Edit tour

Windows Analysis Report
https://nimblethumb.world/ad88e0364e2c172b62811cb705409770

Overview

General Information

Sample URL:	https://nimblethumb.world/ad88e0364e2c172b62811cb705409770
Analysis ID:	1412023
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found iframes

HTML body contains low number of good links

HTML title does not match URL

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4176 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1740 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1992,i,11304834377449891159,15558873975835861540,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7140 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4104 --field-trial-handle=1992,i,11304834377449891159,15558873975835861540,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7156 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 --field-trial-handle=1992,i,11304834377449891159,15558873975835861540,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://nimblethumb.world/ad88e0364e2c172b62811cb705409770" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://nimblethumb.world/ad88e0364e2c172b62811cb705409770

Avira URL Cloud: detection malicious, Label: phishing

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=66459529-883c-4d99-a6f4-a6f2be006b3c&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.18.0&x-client-OS=&x-client-CPU=&client_info=1&code_challenge=SQJ8ctQKGIot7MyVhIRQ5K2c8k1KV0XlVSEPd3oGG8E&code_challenge_method=S256&prompt=none&nonce=d81082a2-b615-4699-bcec-295048ed6ae2&state=eyJpZCI6IjQwZjA2YjRlLTExMzMtNDY0OS04ZjRiLWQ2NzE5Yzk5NDUwNyIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19

Source: https://www.bing.com/secure/Passport.aspx?popup=1&ssl=1	HTTP Parser: No favicon
Source: https://www.youtube.com/embed/jaRfBM7ESfc?autoplay=1&enablejsapi=1&origin=https://www.bing.com&rel=0&mute=1	HTTP Parser: No favicon
Source: https://www.youtube.com/embed/jaRfBM7ESfc?autoplay=1&enablejsapi=1&origin=https://www.bing.com&rel=0&mute=1	HTTP Parser: No favicon
Source: https://www.youtube.com/embed/jaRfBM7ESfc?autoplay=1&enablejsapi=1&origin=https://www.bing.com&rel=0&mute=1	HTTP Parser: No favicon
Source: https://www.youtube.com/embed/jaRfBM7ESfc?autoplay=1&enablejsapi=1&origin=https://www.bing.com&rel=0&mute=1	HTTP Parser: No favicon
Source: https://www.youtube.com/embed/jaRfBM7ESfc?autoplay=1&enablejsapi=1&origin=https://www.bing.com&rel=0&mute=1	HTTP Parser: No favicon
Source: https://www.youtube.com/embed/jaRfBM7ESfc?autoplay=1&enablejsapi=1&origin=https://www.bing.com&rel=0&mute=1	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=66459529-883c-4d99-a6f4-a6f2be006b3c&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.18.0&x-client-OS=&x-client-CPU=&client_info=1&code_challenge=SQJ8ctQKGIot7MyVhIRQ5K2c8k1KV0XlVSEPd3oGG8E&code_challenge_method=S256&prompt=none&nonce=d81082a2-b615-4699-bcec-295048ed6ae2&state=eyJpZCI6IjQwZjA2YjRlLTExMzMtNDY0OS04ZjRiLWQ2NzE5Yzk5NDUwNyIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No favicon

Source: chromecache_1608.2.dr	String found in binary or memory: </p>","focalRegion":{"x1":94,"x2":152,"y1":61,"y2":119},"source":"msn"}},{"title":"Addressing the Budget Deficit Through Taxation","body":"<p>John Williams <a href=\"https://www.youtube.com/watch?v=WY-dLyZSA10\">highlights</a> California's substantial budget deficit of <a href=\"https://apnews.com/article/california-budget-deficit-29315d622212facef307ddab29d4c0c7\">$68 billion</a>. The state's response involves implementing a <a href=\"https://www.wsj.com/articles/california-wealth-tax-bill-sacramento-democrats-gavin-newsom-f0c723b6\">wealth tax</a>, which includes the annual taxation of the rich based on their assets. equals www.youtube.com (Youtube)
Source: chromecache_1161.2.dr	String found in binary or memory: (function(a,b,c,d){var e={exports:{}};e.exports;(function(){var f=a.fbq;f.execStart=a.performance&&a.performance.now&&a.performance.now();if(!function(){var b=a.postMessage\|\|function(){};if(!f){b({action:"FB_LOG",logType:"Facebook Pixel Error",logMessage:"Pixel code is not installed correctly on this page"},"");"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;f.__fbeventsModules\|\|(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbeventsModules=function(a){f.__fbeventsResolvedModules[a]\|\|(f.__fbeventsResolvedModules[a]=f.__fbeventsModules[a]());return f.__fbeventsResolvedModules[a]},f.fbIsModuleLoaded=function(a){return!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded(b)\|\|(f.__fbeventsModules[b]=a)});f.ensureModuleRegistered("signalsFBEventsGetIwlUrl",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(a){var b=new URL(a);b=b.hostname.endsWith(".facebook.com")&&b.pathname=="/signals/iwl.js";if(!b)throw new Error("Disallowed script URL");return a}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsGetTier",function(){return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEvents.plugins.iwlbootstrapper",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var c=f.getFbeventsModules("SignalsFBEventsIWLBootStrapEvent"),d=f.getFbeventsModules("SignalsFBEventsLogging"),g=f.getFbeventsModules("SignalsFBEventsNetworkConfig"),h=f.getFbeventsModules("SignalsFBEventsPlugin"),i=f.getFbeventsModules("signalsFBEventsGetIwlUrl"),j=f.getFbeventsModules("signalsFBEventsGetTier"),k=d.logUserError,l=/^https:\/\/.\.facebook\.com$/i,m="FACEBOOK_IWL_CONFIG_STORAGE_KEY",n=null;e.exports=new h(function(d,e){try{n=a.sessionStorage?a.sessionStorage:{getItem:function(a){return null},removeItem:function(a){},setItem:function(a,b){}}}catch(a){return}function h(c,d){var e=b.createElement("script");e.async=!0;e.onload=function(){if(!a.FacebookIWL\|\|!a.FacebookIWL.init)return;var b=j(g.ENDPOINT);b!=null&&a.FacebookIWL.set&&a.FacebookIWL.set("tier",b);d()};a.FacebookIWLSessionEnd=func
Source: chromecache_848.2.dr	String found in binary or memory: (g.Jo(c,"redirector.googlevideo.com"),d=c.toString()):c.j.match("rr?[1-9].*\\.c\\.youtube\\.com$")?(g.Jo(c,"www.youtube.com"),d=c.toString()):(c=pBa(d),JJ(c)&&(d=c));c=new g.EP(d);c.set("cmo=pf","1");e&&c.set("cmo=td","a1.googlevideo.com");return c}; equals www.youtube.com (Youtube)
