Edit tour

Windows Analysis Report
https://ergv54ergrz.s3.amazonaws.com/uhdigth1.html

Overview

General Information

Sample URL:	https://ergv54ergrz.s3.amazonaws.com/uhdigth1.html
Analysis ID:	1412017
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found iframes

HTML body contains low number of good links

HTML title does not match URL

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4600 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4856 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1992,i,3046317749516513628,7685400228688099596,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7120 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5444 --field-trial-handle=1992,i,3046317749516513628,7685400228688099596,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1196 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4312 --field-trial-handle=1992,i,3046317749516513628,7685400228688099596,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ergv54ergrz.s3.amazonaws.com/uhdigth1.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://ergv54ergrz.s3.amazonaws.com/uhdigth1.html

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=78e755e6-fe53-48f1-bb28-f29138935622&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.18.0&x-client-OS=&x-client-CPU=&client_info=1&code_challenge=Y4vSJUJLLQT02zrnz96k2V421_2YULvTqvuSNksHKmQ&code_challenge_method=S256&prompt=none&nonce=709b270c-8372-4504-b375-dfe1a634af97&state=eyJpZCI6IjkyODQwOGEwLWIzYTItNDAwMi1hYjEzLTAwOTA2MDdkNmY5YSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19

Source: https://www.bing.com/secure/Passport.aspx?popup=1&ssl=1	HTTP Parser: No favicon
Source: https://www.youtube.com/embed/Wl9EmRip9V4?autoplay=1&enablejsapi=1&origin=https://www.bing.com&rel=0&mute=1	HTTP Parser: No favicon
Source: https://www.youtube.com/embed/Wl9EmRip9V4?autoplay=1&enablejsapi=1&origin=https://www.bing.com&rel=0&mute=1	HTTP Parser: No favicon
Source: https://www.youtube.com/embed/Wl9EmRip9V4?autoplay=1&enablejsapi=1&origin=https://www.bing.com&rel=0&mute=1	HTTP Parser: No favicon
Source: https://www.youtube.com/embed/Wl9EmRip9V4?autoplay=1&enablejsapi=1&origin=https://www.bing.com&rel=0&mute=1	HTTP Parser: No favicon
Source: https://www.youtube.com/embed/Wl9EmRip9V4?autoplay=1&enablejsapi=1&origin=https://www.bing.com&rel=0&mute=1	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=78e755e6-fe53-48f1-bb28-f29138935622&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.18.0&x-client-OS=&x-client-CPU=&client_info=1&code_challenge=Y4vSJUJLLQT02zrnz96k2V421_2YULvTqvuSNksHKmQ&code_challenge_method=S256&prompt=none&nonce=709b270c-8372-4504-b375-dfe1a634af97&state=eyJpZCI6IjkyODQwOGEwLWIzYTItNDAwMi1hYjEzLTAwOTA2MDdkNmY5YSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No favicon

