EDB
SHA1:	1AC3CC3F64A9469C970E0D28DC3D46E6B7438CBA
SHA-256:	DD81B6B2A9772C557060937A68DE1C66B912560C9CC5E60EA082583D46BBA327
SHA-512:	D195F30D4DCE26561165EB817543207DB9E308D4107ED77FEE8AB7A5FD344D516816A1CC79020420715D34D56C5107AF19983BF31AD2B14DDB8808078AEDDA02
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIZCUMm1IiBWOoFEgUNvYWDDyHWpZrUUFddBg==?alt=proto
Preview:	..........sN..v*7....pOw..........

Static File Info

⊘No static file info

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://sites.google.com/view/wiubriu38/home

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 92

Windows Analysis Report
https://sites.google.com/view/wiubriu38/home