Source: chromecache_1608.2.dr	String found in binary or memory: </p>","image":{"width":969,"height":545,"quality":81,"url":"https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1kb8N6.img","attribution":"freepik","title":"Addressing the Budget Deficit Through Taxation","caption":"<p>John Williams <a href=\"https://www.youtube.com/watch?v=WY-dLyZSA10\">highlights</a> California's substantial budget deficit of <a href=\"https://apnews.com/article/california-budget-deficit-29315d622212facef307ddab29d4c0c7\">$68 billion</a>. The state's response involves implementing a <a href=\"https://www.wsj.com/articles/california-wealth-tax-bill-sacramento-democrats-gavin-newsom-f0c723b6\">wealth tax</a>, which includes the annual taxation of the rich based on their assets. equals www.youtube.com (Youtube)
Source: chromecache_848.2.dr	String found in binary or memory: BQa=function(a,b){if(!a.j["0"]){var c=new IK("0","fakesb",{video:new EK(0,0,0,void 0,void 0,"auto")});a.j["0"]=b?new IQ(new g.EP("http://www.youtube.com/videoplayback"),c,"fake"):new UQ(new g.EP("http://www.youtube.com/videoplayback"),c,new rQ(0,0),new rQ(0,0))}}; equals www.youtube.com (Youtube)
Source: chromecache_848.2.dr	String found in binary or memory: a))):this.Vd(g.gW(a.errorMessage)):this.Vd(iW(this,"HTML5_NO_AVAILABLE_FORMATS_FALLBACK_WITH_LINK_SHORT","//www.youtube.com/supported_browsers")):(a=d.hostLanguage,c="//support.google.com/youtube/?p=player_error1",a&&(c=g.dn(c,{hl:a})),this.Vd(iW(this,"GENERIC_WITH_LINK_AND_CPN",c,!0)),d.Kc&&!d.D&&JYa(this,function(e){if(g.TU(e,b.api,!dS(b.api.U()))){e={as3:!1,html5:!0,player:!0,cpn:b.api.getVideoData().clientPlaybackNonce};var f=b.api;f.Ac("onFeedbackArticleRequest",{articleId:3037019,helpContext:"player_error", equals www.youtube.com (Youtube)
Source: chromecache_848.2.dr	String found in binary or memory: a.BASE_YT_URL)\|\|"")\|\|gBa(this.Wf)\|\|this.protocol+"://www.youtube.com/";h=b?b.eventLabel:a.el;d="detailpage";"adunit"===h?d=this.D?"embedded":"detailpage":"embedded"===h\|\|this.K?d=fC(d,h,CRa):h&&(d="embedded");this.Ma=d;Wta();h=null;d=b?b.playerStyle:a.ps;f=g.Fb(DRa,d);!d\|\|f&&!this.K\|\|(h=d);this.playerStyle=h;this.ma=(this.N=g.Fb(DRa,this.playerStyle))&&"play"!==this.playerStyle&&"jamboard"!==this.playerStyle;this.Yo=!this.ma;this.Wa=eC(!1,a.disableplaybackui);this.disablePaidContentOverlay=eC(!1, equals www.youtube.com (Youtube)
Source: chromecache_848.2.dr	String found in binary or memory: a.severity,e,tK(a.details),f)}else this.oa.ra("nonfatalerror",a),d=/^pp/.test(this.videoData.clientPlaybackNonce),this.Ae(a.errorCode,a.details),d&&"manifest.net.connect"===a.errorCode&&(a="https://www.youtube.com/generate_204?cpn="+this.videoData.clientPlaybackNonce+"&t="+(0,g.iD)(),nU(a,"manifest",function(h){b.G=!0;b.qa("pathprobe",h)},function(h){b.Ae(h.errorCode,h.details)}))}}; equals www.youtube.com (Youtube)
Source: chromecache_1142.2.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var h=tB(a,c,e);L(121);if("https://www.facebook.com/tr/"===h["gtm.elementUrl"])return L(122),!0;if(d&&f){for(var m=db(b,g.length),n=0;n<g.length;++n)g[n](h,m);return m.done}for(var p=0;p<g.length;++p)g[p](h,function(){});return!0},wB=function(){var a=[],b=function(c){return Ja(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_441.2.dr	String found in binary or memory: function Qr(a,b,c){this.o=this.g=this.h=null;this.i=0;this.G=!1;this.u=[];this.l=null;this.O={};if(!a)throw Error("YouTube player element ID required.");this.id=Qa(this);this.K=c;c=document;if(a="string"===typeof a?c.getElementById(a):a)if(c="iframe"===a.tagName.toLowerCase(),b.host\|\|(b.host=c?nc(a.src):"https://www.youtube.com"),this.h=new Kr(b),c\|\|(b=Rr(this,a),this.o=a,(c=a.parentNode)&&c.replaceChild(b,a),a=b),this.g=a,this.g.id\|\|(this.g.id="widget"+Qa(this.g)),Er[this.g.id]=this,window.postMessage){this.l= equals www.youtube.com (Youtube)
Source: chromecache_1142.2.dr	String found in binary or memory: f\|\|g.length\|\|h.length))return;var n={kh:d,ih:e,jh:f,Uh:g,Vh:h,He:m,yb:b},p=l.YT,q=function(){DD(n)};if(p)return p.ready&&p.ready(q),b;var r=l.onYouTubeIframeAPIReady;l.onYouTubeIframeAPIReady=function(){r&&r();q()};C(function(){for(var t=z.getElementsByTagName("script"),u=t.length,v=0;v<u;v++){var w=t[v].getAttribute("src");if(GD(w,"iframe_api")\|\|GD(w,"player_api"))return b}for(var x=z.getElementsByTagName("iframe"),y=x.length,B=0;B<y;B++)if(!xD&&ED(x[B],n.He))return Ic("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_848.2.dr	String found in binary or memory: g.Va("Goog_AdSense_Lidar_getUrlSignalsList",Eib);var ZAa=oa(["//tpc.googlesyndication.com/sodar/",""]);var HMa={Z4a:0,W4a:1,T4a:2,U4a:3,V4a:4,Y4a:5,X4a:6};var kpa=(new Date).getTime();var Wka="://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.]*.moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/xsul www.youtube.com/pagead/slav".split(" "),Xka=/\bocr\b/;var Zka=/(?:\[\|%5B)([a-zA-Z0-9_]+)(?:\]\|%5D)/g;g.w(Ku,g.Ld);Ku.prototype.dispose=function(){window.removeEventListener("offline",this.C);window.removeEventListener("online",this.C);this.Sn.Wj(this.G);delete Ku.instance}; equals www.youtube.com (Youtube)
Source: chromecache_848.2.dr	String found in binary or memory: g.bS=function(a){a=$R(a.Ea);return"www.youtube-nocookie.com"===a?"www.youtube.com":a}; equals www.youtube.com (Youtube)
Source: chromecache_848.2.dr	String found in binary or memory: g.k.getVideoUrl=function(a,b,c,d,e,f){b={list:b};c&&(e?b.time_continue=c:b.t=c);c=g.bS(this);e="www.youtube.com"===c;!f&&d&&e?f="https://youtu.be/"+a:g.VR(this)?(f="https://"+c+"/fire",b.v=a):(f&&e?(f=this.protocol+"://"+c+"/shorts/"+a,d&&(b.feature="share")):(f=this.protocol+"://"+c+"/watch",b.v=a),yD&&(a=$oa())&&(b.ebc=a));return g.dn(f,b)}; equals www.youtube.com (Youtube)
Source: chromecache_848.2.dr	String found in binary or memory: g.mS=function(a){var b=g.bS(a);SRa.includes(b)&&(b="www.youtube.com");return a.protocol+"://"+b}; equals www.youtube.com (Youtube)