Source: chromecache_1337.2.dr	String found in binary or memory: http://adaptivecards.io/schemas/adaptive-card.json
Source: chromecache_611.2.dr, chromecache_819.2.dr	String found in binary or memory: http://feross.org
Source: chromecache_1573.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_1589.2.dr, chromecache_448.2.dr, chromecache_817.2.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: chromecache_1302.2.dr	String found in binary or memory: http://www.beian.gov.cn/portal/registerSystemInfo?recordcode=11010802022657
Source: chromecache_1573.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_831.2.dr	String found in binary or memory: https://angular.io/license
Source: chromecache_908.2.dr	String found in binary or memory: https://api.msn.com/news/feed/pages/binghp?activityId=3D700543-AE81-4E96-BCC7-08D01A12B199&timeOut=2
Source: chromecache_908.2.dr	String found in binary or memory: https://apnews.com/article/california-budget-deficit-29315d622212facef307ddab29d4c0c7
Source: chromecache_1546.2.dr	String found in binary or memory: https://assets.msn.com/statics/icons/Microsoft_16_SVG.ico
Source: chromecache_1162.2.dr	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/$
Source: chromecache_1132.2.dr	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/shopping/discountTag.svg
Source: chromecache_1132.2.dr	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3872652/shopping/plusw.svg
Source: chromecache_1132.2.dr	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3872652/shopping/tick.svg
Source: chromecache_898.2.dr	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-4067035/forum/deliveryTruck.svg
Source: chromecache_898.2.dr	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-4318916/forum/buyDirectBlackFriday.svg
Source: chromecache_898.2.dr	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-4421438/forum/videoIcon.svg
Source: chromecache_898.2.dr	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-4421438/forum/videoPlayIcon.svg
Source: chromecache_1302.2.dr	String found in binary or memory: https://beian.miit.gov.cn/
Source: chromecache_1037.2.dr	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=3056
Source: chromecache_1037.2.dr	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=4118
Source: chromecache_510.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_908.2.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm
Source: chromecache_908.2.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm-dark
Source: chromecache_908.2.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0
Source: chromecache_908.2.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0-dark
Source: chromecache_1335.2.dr	String found in binary or memory: https://cdn.shopify.com/s/files/1/0065/5812/2036/products/Baby_Jersey_Bodysuit-Front_1024x1024.jpg?v
Source: chromecache_1335.2.dr	String found in binary or memory: https://cdn.shopify.com/s/files/1/0065/5812/2036/products/CoupleRunning_116b0436-cd87-4e2f-a4c4-a02a
Source: chromecache_1335.2.dr	String found in binary or memory: https://cdn.shopify.com/s/files/1/0065/5812/2036/products/Hooded_Sweatshirt-Women-White-Front2_1024x
Source: chromecache_1335.2.dr	String found in binary or memory: https://cdn.shopify.com/s/files/1/0065/5812/2036/products/White_T-shirt_design-front_1024x1024.jpg?v
Source: chromecache_448.2.dr	String found in binary or memory: https://developers.google.com/youtube/iframe_api_reference#Events
Source: chromecache_1307.2.dr	String found in binary or memory: https://fb.me/react-polyfills
Source: chromecache_1573.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_1589.2.dr, chromecache_448.2.dr, chromecache_817.2.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: chromecache_866.2.dr	String found in binary or memory: https://github.com/microsoft/clarity
Source: chromecache_510.2.dr	String found in binary or memory: https://googlesyndication.com
Source: chromecache_1580.2.dr	String found in binary or memory: https://highlightjs.org/
Source: chromecache_908.2.dr	String found in binary or memory: https://honemaxwell.com/california-exit-tax/#:~:text=For%20taxable%20years%20from%202024
Source: chromecache_908.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA172lhg.img
Source: chromecache_908.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA172lhi.img
Source: chromecache_908.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA172nIc.img
Source: chromecache_908.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA18WVAl.img
Source: chromecache_908.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hhcfw.img
Source: chromecache_908.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hheoT.img
Source: chromecache_908.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hhs8s.img
Source: chromecache_908.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1jWIH2.img
Source: chromecache_908.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1kBpgW.img
Source: chromecache_908.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAYyiCx.img
Source: chromecache_908.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAYyopp.img
Source: chromecache_908.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1kb40J.img
Source: chromecache_908.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1kb40O.img
Source: chromecache_908.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1kb8N6.img
Source: chromecache_908.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBUvpML.img
Source: chromecache_908.2.dr	String found in binary or memory: https://itif.org/publications/2022/09/30/oops-the-predicted-47-percent-of-job-loss-from-ai-didnt-hap
Source: chromecache_817.2.dr	String found in binary or memory: https://jnn-pa.googleapis.com
Source: chromecache_1196.2.dr	String found in binary or memory: https://login.chinacloudapi.cn
Source: chromecache_1548.2.dr, chromecache_1562.2.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0
Source: chromecache_1196.2.dr, chromecache_1462.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_911.2.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: chromecache_911.2.dr	String found in binary or memory: https://login.microsoftonline.com/common/discovery/v2.0/keys
Source: chromecache_911.2.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/token
Source: chromecache_1303.2.dr, chromecache_1257.2.dr	String found in binary or memory: https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration
Source: chromecache_1196.2.dr	String found in binary or memory: https://login.microsoftonline.de
Source: chromecache_1196.2.dr	String found in binary or memory: https://login.microsoftonline.us
Source: chromecache_1196.2.dr, chromecache_1462.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_1337.2.dr	String found in binary or memory: https://msasg.visualstudio.com/Bing_Ads/_workitems/edit/3905327
Source: chromecache_1337.2.dr	String found in binary or memory: https://msasg.visualstudio.com/ContentServices/_workitems/edit/3620803
Source: chromecache_1198.2.dr	String found in binary or memory: https://nitricwell.com/0/0/0/2734ac06a6295ef72c4f8a72588f86fd/19/8/
Source: chromecache_908.2.dr	String found in binary or memory: https://openai.com/blog/chatgpt/
Source: chromecache_510.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_510.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_817.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_1307.2.dr	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: chromecache_817.2.dr	String found in binary or memory: https://redux.js.org/api/store#subscribelistener
Source: chromecache_817.2.dr	String found in binary or memory: https://redux.js.org/tutorials/fundamentals/part-4-store#creating-a-store-with-enhancers
Source: chromecache_817.2.dr	String found in binary or memory: https://redux.js.org/tutorials/fundamentals/part-4-store#middleware
Source: chromecache_817.2.dr	String found in binary or memory: https://redux.js.org/tutorials/fundamentals/part-6-async-logic#using-the-redux-thunk-middleware
Source: chromecache_1562.2.dr	String found in binary or memory: https://storage.live.com/users/0x
Source: chromecache_510.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_908.2.dr	String found in binary or memory: https://theconversation.com/no-wonder-fox-hunting-is-still-prevalent-the-ban-is-designed-to-fail-bri
Source: chromecache_908.2.dr	String found in binary or memory: https://www.alumni.hbs.edu/stories/Pages/story-bulletin.aspx?num=7824
Source: chromecache_908.2.dr	String found in binary or memory: https://www.bls.gov/oes/
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/33-high-paying-jobs-for-people-who-dont-like-stress-2019-3
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/ai-chatgpt-college-professors-students-cheating-2023-1
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/british-telecom-ceo-ai-replace-jobs-chatgpt-bt-2023-5
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/buzzfeed-writers-react-ai-generated-articles-content-chatgpt-maker-o
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/chatgpt-amazon-employees-use-ai-chatbot-software-coding-customer-que
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/chatgpt-google-could-get-hired-as-coder-internal-document-report-202
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/chatgpt-job-applications-hiring-managers-job-interview-candidate-202
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/chatgpt-jobs-at-risk-replacement-artificial-intelligence-ai-labor-tr
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/chatgpt-midjourney-ai-write-illustrate-childrens-book-one-weekend-al
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/generative-ai-chatpgt-300-million-full-time-jobs-goldman-sachs-2023-
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/i-asked-chatgpt-to-write-insider-story-it-was-convincing-2022-12
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/ibm-halts-hiring-for-7800-jobs-that-could-be-replaced-by-ai-report-2
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/jobs-at-risk-from-ai-replace-change-chatgpt-automation-study-2023-7
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/openai-chatgpt-contractors-train-ai-software-engineering-autonomous-
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/tech-site-issued-corrections-after-ai-writing-got-facts-wrong-2023-1
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/top-coding-languages-for-wall-street-jobs-banks-hedge-funds-2022-11
Source: chromecache_908.2.dr	String found in binary or memory: https://www.businessinsider.com/wharton-mba-professor-requires-students-to-use-chatgpt-ai-cheating-2
Source: chromecache_908.2.dr	String found in binary or memory: https://www.cbsnews.com/news/chatgpt-chat-ai-jobs-most-likely-to-be-replaced/
Source: chromecache_863.2.dr	String found in binary or memory: https://www.gettyimages.com/detail/1125576617?utm_medium=organic&utm_source=google&utm_campa
Source: chromecache_754.2.dr	String found in binary or memory: https://www.gettyimages.com/detail/1194601649?utm_medium=organic&utm_source=google&utm_campa
Source: chromecache_510.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_510.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_510.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_868.2.dr	String found in binary or memory: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Source: chromecache_1337.2.dr	String found in binary or memory: https://www.lotteryusa.com/mega-millions/
Source: chromecache_1337.2.dr	String found in binary or memory: https://www.lotteryusa.com/powerball/
Source: chromecache_1193.2.dr	String found in binary or memory: https://www.msn.com
Source: chromecache_1337.2.dr	String found in binary or memory: https://www.msn.com/$
Source: chromecache_908.2.dr	String found in binary or memory: https://www.msn.com/en-us/lifestyle/pets/the-rarest-dog-breeds/ss-AA1hhcgc
Source: chromecache_908.2.dr	String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/a-grim-trend-among-americans-without-college-deg
Source: chromecache_908.2.dr	String found in binary or memory: https://www.msn.com/en-us/news/opinion/the-supreme-court-is-about-an-inch-away-from-legalizing-bribe
Source: chromecache_908.2.dr	String found in binary or memory: https://www.msn.com/en-us/news/politics/milley-responds-to-trump-execution-comments-it-s-a-free-coun
Source: chromecache_908.2.dr	String found in binary or memory: https://www.msn.com/en-us/news/us/fiery-school-board-meeting-brings-out-black-panthers-in-virginia/a
Source: chromecache_908.2.dr	String found in binary or memory: https://www.msn.com/en-us/news/us/peter-navarro-is-1st-trump-white-house-official-to-serve-prison-ti
Source: chromecache_1548.2.dr	String found in binary or memory: https://www.msn.com:443/en-us/shopping?bngred=1&isembedded=1&disableheader=1&ocid=startW
Source: chromecache_908.2.dr	String found in binary or memory: https://www.nytimes.com/2022/12/06/opinion/chatgpt-ai-skilled-jobs-automation.html
Source: chromecache_908.2.dr	String found in binary or memory: https://www.onetonline.org/
Source: chromecache_908.2.dr	String found in binary or memory: https://www.onetonline.org/find/descriptor/result/1.C.4.b?a=1
Source: chromecache_908.2.dr	String found in binary or memory: https://www.oxfordmartin.ox.ac.uk/downloads/academic/future-of-employment.pdf
Source: chromecache_908.2.dr	String found in binary or memory: https://www.savvydime.com/california-isnt-the-only-state-planning-to-tax-the-rich-to-solve-inequity-
Source: chromecache_908.2.dr	String found in binary or memory: https://www.savvydime.com/the-dreaded-california-wealth-tax-has-finally-arrived/
Source: chromecache_779.2.dr, chromecache_881.2.dr	String found in binary or memory: https://www.suno.ai/legal/privacy
Source: chromecache_779.2.dr, chromecache_881.2.dr	String found in binary or memory: https://www.suno.ai/legal/terms
Source: chromecache_1582.2.dr	String found in binary or memory: https://www.suno.ai/privacy)
Source: chromecache_1582.2.dr	String found in binary or memory: https://www.suno.ai/terms)
Source: chromecache_908.2.dr	String found in binary or memory: https://www.theverge.com/2022/12/5/23493932/chatgpt-ai-generated-answers-temporarily-banned-stack-ov
Source: chromecache_908.2.dr	String found in binary or memory: https://www.theverge.com/2023/2/14/23599330/buzzfeeds-ai-quizzes-openai-automation-digital-media
Source: chromecache_908.2.dr	String found in binary or memory: https://www.theverge.com/2023/3/30/23663206/buzzfeed-ai-travel-guides-buzzy
Source: chromecache_908.2.dr	String found in binary or memory: https://www.wsj.com/articles/california-wealth-tax-bill-sacramento-democrats-gavin-newsom-f0c723b6
Source: chromecache_1335.2.dr	String found in binary or memory: https://www.youngrebelz.com/products/baby-jersey-bodysuit-white
Source: chromecache_1335.2.dr	String found in binary or memory: https://www.youngrebelz.com/products/hooded-sweatshirt-women-white-1
Source: chromecache_1335.2.dr	String found in binary or memory: https://www.youngrebelz.com/products/short-sleeve-white-t-shirt
Source: chromecache_1335.2.dr	String found in binary or memory: https://www.youngrebelz.com/products/soltea
Source: chromecache_448.2.dr	String found in binary or memory: https://www.youtube.com
Source: chromecache_1222.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api
Source: chromecache_908.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=WY-dLyZSA10