Source: chromecache_848.2.dr	String found in binary or memory: r;this.xj=b?b.hl\|\|"en_US":hC("en_US",a.hl);this.region=b?b.contentRegion\|\|"US":hC("US",a.cr);this.hostLanguage=b?b.hostLanguage\|\|"en":hC("en",a.host_language);this.So=!this.Yc&&Math.random()<g.eJ(this.experiments,"web_player_api_logging_fraction");this.ib=!this.Yc;this.enabledEngageTypes=new Set;this.deviceIsAudioOnly=!(null==b\|\|!b.deviceIsAudioOnly);this.Nd=gC(this.Nd,a.ismb);this.Yo?(r=a.vss_host\|\|"s.youtube.com","s.youtube.com"===r&&(r=$R(this.Ea)\|\|"www.youtube.com")):r="video.google.com";this.Zm= equals www.youtube.com (Youtube)
Source: chromecache_1142.2.dr	String found in binary or memory: return b}uD.D="internal.enableAutoEventOnTimer";var wc=da(["data-gtm-yt-inspected-"]),vD=["www.youtube.com","www.youtube-nocookie.com"],wD,xD=!1; equals www.youtube.com (Youtube)
Source: chromecache_848.2.dr	String found in binary or memory: this.W.Ca&&(a.authuser=this.W.Ca);this.W.pageId&&(a.pageid=this.W.pageId);isNaN(this.cryptoPeriodIndex)\|\|(a.cpi=this.cryptoPeriodIndex.toString());var e=(e=/_(TV\|STB\|GAME\|OTT\|ATV\|BDP)_/.exec(g.pc()))?e[1]:"";"ATV"===e&&(a.cdt=e);this.G=a;this.G.session_id=d;this.ma=!0;"widevine"===this.B.flavor&&(this.G.hdr="1");"playready"===this.B.flavor&&(b=Number(vR(b.experiments,"playready_first_play_expiration")),!isNaN(b)&&0<=b&&(this.G.mfpe=""+b),this.ma=!1);b="";g.oR(this.B)?nR(this.B)?(d=c.B)&&(b="https://www.youtube.com/api/drm/fps?ek="+ equals www.youtube.com (Youtube)
Source: chromecache_848.2.dr	String found in binary or memory: var J3={};var Geb=/[&\?]action_proxy=1/,Feb=/[&\?]token=([\w-])/,Heb=/[&\?]video_id=([\w-])/,Ieb=/[&\?]index=([\d-])/,Jeb=/[&\?]m_pos_ms=([\d-])/,Leb=/[&\?]vvt=([\w-]*)/,xeb="ca_type dt el flash u_tz u_his u_h u_w u_ah u_aw u_cd u_nplug u_nmime frm u_java bc bih biw brdim vis wgl".split(" "),Keb="www.youtube-nocookie.com youtube-nocookie.com www.youtube-nocookie.com:443 youtube.googleapis.com www.youtubeedu.com www.youtubeeducation.com video.google.com redirector.gvt1.com".split(" "),Aeb={android:"ANDROID", equals www.youtube.com (Youtube)
Source: chromecache_1142.2.dr	String found in binary or memory: var JC=function(a,b,c,d,e){var f=Az("fsl",c?"nv.mwt":"mwt",0),g;g=c?Az("fsl","nv.ids",[]):Az("fsl","ids",[]);if(!g.length)return!0;var h=wz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);L(121);if("https://www.facebook.com/tr/"===m)return L(122),!0;h["gtm.elementUrl"]=m;h["gtm.formCanceled"]=c;null!=a.getAttribute("name")&&(h["gtm.interactedFormName"]=a.getAttribute("name"));e&&(h["gtm.formSubmitElement"]=e,h["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!Iy(h,Jy(b, equals www.facebook.com (Facebook)
Source: chromecache_1309.2.dr	String found in binary or memory: var VideoCanvasForEmbeddedYTPlayer;(function(n){function o(i){var b,f,o,h;if(!r&&i&&i.length>1){if(f=i[1],(f===null\|\|f===void 0?void 0:f.playerKey)&&f.playerKey==n._playerKey)return;n._playerKey=f.playerKey;o=(b=f.playerConfig)===null\|\|b===void 0?void 0:b.ytpc;o&&(r=o.ytpi,a=o.lpi,u=o.epiocu);typeof({}===null\|\|{}===void 0?void 0:{}.trace)===y&&f}if((h=i===null\|\|i===void 0?void 0:i[0],h&&(u\|\|h!=(t===null\|\|t===void 0?void 0:t.EmbedPlayer_ComponentUpdate))&&(!u\|\|h!=(t===null\|\|t===void 0?void 0:t.EmbedPlayer_Init)))&&(!r&&e&&e.ytp&&e.ytpid&&(r=e.ytpid),pMMUtils&&r&&_ge(r)))if(_w.onYouTubeIframeAPIReady=s,c){if(u){w(i);return}a\|\|s(i)}else l\|\|(l=!0,ct(),sj_be(_w,"unload",p),it())}function h(){lt();i&&i.getIframe()&&i.destroy();YT=undefined}function p(){h();sj_ue(_w,"unload",p)}function it(){var t=document.createElement("script"),n;t.src="https://www.youtube.com/iframe_api";n=document.getElementsByTagName("script")[0];n.parentNode.insertBefore(t,n)}function s(n){c=!0;w(n)}function w(t){if(t&&t.length>1){var u=t[1];if((u===null\|\|u===void 0?void 0:u.playerKey)&&u.playerKey==n._playerKey)return;n._playerKey=u.playerKey}typeof YT!="undefined"&&typeof YT.Player!="undefined"&&(i=new YT.Player(r,{events:{onReady:ut,onStateChange:ft,onError:et}}),typeof({}===null\|\|{}===void 0?void 0:{}.trace)===y&&i,sj_be(_w,"message",rt))}function rt(n){var u,f=(u=i===null\|\|i===void 0?void 0:i.getIframe())===null\|\|u===void 0?void 0:u.contentWindow,r;if(n&&f&&(n===null\|\|n===void 0?void 0:n.source)===f&&typeof(n===null\|\|n===void 0?void 0:n.data)=="string")try{r=JSON.parse(n.data);r&&r.event==="infoDelivery"&&r.info&&sj_evt.fire(t===null\|\|t===void 0?void 0:t.VideoPlayer_InfoUpdate,r.info)}catch(e){}}function ut(n){f=!0;var i={videoDuration:ot()};i.videoDuration&&i.videoDuration!=-1\|\|(i.videoDuration=st(n));sj_evt.fire(t===null\|\|t===void 0?void 0:t.VideoCanvas_VideoPlayerReady,i)}function ft(n){var i=YT===null\|\|YT===void 0?void 0:YT.PlayerState;if(i&&n)switch(n.data){case i.UNSTARTED:sj_evt.fire(t===null\|\|t===void 0?void 0:t.VideoCanvas_VideoUnStarted);break;case i.ENDED:sj_evt.fire(t===null\|\|t===void 0?void 0:t.VideoCanvas_VideoEnded);break;case i.PLAYING:sj_evt.fire(t===null\|\|t===void 0?void 0:t.VideoCanvas_VideoPlaying);break;case i.PAUSED:sj_evt.fire(t===null\|\|t===void 0?void 0:t.VideoCanvas_VideoStopped);break;case i.BUFFERING:sj_evt.fire(t===null\|\|t===void 0?void 0:t.VideoCanvas_VideoStopped)}}function et(n){tt.isTest()&&console&&console.log("YT.Player Error: "+n.data);sj_evt.fire("VideoCanvas.VideoPlayerError",n.data)}function b(n){if(n&&!(n.length<2)&&n[1]){var t=n[1],i=t.seekTime,r=t.enableSeekAhead,u=t.enableSeekBack;typeof i=="number"&&i>=0&&d(i,r,u)}}function k(n){if(typeof i!="undefined"&&n&&!(n.length<2)){var t=n[1];t==!0?typeof(i===null\|\|i===void 0?void 0:i.mute)=="function"&&i.mute():typeof(i===null\|\|i===void 0?void 0:i.unMute)=="function"&&i.unMute()}}function d(n,t,r){var u=g();return(n>u&&t\|\|n<u&&r)&&i&&f&&typeof i.seekTo!="undefined"?(i.seekTo(n,!0),!0):!1}func

Source: chromecache_1462.2.dr	String found in binary or memory: http://adaptivecards.io/schemas/adaptive-card.json
Source: chromecache_605.2.dr, chromecache_849.2.dr	String found in binary or memory: http://feross.org