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1992,i,3046317749516513628,7685400228688099596,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ergv54ergrz.s3.amazonaws.com/uhdigth1.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5444 --field-trial-handle=1992,i,3046317749516513628,7685400228688099596,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4312 --field-trial-handle=1992,i,3046317749516513628,7685400228688099596,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1992,i,3046317749516513628,7685400228688099596,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5444 --field-trial-handle=1992,i,3046317749516513628,7685400228688099596,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4312 --field-trial-handle=1992,i,3046317749516513628,7685400228688099596,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source	Detection	Scanner	Label	Link
https://ergv54ergrz.s3.amazonaws.com/uhdigth1.html	0%	Avira URL Cloud	safe
https://ergv54ergrz.s3.amazonaws.com/uhdigth1.html	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label
https://redux.js.org/tutorials/fundamentals/part-4-store#creating-a-store-with-enhancers	0%	URL Reputation	safe
https://beian.miit.gov.cn/	0%	URL Reputation	safe
https://redux.js.org/tutorials/fundamentals/part-4-store#middleware	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://redux.js.org/tutorials/fundamentals/part-6-async-logic#using-the-redux-thunk-middleware	0%	URL Reputation	safe
https://redux.js.org/api/store#subscribelistener	0%	URL Reputation	safe
https://www.suno.ai/privacy)	0%	Avira URL Cloud	safe
https://www.oxfordmartin.ox.ac.uk/downloads/academic/future-of-employment.pdf	0%	Avira URL Cloud	safe
https://www.suno.ai/legal/terms	0%	Avira URL Cloud	safe
https://www.youngrebelz.com/products/hooded-sweatshirt-women-white-1	0%	Avira URL Cloud	safe
https://honemaxwell.com/california-exit-tax/#:~:text=For%20taxable%20years%20from%202024	0%	Avira URL Cloud	safe
https://login.microsoftonline.us	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe
https://www.youngrebelz.com/products/short-sleeve-white-t-shirt	0%	Avira URL Cloud	safe
https://www.suno.ai/legal/privacy	0%	Avira URL Cloud	safe
https://www.savvydime.com/the-dreaded-california-wealth-tax-has-finally-arrived/	0%	Avira URL Cloud	safe
https://www.youngrebelz.com/products/baby-jersey-bodysuit-white	0%	Avira URL Cloud	safe
https://www.suno.ai/terms)	0%	Avira URL Cloud	safe
http://www.beian.gov.cn/portal/registerSystemInfo?recordcode=11010802022657	0%	Avira URL Cloud	safe
https://itif.org/publications/2022/09/30/oops-the-predicted-47-percent-of-job-loss-from-ai-didnt-hap	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
https://www.msn.com/en-us/shopping?bngred=1&isembedded=1&disableheader=1&ocid=startWidget&FORM=Z9LHS4	false		high
about:blank	false	Avira URL Cloud: safe	low
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=78e755e6-fe53-48f1-bb28-f29138935622&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.18.0&x-client-OS=&x-client-CPU=&client_info=1&code_challenge=Y4vSJUJLLQT02zrnz96k2V421_2YULvTqvuSNksHKmQ&code_challenge_method=S256&prompt=none&nonce=709b270c-8372-4504-b375-dfe1a634af97&state=eyJpZCI6IjkyODQwOGEwLWIzYTItNDAwMi1hYjEzLTAwOTA2MDdkNmY5YSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.microsoftonline.com/	chromecache_911.2.dr	false		high
https://www.businessinsider.com/top-coding-languages-for-wall-street-jobs-banks-hedge-funds-2022-11	chromecache_908.2.dr	false		high
https://redux.js.org/tutorials/fundamentals/part-4-store#creating-a-store-with-enhancers	chromecache_817.2.dr	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm-dark	chromecache_908.2.dr	false		high
https://www.savvydime.com/the-dreaded-california-wealth-tax-has-finally-arrived/	chromecache_908.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0-dark	chromecache_908.2.dr	false		high
https://www.suno.ai/privacy)	chromecache_1582.2.dr	false	Avira URL Cloud: safe	unknown
https://api.msn.com/news/feed/pages/binghp?activityId=3D700543-AE81-4E96-BCC7-08D01A12B199&timeOut=2	chromecache_908.2.dr	false		high
https://cdn.shopify.com/s/files/1/0065/5812/2036/products/White_T-shirt_design-front_1024x1024.jpg?v	chromecache_1335.2.dr	false		high
https://openai.com/blog/chatgpt/	chromecache_908.2.dr	false		high
https://msasg.visualstudio.com/Bing_Ads/_workitems/edit/3905327	chromecache_1337.2.dr	false		high
https://www.youtube.com/watch?v=WY-dLyZSA10	chromecache_908.2.dr	false		high
https://www.msn.com/en-us/news/us/peter-navarro-is-1st-trump-white-house-official-to-serve-prison-ti	chromecache_908.2.dr	false		high
https://www.msn.com/$	chromecache_1337.2.dr	false		high
https://www.theverge.com/2022/12/5/23493932/chatgpt-ai-generated-answers-temporarily-banned-stack-ov	chromecache_908.2.dr	false		high
https://www.youtube.com	chromecache_448.2.dr	false		high
https://www.google.com	chromecache_510.2.dr	false		high
https://www.youtube.com/iframe_api	chromecache_1222.2.dr	false		high
https://login.microsoftonline.us	chromecache_1196.2.dr	false	Avira URL Cloud: safe	unknown
https://www.businessinsider.com/chatgpt-job-applications-hiring-managers-job-interview-candidate-202	chromecache_908.2.dr	false		high
https://beian.miit.gov.cn/	chromecache_1302.2.dr	false	URL Reputation: safe	unknown
https://assets.msn.com/staticsb/statics/latest/shopping/discountTag.svg	chromecache_1132.2.dr	false		high
https://www.msn.com	chromecache_1193.2.dr	false		high
https://assets.msn.com/staticsb/statics/pr-3872652/shopping/tick.svg	chromecache_1132.2.dr	false		high
https://redux.js.org/tutorials/fundamentals/part-4-store#middleware	chromecache_817.2.dr	false	URL Reputation: safe	unknown
https://msasg.visualstudio.com/ContentServices/_workitems/edit/3620803	chromecache_1337.2.dr	false		high
https://assets.msn.com/staticsb/statics/pr-4421438/forum/videoIcon.svg	chromecache_898.2.dr	false		high
https://www.gettyimages.com/detail/1125576617?utm_medium=organic&utm_source=google&utm_campa	chromecache_863.2.dr	false		high
https://www.businessinsider.com/wharton-mba-professor-requires-students-to-use-chatgpt-ai-cheating-2	chromecache_908.2.dr	false		high
https://bugs.chromium.org/p/v8/issues/detail?id=4118	chromecache_1037.2.dr	false		high
https://github.com/madler/zlib/blob/master/zlib.h	chromecache_1589.2.dr, chromecache_448.2.dr, chromecache_817.2.dr	false		high
https://github.com/microsoft/clarity	chromecache_866.2.dr	false		high
https://login.microsoftonline.com/common/discovery/v2.0/keys	chromecache_911.2.dr	false		high
https://login.microsoftonline.de	chromecache_1196.2.dr	false		high
https://www.wsj.com/articles/california-wealth-tax-bill-sacramento-democrats-gavin-newsom-f0c723b6	chromecache_908.2.dr	false		high
http://adaptivecards.io/schemas/adaptive-card.json	chromecache_1337.2.dr	false		high
https://www.suno.ai/legal/terms	chromecache_779.2.dr, chromecache_881.2.dr	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/staticsb/statics/pr-4067035/forum/deliveryTruck.svg	chromecache_898.2.dr	false		high
https://www.youngrebelz.com/products/hooded-sweatshirt-women-white-1	chromecache_1335.2.dr	false	Avira URL Cloud: safe	unknown
https://www.oxfordmartin.ox.ac.uk/downloads/academic/future-of-employment.pdf	chromecache_908.2.dr	false	Avira URL Cloud: safe	unknown
https://www.youngrebelz.com/products/short-sleeve-white-t-shirt	chromecache_1335.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0	chromecache_908.2.dr	false		high
https://www.bls.gov/oes/	chromecache_908.2.dr	false		high
https://www.businessinsider.com/chatgpt-amazon-employees-use-ai-chatbot-software-coding-customer-que	chromecache_908.2.dr	false		high
https://www.suno.ai/legal/privacy	chromecache_779.2.dr, chromecache_881.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/douglascrockford/JSON-js	chromecache_1573.2.dr	false		high
https://www.msn.com/en-us/news/politics/milley-responds-to-trump-execution-comments-it-s-a-free-coun	chromecache_908.2.dr	false		high
https://www.businessinsider.com/buzzfeed-writers-react-ai-generated-articles-content-chatgpt-maker-o	chromecache_908.2.dr	false		high
https://cct.google/taggy/agent.js	chromecache_510.2.dr	false	URL Reputation: safe	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_817.2.dr	false		high
http://www.opensource.org/licenses/mit-license.php)	chromecache_1573.2.dr	false		high
https://cdn.shopify.com/s/files/1/0065/5812/2036/products/Hooded_Sweatshirt-Women-White-Front2_1024x	chromecache_1335.2.dr	false		high
http://tools.ietf.org/html/rfc1950	chromecache_1589.2.dr, chromecache_448.2.dr, chromecache_817.2.dr	false		high
https://honemaxwell.com/california-exit-tax/#:~:text=For%20taxable%20years%20from%202024	chromecache_908.2.dr	false	Avira URL Cloud: safe	unknown
https://www.gettyimages.com/detail/1194601649?utm_medium=organic&utm_source=google&utm_campa	chromecache_754.2.dr	false		high
https://theconversation.com/no-wonder-fox-hunting-is-still-prevalent-the-ban-is-designed-to-fail-bri	chromecache_908.2.dr	false		high
https://www.onetonline.org/	chromecache_908.2.dr	false		high
https://www.businessinsider.com/ai-chatgpt-college-professors-students-cheating-2023-1	chromecache_908.2.dr	false		high
https://www.businessinsider.com/jobs-at-risk-from-ai-replace-change-chatgpt-automation-study-2023-7	chromecache_908.2.dr	false		high
https://www.businessinsider.com/generative-ai-chatpgt-300-million-full-time-jobs-goldman-sachs-2023-	chromecache_908.2.dr	false		high
https://www.businessinsider.com/chatgpt-google-could-get-hired-as-coder-internal-document-report-202	chromecache_908.2.dr	false		high
https://www.lotteryusa.com/mega-millions/	chromecache_1337.2.dr	false		high
https://assets.msn.com/staticsb/statics/pr-4421438/forum/videoPlayIcon.svg	chromecache_898.2.dr	false		high
https://www.youngrebelz.com/products/baby-jersey-bodysuit-white	chromecache_1335.2.dr	false	Avira URL Cloud: safe	unknown
http://www.beian.gov.cn/portal/registerSystemInfo?recordcode=11010802022657	chromecache_1302.2.dr	false	Avira URL Cloud: safe	unknown
https://www.alumni.hbs.edu/stories/Pages/story-bulletin.aspx?num=7824	chromecache_908.2.dr	false		high
https://assets.msn.com/statics/icons/Microsoft_16_SVG.ico	chromecache_1546.2.dr	false		high
https://storage.live.com/users/0x	chromecache_1562.2.dr	false		high
https://login.chinacloudapi.cn	chromecache_1196.2.dr	false		high
https://www.businessinsider.com/british-telecom-ceo-ai-replace-jobs-chatgpt-bt-2023-5	chromecache_908.2.dr	false		high
https://cdn.shopify.com/s/files/1/0065/5812/2036/products/CoupleRunning_116b0436-cd87-4e2f-a4c4-a02a	chromecache_1335.2.dr	false		high
https://login.windows-ppe.net	chromecache_1196.2.dr, chromecache_1462.2.dr	false		high
https://developers.google.com/youtube/iframe_api_reference#Events	chromecache_448.2.dr	false		high
https://cdn.shopify.com/s/files/1/0065/5812/2036/products/Baby_Jersey_Bodysuit-Front_1024x1024.jpg?v	chromecache_1335.2.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm	chromecache_908.2.dr	false		high
https://www.msn.com:443/en-us/shopping?bngred=1&isembedded=1&disableheader=1&ocid=startW	chromecache_1548.2.dr	false		high
https://login.microsoftonline.com	chromecache_1196.2.dr, chromecache_1462.2.dr	false		high
https://assets.msn.com/staticsb/statics/pr-4318916/forum/buyDirectBlackFriday.svg	chromecache_898.2.dr	false		high
https://www.nytimes.com/2022/12/06/opinion/chatgpt-ai-skilled-jobs-automation.html	chromecache_908.2.dr	false		high
https://www.msn.com/en-us/news/us/fiery-school-board-meeting-brings-out-black-panthers-in-virginia/a	chromecache_908.2.dr	false		high
https://www.theverge.com/2023/3/30/23663206/buzzfeed-ai-travel-guides-buzzy	chromecache_908.2.dr	false		high
https://login.microsoftonline.com/common/oauth2/v2.0/token	chromecache_911.2.dr	false		high
https://itif.org/publications/2022/09/30/oops-the-predicted-47-percent-of-job-loss-from-ai-didnt-hap	chromecache_908.2.dr	false	Avira URL Cloud: safe	unknown
https://www.onetonline.org/find/descriptor/result/1.C.4.b?a=1	chromecache_908.2.dr	false		high
https://redux.js.org/tutorials/fundamentals/part-6-async-logic#using-the-redux-thunk-middleware	chromecache_817.2.dr	false	URL Reputation: safe	unknown
https://www.businessinsider.com/i-asked-chatgpt-to-write-insider-story-it-was-convincing-2022-12	chromecache_908.2.dr	false		high
https://assets.msn.com/staticsb/statics/pr-3872652/shopping/plusw.svg	chromecache_1132.2.dr	false		high
https://redux.js.org/api/store#subscribelistener	chromecache_817.2.dr	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/careersandeducation/a-grim-trend-among-americans-without-college-deg	chromecache_908.2.dr	false		high
https://www.theverge.com/2023/2/14/23599330/buzzfeeds-ai-quizzes-openai-automation-digital-media	chromecache_908.2.dr	false		high
https://www.businessinsider.com/ibm-halts-hiring-for-7800-jobs-that-could-be-replaced-by-ai-report-2	chromecache_908.2.dr	false		high
https://www.suno.ai/terms)	chromecache_1582.2.dr	false	Avira URL Cloud: safe	unknown
https://reactjs.org/docs/error-decoder.html?invariant=	chromecache_1307.2.dr	false		high
http://knockoutjs.com/	chromecache_1573.2.dr	false		high
https://www.businessinsider.com/openai-chatgpt-contractors-train-ai-software-engineering-autonomous-	chromecache_908.2.dr	false		high
https://www.msn.com/en-us/lifestyle/pets/the-rarest-dog-breeds/ss-AA1hhcgc	chromecache_908.2.dr	false		high
https://www.lotteryusa.com/powerball/	chromecache_1337.2.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
142.251.35.182	unknown	United States	15169	GOOGLEUS	false
204.79.197.200	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.200.3.32	unknown	United States	20940	AKAMAI-ASN1EU	false
172.253.63.84	unknown	United States	15169	GOOGLEUS	false
142.251.40.206	unknown	United States	15169	GOOGLEUS	false
142.250.64.110	unknown	United States	15169	GOOGLEUS	false
157.240.241.35	unknown	United States	32934	FACEBOOKUS	false
104.21.19.116	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.40.131	unknown	United States	15169	GOOGLEUS	false
13.107.213.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.209.72.32	unknown	United States	20940	AKAMAI-ASN1EU	false
157.240.241.1	unknown	United States	32934	FACEBOOKUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.117.182.27	unknown	United States	20940	AKAMAI-ASN1EU	false
142.251.35.174	unknown	United States	15169	GOOGLEUS	false
13.107.5.80	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
23.44.201.27	unknown	United States	20940	AKAMAI-ASN1EU	false
152.199.4.44	unknown	United States	15133	EDGECASTUS	false
142.250.80.74	unknown	United States	15169	GOOGLEUS	false
142.251.40.136	unknown	United States	15169	GOOGLEUS	false
195.133.30.14	unknown	Russian Federation	21453	FLEX-ASRU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.32.110	unknown	United States	15169	GOOGLEUS	false
52.182.143.210	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.72.97	unknown	United States	15169	GOOGLEUS	false
142.250.72.110	unknown	United States	15169	GOOGLEUS	false
23.209.72.20	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.65.202	unknown	United States	15169	GOOGLEUS	false
23.219.82.18	unknown	United States	20940	AKAMAI-ASN1EU	false
142.251.41.1	unknown	United States	15169	GOOGLEUS	false
23.200.3.10	unknown	United States	20940	AKAMAI-ASN1EU	false
31.13.71.36	unknown	Ireland	32934	FACEBOOKUS	false
40.126.24.148	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.65.182	unknown	United States	15169	GOOGLEUS	false
13.107.21.200	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.40.102	unknown	United States	15169	GOOGLEUS	false
18.238.49.99	unknown	United States	16509	AMAZON-02US	false
142.250.64.74	unknown	United States	15169	GOOGLEUS	false
104.21.3.162	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.40.196	unknown	United States	15169	GOOGLEUS	false
20.246.175.39	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.42.73.25	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.209.72.15	unknown	United States	20940	AKAMAI-ASN1EU	false
3.5.17.197	unknown	United States	14618	AMAZON-AESUS	false
23.44.201.43	unknown	United States	20940	AKAMAI-ASN1EU	false
23.209.72.8	unknown	United States	20940	AKAMAI-ASN1EU	false
23.199.50.102	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.176.196	unknown	United States	15169	GOOGLEUS	false
142.250.65.194	unknown	United States	15169	GOOGLEUS	false
142.250.80.99	unknown	United States	15169	GOOGLEUS	false
23.219.82.8	unknown	United States	20940	AKAMAI-ASN1EU	false
20.190.152.20	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.129.36	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.135.9	unknown	United States	15169	GOOGLEUS	false
142.251.40.99	unknown	United States	15169	GOOGLEUS	false
23.44.201.11	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.176.195	unknown	United States	15169	GOOGLEUS	false
204.79.197.203	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1412017
Start date and time:	2024-03-19 21:47:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://ergv54ergrz.s3.amazonaws.com/uhdigth1.html
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@39/1598@0/62
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.bing.com/chat?q=Bing+AI&FORM=hpcodx Browse: https://www.bing.com/chat?q=Bing+AI&FORM=hpcodx Browse: https://www.bing.com/images?FORM=Z9LH Browse: https://www.bing.com/videos?FORM=Z9LH1 Browse: https://www.bing.com/shop?FORM=Z9LHS4