Source: chromecache_1727.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_848.2.dr, chromecache_441.2.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: chromecache_1063.2.dr	String found in binary or memory: http://www.bohemiancoding.com/sketch
Source: chromecache_1727.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_848.2.dr	String found in binary or memory: http://www.youtube.com/videoplayback
Source: chromecache_848.2.dr	String found in binary or memory: http://youtube.com/drm/2012/10/10
Source: chromecache_848.2.dr	String found in binary or memory: http://youtube.com/streaming/metadata/segment/102015
Source: chromecache_848.2.dr	String found in binary or memory: http://youtube.com/streaming/otf/durations/112015
Source: chromecache_848.2.dr	String found in binary or memory: http://youtube.com/yt/2012/10/10
Source: chromecache_848.2.dr	String found in binary or memory: https://admin.youtube.com
Source: chromecache_862.2.dr	String found in binary or memory: https://angular.io/license
Source: chromecache_1608.2.dr	String found in binary or memory: https://api.msn.com/news/feed/pages/binghp?activityId=944D0647-2500-40E0-9862-6999BCD00A9E&timeOut=2
Source: chromecache_1608.2.dr	String found in binary or memory: https://apnews.com/article/california-budget-deficit-29315d622212facef307ddab29d4c0c7
Source: chromecache_1693.2.dr, chromecache_1664.2.dr	String found in binary or memory: https://assets.msn.com/statics/icons/Microsoft_16_SVG.ico
Source: chromecache_1241.2.dr	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/$
Source: chromecache_1210.2.dr	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/shopping/discountTag.svg
Source: chromecache_1210.2.dr	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3872652/shopping/plusw.svg
Source: chromecache_1210.2.dr	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3872652/shopping/tick.svg
Source: chromecache_1063.2.dr	String found in binary or memory: https://assets.talkshop.live/images/tsl-logo-talkshoplive_r.svg
Source: chromecache_1112.2.dr	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=3056
Source: chromecache_1112.2.dr	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=4118
Source: chromecache_1142.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_1608.2.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm
Source: chromecache_1608.2.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm-dark
Source: chromecache_1608.2.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gACQ
Source: chromecache_1608.2.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gACQ-dark
Source: chromecache_1608.2.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gALZ
Source: chromecache_1608.2.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gALZ-dark
Source: chromecache_1460.2.dr	String found in binary or memory: https://cdn.shopify.com/s/files/1/0065/5812/2036/products/Baby_Jersey_Bodysuit-Front_1024x1024.jpg?v
Source: chromecache_1460.2.dr	String found in binary or memory: https://cdn.shopify.com/s/files/1/0065/5812/2036/products/CoupleRunning_116b0436-cd87-4e2f-a4c4-a02a
Source: chromecache_1460.2.dr	String found in binary or memory: https://cdn.shopify.com/s/files/1/0065/5812/2036/products/Hooded_Sweatshirt-Women-White-Front2_1024x
Source: chromecache_1460.2.dr	String found in binary or memory: https://cdn.shopify.com/s/files/1/0065/5812/2036/products/White_T-shirt_design-front_1024x1024.jpg?v
Source: chromecache_441.2.dr	String found in binary or memory: https://developers.google.com/youtube/iframe_api_reference#Events
Source: chromecache_848.2.dr	String found in binary or memory: https://docs.google.com/get_video_info
Source: chromecache_1727.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_848.2.dr, chromecache_441.2.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: chromecache_893.2.dr	String found in binary or memory: https://github.com/microsoft/clarity
Source: chromecache_1142.2.dr	String found in binary or memory: https://googlesyndication.com
Source: chromecache_1731.2.dr	String found in binary or memory: https://highlightjs.org/
Source: chromecache_1608.2.dr	String found in binary or memory: https://honemaxwell.com/california-exit-tax/#:~:text=For%20taxable%20years%20from%202024
Source: chromecache_848.2.dr	String found in binary or memory: https://i.ytimg.com/vi/
Source: chromecache_1608.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA13slaS.img
Source: chromecache_1608.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAENEUh.img
Source: chromecache_1608.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAT0qC2.img
Source: chromecache_1608.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAVmfsD.img
Source: chromecache_1608.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1kb40J.img
Source: chromecache_1608.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1kb40O.img
Source: chromecache_1608.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1kb8N6.img
Source: chromecache_1608.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBUvpML.img
Source: chromecache_848.2.dr	String found in binary or memory: https://jnn-pa.googleapis.com
Source: chromecache_1564.2.dr, chromecache_1278.2.dr	String found in binary or memory: https://login.chinacloudapi.cn
Source: chromecache_1698.2.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0
Source: chromecache_1564.2.dr, chromecache_1278.2.dr, chromecache_1610.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_1564.2.dr, chromecache_1278.2.dr	String found in binary or memory: https://login.microsoftonline.de
Source: chromecache_1564.2.dr, chromecache_1278.2.dr	String found in binary or memory: https://login.microsoftonline.us
Source: chromecache_1564.2.dr, chromecache_1278.2.dr, chromecache_1610.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_495.2.dr, chromecache_1462.2.dr	String found in binary or memory: https://msasg.visualstudio.com/Bing_Ads/_workitems/edit/3905327
Source: chromecache_495.2.dr, chromecache_1462.2.dr	String found in binary or memory: https://msasg.visualstudio.com/ContentServices/_workitems/edit/3620803
Source: chromecache_1142.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_1142.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_848.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_848.2.dr	String found in binary or memory: https://redux.js.org/api/store#subscribelistener
Source: chromecache_848.2.dr	String found in binary or memory: https://redux.js.org/tutorials/fundamentals/part-4-store#creating-a-store-with-enhancers
Source: chromecache_848.2.dr	String found in binary or memory: https://redux.js.org/tutorials/fundamentals/part-4-store#middleware
Source: chromecache_848.2.dr	String found in binary or memory: https://redux.js.org/tutorials/fundamentals/part-6-async-logic#using-the-redux-thunk-middleware
Source: chromecache_1142.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_1142.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: chromecache_1698.2.dr	String found in binary or memory: https://storage.live.com/users/0x
Source: chromecache_848.2.dr	String found in binary or memory: https://support.google.com/youtube/?p=missing_quality
Source: chromecache_848.2.dr	String found in binary or memory: https://support.google.com/youtube/?p=noaudio
Source: chromecache_848.2.dr	String found in binary or memory: https://support.google.com/youtube/?p=report_playback
Source: chromecache_848.2.dr	String found in binary or memory: https://support.google.com/youtube/answer/6276924
Source: chromecache_1142.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_848.2.dr	String found in binary or memory: https://viacon.corp.google.com
Source: chromecache_481.2.dr, chromecache_890.2.dr	String found in binary or memory: https://www.gettyimages.com/detail/1125576617?utm_medium=organic&utm_source=google&utm_campa
Source: chromecache_1718.2.dr, chromecache_1083.2.dr	String found in binary or memory: https://www.gettyimages.com/detail/1190440285?utm_medium=organic&utm_source=google&utm_campa
Source: chromecache_1280.2.dr	String found in binary or memory: https://www.gettyimages.com/detail/1194601649?utm_medium=organic&utm_source=google&utm_campa
Source: chromecache_1142.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_1142.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_848.2.dr	String found in binary or memory: https://www.googleapis.com/certificateprovisioning/v1/devicecertificates/create?key=AIzaSyB-5OLKTx2i
Source: chromecache_1142.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_895.2.dr	String found in binary or memory: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Source: chromecache_848.2.dr	String found in binary or memory: https://www.gstatic.com/ytlr/img/sign_in_avatar_default.png?rn=
Source: chromecache_1462.2.dr	String found in binary or memory: https://www.lotteryusa.com/mega-millions/
Source: chromecache_1462.2.dr	String found in binary or memory: https://www.lotteryusa.com/powerball/
Source: chromecache_1142.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_1275.2.dr	String found in binary or memory: https://www.msn.com
Source: chromecache_495.2.dr, chromecache_1462.2.dr	String found in binary or memory: https://www.msn.com/$
Source: chromecache_1608.2.dr	String found in binary or memory: https://www.msn.com/en-us/health/wellness/8-signs-you-re-the-selfish-partner-in-your-relationship/ar
Source: chromecache_1608.2.dr	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/nationwide-has-finally-revealed-its-true-colours-
Source: chromecache_1608.2.dr	String found in binary or memory: https://www.msn.com/en-us/money/markets/it-s-not-the-economy-it-s-inflation-stupid/ar-BB1k8SY6
Source: chromecache_1608.2.dr	String found in binary or memory: https://www.msn.com/en-us/movies/news/the-next-james-bond-has-reportedly-been-chosen-and-film-fans-a
Source: chromecache_1608.2.dr	String found in binary or memory: https://www.msn.com/en-us/news/politics/ex-trump-press-aide-breaks-down-true-message-of-his-unhinged
Source: chromecache_1608.2.dr	String found in binary or memory: https://www.msn.com/en-us/news/politics/milley-responds-to-trump-execution-comments-it-s-a-free-coun
Source: chromecache_1608.2.dr	String found in binary or memory: https://www.msn.com/en-us/news/us/fiery-school-board-meeting-brings-out-black-panthers-in-virginia/a
Source: chromecache_1608.2.dr	String found in binary or memory: https://www.msn.com/en-us/news/us/n-j-reports-huge-jump-in-number-of-people-seeking-gun-carry-permit
Source: chromecache_1698.2.dr	String found in binary or memory: https://www.msn.com:443/en-us/shopping?bngred=1&isembedded=1&disableheader=1&ocid=startW
Source: chromecache_1608.2.dr	String found in binary or memory: https://www.savvydime.com/california-isnt-the-only-state-planning-to-tax-the-rich-to-solve-inequity-
Source: chromecache_1608.2.dr	String found in binary or memory: https://www.savvydime.com/the-dreaded-california-wealth-tax-has-finally-arrived/
Source: chromecache_1472.2.dr, chromecache_489.2.dr	String found in binary or memory: https://www.suno.ai/legal/privacy
Source: chromecache_1472.2.dr, chromecache_489.2.dr	String found in binary or memory: https://www.suno.ai/legal/terms
Source: chromecache_1734.2.dr	String found in binary or memory: https://www.suno.ai/privacy)
Source: chromecache_1734.2.dr	String found in binary or memory: https://www.suno.ai/terms)
Source: chromecache_1608.2.dr	String found in binary or memory: https://www.wsj.com/articles/california-wealth-tax-bill-sacramento-democrats-gavin-newsom-f0c723b6
Source: chromecache_1460.2.dr	String found in binary or memory: https://www.youngrebelz.com/products/baby-jersey-bodysuit-white
Source: chromecache_1460.2.dr	String found in binary or memory: https://www.youngrebelz.com/products/hooded-sweatshirt-women-white-1
Source: chromecache_1460.2.dr	String found in binary or memory: https://www.youngrebelz.com/products/short-sleeve-white-t-shirt
Source: chromecache_1460.2.dr	String found in binary or memory: https://www.youngrebelz.com/products/soltea