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2483), with no line terminators
Category:	downloaded
Size (bytes):	2483
Entropy (8bit):	5.118791495328502
Encrypted:	false
SSDEEP:	48:2JU5qdQKF0c10+toDP/SzKyDKz4OKtjoatv6CKlDvgIUIzf1xdIE:2JeqdQu9z6DPSTDi8JvWlDzzfJIE
MD5:	9FC246A7871F4AB15C3FF4B6BC653C95
SHA1:	CF7A116642B19A632A1B39C8179FD6B262605E15
SHA-256:	0E59C859FBAACB9D73F18A98F0684FA1EB737AB89D21FB55D5F8A6691CDC9950
SHA-512:	C48C0C4F5891E5D0254F02471840D4954DDC79C965578F10E6F1EB04CB48A4E3C000E02F6B887AF3696A8B872EDDE90767DF613696A568F5FF887B5039D6E567
Malicious:	false
Reputation:	low
URL:	https://r.bing.com/rp/z3oRZkKxmmMqGznIF5_WsmJgXhU.js
Preview:	(function(){function o(n){var i=t(n,!0,!0),r,u;if(i==null\|\|!a(i.colSp,i.items[0])){i.call!=null&&i.call(!1,{IsSuccess:!1});return}r=i.items[0];u=v(i.colSp,r);FavRequest.setRequestType(r.type!=1);FavRequest.addItem(u).then(function(n){i.call(n)})["catch"](function(n){return n})}function s(n){var i=t(n,!1,!0),r,u;if(i==null\|\|!w(i.items[0])){i.call!=null&&i.call(!1,{IsSuccess:!1});return}r=i.items[0];u=b(i.colSp,r);FavRequest.setRequestType(r.type!=1);FavRequest.deleteItems(u).then(function(n){i.call(n)})["catch"](function(n){return n})}function h(n){var i=t(n,!1,!0),r;i!=null&&(r=g(i.items),FavRequest.setRequestType(i.items[0].type!=1),FavRequest.getStatus(r).then(function(n){i.call(n)})["catch"](function(n){return n}))}function c(n){var i=t(n,!0,!1);i!=null&&(FavRequest.setRequestType(!0),FavRequest.deleteCollection(i.colSp).then(function(n){i.call(n)})["catch"](function(n){return n}))}function t(n,t,i){var u,r,f;return!n\|\|n.length<3?null:(u=n[1],t&&u==null)?null:(r=n[2],i&&(r==null\|\|r.