Source: chromecache_441.2.dr	String found in binary or memory: https://www.youtube.com
Source: chromecache_848.2.dr	String found in binary or memory: https://www.youtube.com/api/drm/fps?ek=
Source: chromecache_848.2.dr	String found in binary or memory: https://www.youtube.com/generate_204?cpn=
Source: chromecache_1309.2.dr, chromecache_1142.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api
Source: chromecache_1608.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=WY-dLyZSA10
Source: chromecache_848.2.dr	String found in binary or memory: https://youtu.be/
Source: chromecache_848.2.dr	String found in binary or memory: https://youtube.com/api/drm/fps?ek=uninitialized
Source: chromecache_848.2.dr	String found in binary or memory: https://youtubei.googleapis.com/youtubei/
Source: chromecache_848.2.dr	String found in binary or memory: https://yurt.corp.google.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1992,i,11304834377449891159,15558873975835861540,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://nimblethumb.world/ad88e0364e2c172b62811cb705409770"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4104 --field-trial-handle=1992,i,11304834377449891159,15558873975835861540,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 --field-trial-handle=1992,i,11304834377449891159,15558873975835861540,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1992,i,11304834377449891159,15558873975835861540,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4104 --field-trial-handle=1992,i,11304834377449891159,15558873975835861540,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 --field-trial-handle=1992,i,11304834377449891159,15558873975835861540,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source	Detection	Scanner	Label
https://redux.js.org/tutorials/fundamentals/part-4-store#creating-a-store-with-enhancers	0%	URL Reputation	safe
https://redux.js.org/tutorials/fundamentals/part-4-store#middleware	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://redux.js.org/tutorials/fundamentals/part-6-async-logic#using-the-redux-thunk-middleware	0%	URL Reputation	safe
https://redux.js.org/api/store#subscribelistener	0%	URL Reputation	safe
http://www.bohemiancoding.com/sketch	0%	URL Reputation	safe
https://www.merchant-center-analytics.goog	0%	URL Reputation	safe
https://honemaxwell.com/california-exit-tax/#:~:text=For%20taxable%20years%20from%202024	0%	Avira URL Cloud	safe
https://www.suno.ai/legal/terms	0%	Avira URL Cloud	safe
https://www.suno.ai/legal/privacy	0%	Avira URL Cloud	safe
https://login.microsoftonline.us	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe
https://www.youngrebelz.com/products/hooded-sweatshirt-women-white-1	0%	Avira URL Cloud	safe
https://www.youngrebelz.com/products/short-sleeve-white-t-shirt	0%	Avira URL Cloud	safe
https://www.suno.ai/privacy)	0%	Avira URL Cloud	safe
https://assets.talkshop.live/images/tsl-logo-talkshoplive_r.svg	0%	Avira URL Cloud	safe
https://www.savvydime.com/the-dreaded-california-wealth-tax-has-finally-arrived/	0%	Avira URL Cloud	safe
https://www.youngrebelz.com/products/baby-jersey-bodysuit-white	0%	Avira URL Cloud	safe
https://www.suno.ai/terms)	0%	Avira URL Cloud	safe
https://www.youngrebelz.com/products/soltea	0%	Avira URL Cloud	safe
https://www.savvydime.com/california-isnt-the-only-state-planning-to-tax-the-rich-to-solve-inequity-	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
https://www.msn.com/en-us/shopping?bngred=1&isembedded=1&disableheader=1&ocid=startWidget&FORM=Z9LHS4	false		high
about:blank	false	Avira URL Cloud: safe	low
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=66459529-883c-4d99-a6f4-a6f2be006b3c&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.18.0&x-client-OS=&x-client-CPU=&client_info=1&code_challenge=SQJ8ctQKGIot7MyVhIRQ5K2c8k1KV0XlVSEPd3oGG8E&code_challenge_method=S256&prompt=none&nonce=d81082a2-b615-4699-bcec-295048ed6ae2&state=eyJpZCI6IjQwZjA2YjRlLTExMzMtNDY0OS04ZjRiLWQ2NzE5Yzk5NDUwNyIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_1142.2.dr	false		high
https://redux.js.org/tutorials/fundamentals/part-4-store#creating-a-store-with-enhancers	chromecache_848.2.dr	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm-dark	chromecache_1608.2.dr	false		high
https://www.savvydime.com/the-dreaded-california-wealth-tax-has-finally-arrived/	chromecache_1608.2.dr	false	Avira URL Cloud: safe	unknown
https://www.suno.ai/privacy)	chromecache_1734.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.shopify.com/s/files/1/0065/5812/2036/products/White_T-shirt_design-front_1024x1024.jpg?v	chromecache_1460.2.dr	false		high
https://msasg.visualstudio.com/Bing_Ads/_workitems/edit/3905327	chromecache_495.2.dr, chromecache_1462.2.dr	false		high
https://www.youtube.com/watch?v=WY-dLyZSA10	chromecache_1608.2.dr	false		high
http://youtube.com/streaming/otf/durations/112015	chromecache_848.2.dr	false		high
https://www.msn.com/$	chromecache_495.2.dr, chromecache_1462.2.dr	false		high
https://www.youtube.com	chromecache_441.2.dr	false		high
https://www.google.com	chromecache_1142.2.dr	false		high
https://www.youtube.com/iframe_api	chromecache_1309.2.dr, chromecache_1142.2.dr	false		high
https://login.microsoftonline.us	chromecache_1564.2.dr, chromecache_1278.2.dr	false	Avira URL Cloud: safe	unknown
https://admin.youtube.com	chromecache_848.2.dr	false		high
https://assets.msn.com/staticsb/statics/latest/shopping/discountTag.svg	chromecache_1210.2.dr	false		high
https://www.msn.com/en-us/news/politics/ex-trump-press-aide-breaks-down-true-message-of-his-unhinged	chromecache_1608.2.dr	false		high
https://www.msn.com	chromecache_1275.2.dr	false		high
https://www.youtube.com/api/drm/fps?ek=	chromecache_848.2.dr	false		high
https://assets.msn.com/staticsb/statics/pr-3872652/shopping/tick.svg	chromecache_1210.2.dr	false		high
https://www.msn.com/en-us/health/wellness/8-signs-you-re-the-selfish-partner-in-your-relationship/ar	chromecache_1608.2.dr	false		high
https://redux.js.org/tutorials/fundamentals/part-4-store#middleware	chromecache_848.2.dr	false	URL Reputation: safe	unknown
https://msasg.visualstudio.com/ContentServices/_workitems/edit/3620803	chromecache_495.2.dr, chromecache_1462.2.dr	false		high
https://www.gettyimages.com/detail/1125576617?utm_medium=organic&utm_source=google&utm_campa	chromecache_481.2.dr, chromecache_890.2.dr	false		high
https://bugs.chromium.org/p/v8/issues/detail?id=4118	chromecache_1112.2.dr	false		high
https://github.com/madler/zlib/blob/master/zlib.h	chromecache_848.2.dr, chromecache_441.2.dr	false		high
https://github.com/microsoft/clarity	chromecache_893.2.dr	false		high
https://login.microsoftonline.de	chromecache_1564.2.dr, chromecache_1278.2.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gACQ-dark	chromecache_1608.2.dr	false		high
https://yurt.corp.google.com	chromecache_848.2.dr	false		high
https://viacon.corp.google.com	chromecache_848.2.dr	false		high
https://www.wsj.com/articles/california-wealth-tax-bill-sacramento-democrats-gavin-newsom-f0c723b6	chromecache_1608.2.dr	false		high
https://www.youtube.com/generate_204?cpn=	chromecache_848.2.dr	false		high
http://adaptivecards.io/schemas/adaptive-card.json	chromecache_1462.2.dr	false		high
https://api.msn.com/news/feed/pages/binghp?activityId=944D0647-2500-40E0-9862-6999BCD00A9E&timeOut=2	chromecache_1608.2.dr	false		high
https://www.suno.ai/legal/terms	chromecache_1472.2.dr, chromecache_489.2.dr	false	Avira URL Cloud: safe	unknown
https://www.youngrebelz.com/products/hooded-sweatshirt-women-white-1	chromecache_1460.2.dr	false	Avira URL Cloud: safe	unknown
https://www.youngrebelz.com/products/short-sleeve-white-t-shirt	chromecache_1460.2.dr	false	Avira URL Cloud: safe	unknown
https://assets.talkshop.live/images/tsl-logo-talkshoplive_r.svg	chromecache_1063.2.dr	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/nationwide-has-finally-revealed-its-true-colours-	chromecache_1608.2.dr	false		high
https://www.suno.ai/legal/privacy	chromecache_1472.2.dr, chromecache_489.2.dr	false	Avira URL Cloud: safe	unknown
https://support.google.com/youtube/answer/6276924	chromecache_848.2.dr	false		high
https://github.com/douglascrockford/JSON-js	chromecache_1727.2.dr	false		high
https://www.msn.com/en-us/news/politics/milley-responds-to-trump-execution-comments-it-s-a-free-coun	chromecache_1608.2.dr	false		high
http://youtube.com/yt/2012/10/10	chromecache_848.2.dr	false		high
https://cct.google/taggy/agent.js	chromecache_1142.2.dr	false	URL Reputation: safe	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_848.2.dr	false		high
http://www.opensource.org/licenses/mit-license.php)	chromecache_1727.2.dr	false		high
https://cdn.shopify.com/s/files/1/0065/5812/2036/products/Hooded_Sweatshirt-Women-White-Front2_1024x	chromecache_1460.2.dr	false		high
http://tools.ietf.org/html/rfc1950	chromecache_848.2.dr, chromecache_441.2.dr	false		high
https://honemaxwell.com/california-exit-tax/#:~:text=For%20taxable%20years%20from%202024	chromecache_1608.2.dr	false	Avira URL Cloud: safe	unknown
https://www.gettyimages.com/detail/1194601649?utm_medium=organic&utm_source=google&utm_campa	chromecache_1280.2.dr	false		high
http://www.youtube.com/videoplayback	chromecache_848.2.dr	false		high
https://stats.g.doubleclick.net/g/collect?v=2&	chromecache_1142.2.dr	false		high
https://support.google.com/youtube/?p=missing_quality	chromecache_848.2.dr	false		high
https://www.lotteryusa.com/mega-millions/	chromecache_1462.2.dr	false		high
https://www.youngrebelz.com/products/baby-jersey-bodysuit-white	chromecache_1460.2.dr	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/statics/icons/Microsoft_16_SVG.ico	chromecache_1693.2.dr, chromecache_1664.2.dr	false		high
https://support.google.com/youtube/?p=report_playback	chromecache_848.2.dr	false		high
https://storage.live.com/users/0x	chromecache_1698.2.dr	false		high
https://login.chinacloudapi.cn	chromecache_1564.2.dr, chromecache_1278.2.dr	false		high
https://cdn.shopify.com/s/files/1/0065/5812/2036/products/CoupleRunning_116b0436-cd87-4e2f-a4c4-a02a	chromecache_1460.2.dr	false		high
https://login.windows-ppe.net	chromecache_1564.2.dr, chromecache_1278.2.dr, chromecache_1610.2.dr	false		high
https://developers.google.com/youtube/iframe_api_reference#Events	chromecache_441.2.dr	false		high
https://www.msn.com/en-us/money/markets/it-s-not-the-economy-it-s-inflation-stupid/ar-BB1k8SY6	chromecache_1608.2.dr	false		high
http://youtube.com/streaming/metadata/segment/102015	chromecache_848.2.dr	false		high
https://cdn.shopify.com/s/files/1/0065/5812/2036/products/Baby_Jersey_Bodysuit-Front_1024x1024.jpg?v	chromecache_1460.2.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm	chromecache_1608.2.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gACQ	chromecache_1608.2.dr	false		high
https://youtu.be/	chromecache_848.2.dr	false		high
https://www.msn.com:443/en-us/shopping?bngred=1&isembedded=1&disableheader=1&ocid=startW	chromecache_1698.2.dr	false		high
https://login.microsoftonline.com	chromecache_1564.2.dr, chromecache_1278.2.dr, chromecache_1610.2.dr	false		high
https://www.msn.com/en-us/movies/news/the-next-james-bond-has-reportedly-been-chosen-and-film-fans-a	chromecache_1608.2.dr	false		high
https://www.msn.com/en-us/news/us/n-j-reports-huge-jump-in-number-of-people-seeking-gun-carry-permit	chromecache_1608.2.dr	false		high
https://www.msn.com/en-us/news/us/fiery-school-board-meeting-brings-out-black-panthers-in-virginia/a	chromecache_1608.2.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gALZ	chromecache_1608.2.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gALZ-dark	chromecache_1608.2.dr	false		high
https://redux.js.org/tutorials/fundamentals/part-6-async-logic#using-the-redux-thunk-middleware	chromecache_848.2.dr	false	URL Reputation: safe	unknown
https://assets.msn.com/staticsb/statics/pr-3872652/shopping/plusw.svg	chromecache_1210.2.dr	false		high
https://redux.js.org/api/store#subscribelistener	chromecache_848.2.dr	false	URL Reputation: safe	unknown
https://youtube.com/api/drm/fps?ek=uninitialized	chromecache_848.2.dr	false		high