Source: chromecache_510.2.dr	String found in binary or memory: "tags":[{"function":"__googtag","metadata":["map"],"once_per_event":true,"vtp_tagId":"G-HWYYQ487XD","tag_id":3},{"function":"__gaawe","metadata":["map"],"once_per_event":true,"vtp_sendEcommerceData":false,"vtp_eventSettingsTable":["list",["map","parameter","value","parameterValue",["macro",1]],["map","parameter","currency","parameterValue",["macro",2]],["map","parameter","items","parameterValue",["macro",3]]],"vtp_eventName":"add_to_cart","vtp_measurementIdOverride":"G-HWYYQ487XD","vtp_enableUserProperties":true,"vtp_enableMoreSettingsOption":true,"vtp_enableEuid":false,"vtp_migratedToV2":true,"vtp_demoV2":false,"tag_id":11},{"function":"__gaawe","metadata":["map"],"once_per_event":true,"vtp_sendEcommerceData":false,"vtp_eventSettingsTable":["list",["map","parameter","currency","parameterValue",["macro",2]],["map","parameter","value","parameterValue",["macro",1]],["map","parameter","items","parameterValue",["macro",3]]],"vtp_eventName":"CheckoutBegin","vtp_measurementIdOverride":"G-HWYYQ487XD","vtp_enableUserProperties":true,"vtp_enableMoreSettingsOption":true,"vtp_enableEuid":false,"vtp_migratedToV2":true,"vtp_demoV2":false,"tag_id":13},{"function":"__gaawe","metadata":["map"],"once_per_event":true,"vtp_sendEcommerceData":false,"vtp_eventSettingsTable":["list",["map","parameter","value","parameterValue",["macro",1]],["map","parameter","currency","parameterValue",["macro",2]],["map","parameter","items","parameterValue",["macro",3]],["map","parameter","transaction_id","parameterValue",["macro",4]]],"vtp_eventName":"purchase","vtp_measurementIdOverride":"G-HWYYQ487XD","vtp_enableUserProperties":true,"vtp_enableMoreSettingsOption":true,"vtp_enableEuid":false,"vtp_migratedToV2":true,"vtp_demoV2":false,"tag_id":16},{"function":"__html","metadata":["map"],"once_per_load":true,"vtp_html":"\u003Cscript type=\"text\/gtmscript\"\u003E!function(b,e,f,g,a,c,d){b.fbq\|\|(a=b.fbq=function(){a.callMethod?a.callMethod.apply(a,arguments):a.queue.push(arguments)},b._fbq\|\|(b._fbq=a),a.push=a,a.loaded=!0,a.version=\"2.0\",a.queue=[],c=e.createElement(f),c.async=!0,c.src=g,d=e.getElementsByTagName(f)[0],d.parentNode.insertBefore(c,d))}(window,document,\"script\",\"https:\/\/connect.facebook.net\/en_US\/fbevents.js\");fbq(\"init\",\"1243031260431092\");fbq(\"track\",\"PageView\");\u003C\/script\u003E \n\n\u003Cnoscript\u003E\u003Cimg height=\"1\" width=\"1\" style=\"display:none\" src=\"https:\/\/www.facebook.com\/tr?id=1243031260431092\u0026amp;ev=PageView\u0026amp;noscript=1\"\u003E\u003C\/noscript\u003E ","vtp_supportDocumentWrite":false,"vtp_enableIframeMode":false,"vtp_enableEditJsMacroBehavior":false,"tag_id":17},{"function":"__html","metadata":["map"],"once_per_event":true,"vtp_html":["template","\u003Cscript type=\"text\/gtmscript\"\u003Efbq(\"track\",\"InitiateCheckout\",{currency:",["escape",["macro",2],8,16],",value:",["escape",["macro",1],8,16],",items:",["escape",["macro",3],8,16],"});\u003C\/script\u003E\n\u003Cnoscript\u003E\u003Cimg height=\"1\" width=
Source: chromecache_908.2.dr	String found in binary or memory: </p>","focalRegion":{"x1":94,"x2":152,"y1":61,"y2":119},"source":"msn"}},{"title":"Addressing the Budget Deficit Through Taxation","body":"<p>John Williams <a href=\"https://www.youtube.com/watch?v=WY-dLyZSA10\">highlights</a> California's substantial budget deficit of <a href=\"https://apnews.com/article/california-budget-deficit-29315d622212facef307ddab29d4c0c7\">$68 billion</a>. The state's response involves implementing a <a href=\"https://www.wsj.com/articles/california-wealth-tax-bill-sacramento-democrats-gavin-newsom-f0c723b6\">wealth tax</a>, which includes the annual taxation of the rich based on their assets. equals www.youtube.com (Youtube)
Source: chromecache_1194.2.dr	String found in binary or memory: (function() { var sharingGlobalConfig ={"thumbnailUrlFormat":"https://www.bing.com/th?id={0}","defaultFormCode":"EX0023","facebookShareFormat":"https://www.facebook.com/dialog/feed?app_id={3}\u0026display=popup\u0026link={0}\u0026redirect_uri={1}\u0026ref={2}","facebookMessengerUrlFormat":"http://www.facebook.com/dialog/send?app_id={0}\u0026display=popup\u0026link={1}\u0026redirect_uri={2}","facebookFormCode":"EX0023","fbInitialHeight":576,"fbmInitialWidth":640,"facebookAppId":"3732605936979161","twitterApi":"https://twitter.com/intent/tweet?hashtags={0}\u0026text={1}\u0026url={2}","twitterFormCode":"EX0024","twitterInitialHeight":576,"twitterInitialWidth":720,"defaultInitialHeight":255,"whatsAppSchema":"whatsapp://send?text={0}","whatsAppStoreUrl":"","whatsAppFormCode":"EX0053","mailLauncherUrl":"mailto:?subject={0} \u0026body={1}","mailFormCode":"EX0025","smsProtocol":"","smsFormCode":"EX0052","loadingUrl":"/loading","useBlankLoadingPage":false,"closeRedirectUrl":"/share/fbre","pinterestUrlFormat":"https://pinterest.com/pin/create/button/?url={0}\u0026media={1}\u0026description={2}","pinterestFormCode":"EX0051","mybingFormCode":"shtomb","mybingRedirectUrl":"https://www.bing.com/myprofile?tid=id_chatmessagetab\u0026FORM=shtomb","skypeUrlFormat":"https://web.skype.com/share?url={0}\u0026source=button\u0026text={1}","skypeInitialHeight":665,"skypeInitialWidth":305,"outlookComLauncherUrl":"https://outlook.live.com/owa/?subject={0}\u0026body={1}\u0026path=/mail/action/compose","gmailLauncherUrl":"https://mail.google.com/mail/?view=cm\u0026fs=1\u0026tf=1\u0026su={0}\u0026body={1}","linkedInUrlFormat":"https://www.linkedin.com/shareArticle?mini=true\u0026url={0}\u0026title={1}\u0026summary={2}","linkedInFormCode":"EX0062","oneNoteUrlFormat":"https://www.onenote.com/clipper/save?attributionUrl={0}\u0026sourceUrl={1}\u0026imgUrl={1}\u0026title={2}\u0026description={3}","oneNoteInitialHeight":565,"oneNoteInitialWidth":550,"oneNoteFormCode":"EX0060","checkAppInstall":"","checkAppTimeout":200,"weiboShareFormat":"https://service.weibo.com/share/share.php?title={0}\u0026placeholder=Bing\u0026url={1}\u0026pic={2}","weiboFormCode":"SHDLWE","qzoneShareFormat":"https://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?title={0}\u0026summary={1}\u0026url={2}\u0026pics={3}","qzoneFormCode":"SHDLQZ","isCNEnglishSearch":false,"redditShareFormat":"https://www.reddit.com/submit?url={0}\u0026title={1}","redditFormCode":"EX0061","useLocationReplace":false,"getUrlFormCode":"EX0050","enableGetShareLinkFromServerForGetUrl":true,"isUnderside":false}; if(sj_evt) { sj_evt.fire("GlobalActionMenuV2Wrapper.InitSharingGlobalConfig", sharingGlobalConfig); } })();; equals www.facebook.com (Facebook)
Source: chromecache_1194.2.dr	String found in binary or memory: (function() { var sharingGlobalConfig ={"thumbnailUrlFormat":"https://www.bing.com/th?id={0}","defaultFormCode":"EX0023","facebookShareFormat":"https://www.facebook.com/dialog/feed?app_id={3}\u0026display=popup\u0026link={0}\u0026redirect_uri={1}\u0026ref={2}","facebookMessengerUrlFormat":"http://www.facebook.com/dialog/send?app_id={0}\u0026display=popup\u0026link={1}\u0026redirect_uri={2}","facebookFormCode":"EX0023","fbInitialHeight":576,"fbmInitialWidth":640,"facebookAppId":"3732605936979161","twitterApi":"https://twitter.com/intent/tweet?hashtags={0}\u0026text={1}\u0026url={2}","twitterFormCode":"EX0024","twitterInitialHeight":576,"twitterInitialWidth":720,"defaultInitialHeight":255,"whatsAppSchema":"whatsapp://send?text={0}","whatsAppStoreUrl":"","whatsAppFormCode":"EX0053","mailLauncherUrl":"mailto:?subject={0} \u0026body={1}","mailFormCode":"EX0025","smsProtocol":"","smsFormCode":"EX0052","loadingUrl":"/loading","useBlankLoadingPage":false,"closeRedirectUrl":"/share/fbre","pinterestUrlFormat":"https://pinterest.com/pin/create/button/?url={0}\u0026media={1}\u0026description={2}","pinterestFormCode":"EX0051","mybingFormCode":"shtomb","mybingRedirectUrl":"https://www.bing.com/myprofile?tid=id_chatmessagetab\u0026FORM=shtomb","skypeUrlFormat":"https://web.skype.com/share?url={0}\u0026source=button\u0026text={1}","skypeInitialHeight":665,"skypeInitialWidth":305,"outlookComLauncherUrl":"https://outlook.live.com/owa/?subject={0}\u0026body={1}\u0026path=/mail/action/compose","gmailLauncherUrl":"https://mail.google.com/mail/?view=cm\u0026fs=1\u0026tf=1\u0026su={0}\u0026body={1}","linkedInUrlFormat":"https://www.linkedin.com/shareArticle?mini=true\u0026url={0}\u0026title={1}\u0026summary={2}","linkedInFormCode":"EX0062","oneNoteUrlFormat":"https://www.onenote.com/clipper/save?attributionUrl={0}\u0026sourceUrl={1}\u0026imgUrl={1}\u0026title={2}\u0026description={3}","oneNoteInitialHeight":565,"oneNoteInitialWidth":550,"oneNoteFormCode":"EX0060","checkAppInstall":"","checkAppTimeout":200,"weiboShareFormat":"https://service.weibo.com/share/share.php?title={0}\u0026placeholder=Bing\u0026url={1}\u0026pic={2}","weiboFormCode":"SHDLWE","qzoneShareFormat":"https://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?title={0}\u0026summary={1}\u0026url={2}\u0026pics={3}","qzoneFormCode":"SHDLQZ","isCNEnglishSearch":false,"redditShareFormat":"https://www.reddit.com/submit?url={0}\u0026title={1}","redditFormCode":"EX0061","useLocationReplace":false,"getUrlFormCode":"EX0050","enableGetShareLinkFromServerForGetUrl":true,"isUnderside":false}; if(sj_evt) { sj_evt.fire("GlobalActionMenuV2Wrapper.InitSharingGlobalConfig", sharingGlobalConfig); } })();; equals www.linkedin.com (Linkedin)
Source: chromecache_1194.2.dr	String found in binary or memory: (function() { var sharingGlobalConfig ={"thumbnailUrlFormat":"https://www.bing.com/th?id={0}","defaultFormCode":"EX0023","facebookShareFormat":"https://www.facebook.com/dialog/feed?app_id={3}\u0026display=popup\u0026link={0}\u0026redirect_uri={1}\u0026ref={2}","facebookMessengerUrlFormat":"http://www.facebook.com/dialog/send?app_id={0}\u0026display=popup\u0026link={1}\u0026redirect_uri={2}","facebookFormCode":"EX0023","fbInitialHeight":576,"fbmInitialWidth":640,"facebookAppId":"3732605936979161","twitterApi":"https://twitter.com/intent/tweet?hashtags={0}\u0026text={1}\u0026url={2}","twitterFormCode":"EX0024","twitterInitialHeight":576,"twitterInitialWidth":720,"defaultInitialHeight":255,"whatsAppSchema":"whatsapp://send?text={0}","whatsAppStoreUrl":"","whatsAppFormCode":"EX0053","mailLauncherUrl":"mailto:?subject={0} \u0026body={1}","mailFormCode":"EX0025","smsProtocol":"","smsFormCode":"EX0052","loadingUrl":"/loading","useBlankLoadingPage":false,"closeRedirectUrl":"/share/fbre","pinterestUrlFormat":"https://pinterest.com/pin/create/button/?url={0}\u0026media={1}\u0026description={2}","pinterestFormCode":"EX0051","mybingFormCode":"shtomb","mybingRedirectUrl":"https://www.bing.com/myprofile?tid=id_chatmessagetab\u0026FORM=shtomb","skypeUrlFormat":"https://web.skype.com/share?url={0}\u0026source=button\u0026text={1}","skypeInitialHeight":665,"skypeInitialWidth":305,"outlookComLauncherUrl":"https://outlook.live.com/owa/?subject={0}\u0026body={1}\u0026path=/mail/action/compose","gmailLauncherUrl":"https://mail.google.com/mail/?view=cm\u0026fs=1\u0026tf=1\u0026su={0}\u0026body={1}","linkedInUrlFormat":"https://www.linkedin.com/shareArticle?mini=true\u0026url={0}\u0026title={1}\u0026summary={2}","linkedInFormCode":"EX0062","oneNoteUrlFormat":"https://www.onenote.com/clipper/save?attributionUrl={0}\u0026sourceUrl={1}\u0026imgUrl={1}\u0026title={2}\u0026description={3}","oneNoteInitialHeight":565,"oneNoteInitialWidth":550,"oneNoteFormCode":"EX0060","checkAppInstall":"","checkAppTimeout":200,"weiboShareFormat":"https://service.weibo.com/share/share.php?title={0}\u0026placeholder=Bing\u0026url={1}\u0026pic={2}","weiboFormCode":"SHDLWE","qzoneShareFormat":"https://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?title={0}\u0026summary={1}\u0026url={2}\u0026pics={3}","qzoneFormCode":"SHDLQZ","isCNEnglishSearch":false,"redditShareFormat":"https://www.reddit.com/submit?url={0}\u0026title={1}","redditFormCode":"EX0061","useLocationReplace":false,"getUrlFormCode":"EX0050","enableGetShareLinkFromServerForGetUrl":true,"isUnderside":false}; if(sj_evt) { sj_evt.fire("GlobalActionMenuV2Wrapper.InitSharingGlobalConfig", sharingGlobalConfig); } })();; equals www.twitter.com (Twitter)
Source: chromecache_1080.2.dr	String found in binary or memory: (function(a,b,c,d){var e={exports:{}};e.exports;(function(){var f=a.fbq;f.execStart=a.performance&&a.performance.now&&a.performance.now();if(!function(){var b=a.postMessage\|\|function(){};if(!f){b({action:"FB_LOG",logType:"Facebook Pixel Error",logMessage:"Pixel code is not installed correctly on this page"},"");"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;f.__fbeventsModules\|\|(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbeventsModules=function(a){f.__fbeventsResolvedModules[a]\|\|(f.__fbeventsResolvedModules[a]=f.__fbeventsModules[a]());return f.__fbeventsResolvedModules[a]},f.fbIsModuleLoaded=function(a){return!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded(b)\|\|(f.__fbeventsModules[b]=a)});f.ensureModuleRegistered("signalsFBEventsGetIwlUrl",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(a){var b=new URL(a);b=b.hostname.endsWith(".facebook.com")&&b.pathname=="/signals/iwl.js";if(!b)throw new Error("Disallowed script URL");return a}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsGetTier",function(){return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEvents.plugins.iwlbootstrapper",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var c=f.getFbeventsModules("SignalsFBEventsIWLBootStrapEvent"),d=f.getFbeventsModules("SignalsFBEventsLogging"),g=f.getFbeventsModules("SignalsFBEventsNetworkConfig"),h=f.getFbeventsModules("SignalsFBEventsPlugin"),i=f.getFbeventsModules("signalsFBEventsGetIwlUrl"),j=f.getFbeventsModules("signalsFBEventsGetTier"),k=d.logUserError,l=/^https:\/\/.\.facebook\.com$/i,m="FACEBOOK_IWL_CONFIG_STORAGE_KEY",n=null;e.exports=new h(function(d,e){try{n=a.sessionStorage?a.sessionStorage:{getItem:function(a){return null},removeItem:function(a){},setItem:function(a,b){}}}catch(a){return}function h(c,d){var e=b.createElement("script");e.async=!0;e.onload=function(){if(!a.FacebookIWL\|\|!a.FacebookIWL.init)return;var b=j(g.ENDPOINT);b!=null&&a.FacebookIWL.set&&a.FacebookIWL.set("tier",b);d()};a.FacebookIWLSessionEnd=func
Source: chromecache_908.2.dr	String found in binary or memory: </p>","image":{"width":969,"height":545,"quality":81,"url":"https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1kb8N6.img","attribution":"freepik","title":"Addressing the Budget Deficit Through Taxation","caption":"<p>John Williams <a href=\"https://www.youtube.com/watch?v=WY-dLyZSA10\">highlights</a> California's substantial budget deficit of <a href=\"https://apnews.com/article/california-budget-deficit-29315d622212facef307ddab29d4c0c7\">$68 billion</a>. The state's response involves implementing a <a href=\"https://www.wsj.com/articles/california-wealth-tax-bill-sacramento-democrats-gavin-newsom-f0c723b6\">wealth tax</a>, which includes the annual taxation of the rich based on their assets. equals www.youtube.com (Youtube)
Source: chromecache_908.2.dr	String found in binary or memory: </p><p>While a student there, Chew worked for a startup that \"was called Facebook,\" he said in a post on <a href=\"https://www.alumni.hbs.edu/stories/Pages/story-bulletin.aspx?num=7824\" rel=\"noopener\">Harvard's Alumni website</a>. Facebook went public in mid-2012.</p>","image":{"width":1485,"height":1114,"quality":75,"url":"https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA18WVAl.img","attribution":"Marcio Jose Sanchez/AP","title":"Chew worked for Facebook when it was still a startup.","caption":"<p>He earned his bachelor's degree in economics at the University College London before heading to Harvard Business School for his MBA in 2010. equals www.facebook.com (Facebook)
Source: chromecache_448.2.dr	String found in binary or memory: function Qr(a,b,c){this.o=this.g=this.h=null;this.i=0;this.G=!1;this.u=[];this.l=null;this.O={};if(!a)throw Error("YouTube player element ID required.");this.id=Qa(this);this.K=c;c=document;if(a="string"===typeof a?c.getElementById(a):a)if(c="iframe"===a.tagName.toLowerCase(),b.host\|\|(b.host=c?nc(a.src):"https://www.youtube.com"),this.h=new Kr(b),c\|\|(b=Rr(this,a),this.o=a,(c=a.parentNode)&&c.replaceChild(b,a),a=b),this.g=a,this.g.id\|\|(this.g.id="widget"+Qa(this.g)),Er[this.g.id]=this,window.postMessage){this.l= equals www.youtube.com (Youtube)
Source: chromecache_510.2.dr	String found in binary or memory: return b}uD.D="internal.enableAutoEventOnTimer";var wc=da(["data-gtm-yt-inspected-"]),vD=["www.youtube.com","www.youtube-nocookie.com"],wD,xD=!1; equals www.youtube.com (Youtube)
Source: chromecache_1222.2.dr	String found in binary or memory: var VideoCanvasForEmbeddedYTPlayer;(function(n){function o(i){var b,f,o,h;if(!r&&i&&i.length>1){if(f=i[1],(f===null\|\|f===void 0?void 0:f.playerKey)&&f.playerKey==n._playerKey)return;n._playerKey=f.playerKey;o=(b=f.playerConfig)===null\|\|b===void 0?void 0:b.ytpc;o&&(r=o.ytpi,a=o.lpi,u=o.epiocu);typeof({}===null\|\|{}===void 0?void 0:{}.trace)===y&&f}if((h=i===null\|\|i===void 0?void 0:i[0],h&&(u\|\|h!=(t===null\|\|t===void 0?void 0:t.EmbedPlayer_ComponentUpdate))&&(!u\|\|h!=(t===null\|\|t===void 0?void 0:t.EmbedPlayer_Init)))&&(!r&&e&&e.ytp&&e.ytpid&&(r=e.ytpid),pMMUtils&&r&&_ge(r)))if(_w.onYouTubeIframeAPIReady=s,c){if(u){w(i);return}a\|\|s(i)}else l\|\|(l=!0,ct(),sj_be(_w,"unload",p),it())}function h(){lt();i&&i.getIframe()&&i.destroy();YT=undefined}function p(){h();sj_ue(_w,"unload",p)}function it(){var t=document.createElement("script"),n;t.src="https://www.youtube.com/iframe_api";n=document.getElementsByTagName("script")[0];n.parentNode.insertBefore(t,n)}function s(n){c=!0;w(n)}function w(t){if(t&&t.length>1){var u=t[1];if((u===null\|\|u===void 0?void 0:u.playerKey)&&u.playerKey==n._playerKey)return;n._playerKey=u.playerKey}typeof YT!="undefined"&&typeof YT.Player!="undefined"&&(i=new YT.Player(r,{events:{onReady:ut,onStateChange:ft,onError:et}}),typeof({}===null\|\|{}===void 0?void 0:{}.trace)===y&&i,sj_be(_w,"message",rt))}function rt(n){var u,f=(u=i===null\|\|i===void 0?void 0:i.getIframe())===null\|\|u===void 0?void 0:u.contentWindow,r;if(n&&f&&(n===null\|\|n===void 0?void 0:n.source)===f&&typeof(n===null\|\|n===void 0?void 0:n.data)=="string")try{r=JSON.parse(n.data);r&&r.event==="infoDelivery"&&r.info&&sj_evt.fire(t===null\|\|t===void 0?void 0:t.VideoPlayer_InfoUpdate,r.info)}catch(e){}}function ut(n){f=!0;var i={videoDuration:ot()};i.videoDuration&&i.videoDuration!=-1\|\|(i.videoDuration=st(n));sj_evt.fire(t===null\|\|t===void 0?void 0:t.VideoCanvas_VideoPlayerReady,i)}function ft(n){var i=YT===null\|\|YT===void 0?void 0:YT.PlayerState;if(i&&n)switch(n.data){case i.UNSTARTED:sj_evt.fire(t===null\|\|t===void 0?void 0:t.VideoCanvas_VideoUnStarted);break;case i.ENDED:sj_evt.fire(t===null\|\|t===void 0?void 0:t.VideoCanvas_VideoEnded);break;case i.PLAYING:sj_evt.fire(t===null\|\|t===void 0?void 0:t.VideoCanvas_VideoPlaying);break;case i.PAUSED:sj_evt.fire(t===null\|\|t===void 0?void 0:t.VideoCanvas_VideoStopped);break;case i.BUFFERING:sj_evt.fire(t===null\|\|t===void 0?void 0:t.VideoCanvas_VideoStopped)}}function et(n){tt.isTest()&&console&&console.log("YT.Player Error: "+n.data);sj_evt.fire("VideoCanvas.VideoPlayerError",n.data)}function b(n){if(n&&!(n.length<2)&&n[1]){var t=n[1],i=t.seekTime,r=t.enableSeekAhead,u=t.enableSeekBack;typeof i=="number"&&i>=0&&d(i,r,u)}}function k(n){if(typeof i!="undefined"&&n&&!(n.length<2)){var t=n[1];t==!0?typeof(i===null\|\|i===void 0?void 0:i.mute)=="function"&&i.mute():typeof(i===null\|\|i===void 0?void 0:i.unMute)=="function"&&i.unMute()}}function d(n,t,r){var u=g();return(n>u&&t\|\|n<u&&r)&&i&&f&&typeof i.seekTo!="undefined"?(i.seekTo(n,!0),!0):!1}func

IP
192.168.2.4
192.168.2.16

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 108x108, segment length 16, baseline, precision 8, 224x260, components 3
Category:	downloaded
Size (bytes):	62358
Entropy (8bit):	7.942077998538942
Encrypted:	false
SSDEEP:	1536:on8j+VlX1qlaLCguwWhBa6kh+APImqqwKfkxbjpIIYt:8vAlaLdWDJkh+COqwKcV6lt
MD5:	1801C2B9F3A0789D0CB84CDDB835D5BF
SHA1:	9BA8A2094E53CB4A08977C5A559350BBB3D63B0B
SHA-256:	7C812E65E8FB2B73C2051D7600A24814FB0DD431E7425478403B5D41C13FFD43
SHA-512:	A52B5D69C5F678673280EB3414B2A70D0157772E63EC44D2BB82B35C47255DEB5333E17F70719630E97D12C511407182AF101907825D0EE6702AC2221D195EB4
Malicious:	false
Reputation:	low
URL:	https://www.bing.com/th?id=OSK.EFDEA7FB351FB436A0614D85EF81C1DA&w=224&h=260&c=8&qlt=100&pid=PID
Preview:	......JFIF.....l.l.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......kgn.sY8.....x.rG.:`...v.~"./.N5C..........g....\|....q.27.zu.....W....9..F..?..O.....x.U..8....7......N.....6.....mu..X...RA...1...7.t'......R.j.....>l.j7....}8....o\|.r.q.q.........v.`..a.l.=?....qX.....[_m;.z.m...;....=.k.}....Mk...u.N.cUS...d.........'}..\|#...#.....8..b.w.:w.....;.#...=3..qU-4;.i5.........O.."..,XV.....0f.N.*.G.]...j_K]\|]w...-

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (607)
Category:	downloaded
Size (bytes):	34408
Entropy (8bit):	5.377623108776219
Encrypted:	false
SSDEEP:	384:98WbFBn86uPIvg0OLKcM0J2fQgMiySszOB+SoXpMdyMFZGzv9LFDRpC1Q:98WbLn86ONL382fSta9x
MD5:	B9FCDC31A4B84B6313C3223F0D42F56B
SHA1:	18E3C287B86EB5BBEE48E3105950FA02F55CE98A
SHA-256:	4E37DD418CCDA4465AB559E27D0912FB158B267E0A935C6609E92714260EF8A0
SHA-512:	409CEB9EA2DED2BC5412ADE7E697E57AC7162F65FC5FF9DE8A0A3F585C4A0E06F3A7C9A0A6D3E6711EE0A5C7FC28F53266E7E573C298538664DF58080F589097
Malicious:	false
Reputation:	low
URL:	https://www.youtube.com/s/player/589f1394/player_ias.vflset/en_US/endscreen.js
Preview:	(function(g){var window=this;'use strict';var Jsb=function(a,b){a.ob("onAutonavCoundownStarted",b)},j6=function(a,b,c){g.ev(a.element,"ytp-suggestion-set",!!b.videoId);.var d=b.playlistId;c=b.hh(c?c:"mqdefault.jpg");var e=null,f=null;b instanceof g.DS&&(b.lengthText?(e=b.lengthText\|\|null,f=b.qw\|\|null):b.lengthSeconds&&(e=g.MG(b.lengthSeconds),f=g.MG(b.lengthSeconds,!0)));var h=!!d;d=h&&"RD"===g.BSa(d).type;var l=b instanceof g.DS?b.isLivePlayback:null,m=b instanceof g.DS?b.isUpcoming:null,n=b.author,p=b.shortViewCount,q=b.publishedTimeText,r=[],t=[];n&&r.push(n);p&&(r.push(p),t.push(p));q&&t.push(q);c={title:b.title,author:n,author_and_views:r.join(" \u2022 "),aria_label:b.ariaLabel\|\|.g.UJ("Watch $TITLE",{TITLE:b.title}),duration:e,timestamp:f,url:b.Tk(),is_live:l,is_upcoming:m,is_list:h,is_mix:d,background:c?"background-image: url("+c+")":"",views_and_publish_time:t.join(" \u2022 "),autoplayAlternativeHeader:b.xs};b instanceof g.CS&&(c.playlist_length=b.playlistLength);a.update(c)},k6

Target ID:	0
Start time:	21:48:02
Start date:	19/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	21:48:03
Start date:	19/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1992,i,3046317749516513628,7685400228688099596,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	21:48:05
Start date:	19/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ergv54ergrz.s3.amazonaws.com/uhdigth1.html"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	21:48:22
Start date:	19/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5444 --field-trial-handle=1992,i,3046317749516513628,7685400228688099596,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://ergv54ergrz.s3.amazonaws.com/uhdigth1.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 1000

Chrome Cache Entry: 1001

Chrome Cache Entry: 1002

Chrome Cache Entry: 1003

Chrome Cache Entry: 1004

Chrome Cache Entry: 1005

Chrome Cache Entry: 1006

Chrome Cache Entry: 1007

Chrome Cache Entry: 1008

Chrome Cache Entry: 1009

Chrome Cache Entry: 1010

Chrome Cache Entry: 1011

Chrome Cache Entry: 1012

Chrome Cache Entry: 1013

Chrome Cache Entry: 1014

Chrome Cache Entry: 1015

Chrome Cache Entry: 1016

Chrome Cache Entry: 1017

Chrome Cache Entry: 1018

Chrome Cache Entry: 1019

Chrome Cache Entry: 1020

Chrome Cache Entry: 1021

Chrome Cache Entry: 1022

Chrome Cache Entry: 1023

Chrome Cache Entry: 1024

Chrome Cache Entry: 1025

Chrome Cache Entry: 1026

Windows Analysis Report
https://ergv54ergrz.s3.amazonaws.com/uhdigth1.html