https://www.suno.ai/terms)	chromecache_1734.2.dr	false	Avira URL Cloud: safe	unknown
http://www.bohemiancoding.com/sketch	chromecache_1063.2.dr	false	URL Reputation: safe	unknown
http://knockoutjs.com/	chromecache_1727.2.dr	false		high
https://docs.google.com/get_video_info	chromecache_848.2.dr	false		high
https://www.lotteryusa.com/powerball/	chromecache_1462.2.dr	false		high
https://highlightjs.org/	chromecache_1731.2.dr	false		high
https://www.youngrebelz.com/products/soltea	chromecache_1460.2.dr	false	Avira URL Cloud: safe	unknown
https://bugs.chromium.org/p/v8/issues/detail?id=3056	chromecache_1112.2.dr	false		high
https://apnews.com/article/california-budget-deficit-29315d622212facef307ddab29d4c0c7	chromecache_1608.2.dr	false		high
https://td.doubleclick.net	chromecache_1142.2.dr	false		high
https://www.gettyimages.com/detail/1190440285?utm_medium=organic&utm_source=google&utm_campa	chromecache_1718.2.dr, chromecache_1083.2.dr	false		high
https://www.savvydime.com/california-isnt-the-only-state-planning-to-tax-the-rich-to-solve-inequity-	chromecache_1608.2.dr	false	Avira URL Cloud: safe	unknown
https://www.merchant-center-analytics.goog	chromecache_1142.2.dr	false	URL Reputation: safe	unknown
https://angular.io/license	chromecache_862.2.dr	false		high
http://youtube.com/drm/2012/10/10	chromecache_848.2.dr	false		high
http://feross.org	chromecache_605.2.dr, chromecache_849.2.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
204.79.197.200	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.64.118	unknown	United States	15169	GOOGLEUS	false
23.44.201.17	unknown	United States	20940	AKAMAI-ASN1EU	false
157.240.241.35	unknown	United States	32934	FACEBOOKUS	false
104.21.19.116	unknown	United States	13335	CLOUDFLARENETUS	false
13.107.213.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.126.24.84	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.33.40.140	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.201.24	unknown	United States	20940	AKAMAI-ASN1EU	false
40.126.24.82	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.209.72.35	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.80.35	unknown	United States	15169	GOOGLEUS	false
40.79.141.152	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.5.80	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.72.104	unknown	United States	15169	GOOGLEUS	false
152.199.4.44	unknown	United States	15133	EDGECASTUS	false
142.250.80.74	unknown	United States	15169	GOOGLEUS	false
142.251.40.142	unknown	United States	15169	GOOGLEUS	false
23.209.72.27	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.65.206	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.40.182	unknown	United States	15169	GOOGLEUS	false
18.164.96.83	unknown	United States	3	MIT-GATEWAYSUS	false
31.13.71.7	unknown	Ireland	32934	FACEBOOKUS	false
142.251.32.110	unknown	United States	15169	GOOGLEUS	false
23.44.129.51	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.201.32	unknown	United States	20940	AKAMAI-ASN1EU	false
173.194.7.138	unknown	United States	15169	GOOGLEUS	false
40.126.24.147	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.200.3.10	unknown	United States	20940	AKAMAI-ASN1EU	false
31.13.71.36	unknown	Ireland	32934	FACEBOOKUS	false
13.107.21.200	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.176.206	unknown	United States	15169	GOOGLEUS	false
142.251.32.99	unknown	United States	15169	GOOGLEUS	false
104.70.121.147	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.80.42	unknown	United States	15169	GOOGLEUS	false
20.189.173.11	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.64.78	unknown	United States	15169	GOOGLEUS	false
23.43.85.24	unknown	United States	3257	GTT-BACKBONEGTTDE	false
142.251.41.14	unknown	United States	15169	GOOGLEUS	false
142.251.40.193	unknown	United States	15169	GOOGLEUS	false
142.251.32.100	unknown	United States	15169	GOOGLEUS	false
23.44.129.46	unknown	United States	20940	AKAMAI-ASN1EU	false
142.251.41.10	unknown	United States	15169	GOOGLEUS	false
20.246.175.39	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.209.72.9	unknown	United States	20940	AKAMAI-ASN1EU	false
142.251.179.84	unknown	United States	15169	GOOGLEUS	false
23.200.3.20	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.65.193	unknown	United States	15169	GOOGLEUS	false
104.70.121.211	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.64.68	unknown	United States	15169	GOOGLEUS	false
104.117.182.72	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.81.227	unknown	United States	15169	GOOGLEUS	false
142.251.40.166	unknown	United States	15169	GOOGLEUS	false
23.209.72.43	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.176.194	unknown	United States	15169	GOOGLEUS	false
204.79.197.203	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.35.162	unknown	United States	15169	GOOGLEUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1412023
Start date and time:	2024-03-19 22:09:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://nimblethumb.world/ad88e0364e2c172b62811cb705409770
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@38/1611@0/62
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.bing.com/chat?q=Bing+AI&FORM=hpcodx Browse: https://www.bing.com/chat?q=Bing+AI&FORM=hpcodx Browse: https://www.bing.com/images?FORM=Z9LH Browse: https://www.bing.com/videos?FORM=Z9LH1 Browse: https://www.bing.com/shop?FORM=Z9LHS4

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 124x70, components 3
Category:	downloaded
Size (bytes):	1629
Entropy (8bit):	7.636108185009345
Encrypted:	false
SSDEEP:	48:pXz4Xdj12ewTwu97P9BGUI00dwAgY4zmrAttt:N+dj1mw67w00dyNyAtv
MD5:	E84E7EECE4CA3739B99B714AB325B54D
SHA1:	E448383890E85B70B3FFAC02D8EC9B9793DE969E
SHA-256:	4094A14F728009CA449F798FC9A213EA458F150C4237E9350DE8F6FDDB35033A
SHA-512:	D332E0A28489FE33A2F6E4B8BE76CC08D256FDF9C7D0BB59A8FD62B72BA6F6C9D62571597FB8A9A9AE2A81BE1C9055E3F576A00D03CDD0ECCD6A075F1D3C52BF
Malicious:	false
Reputation:	low
URL:	https://th.bing.com/th?id=OPHS.AUlvZhOiXTdPzQ474C474&o=5&pid=21.1&h=70&c=17&rs=1
Preview:	......JFIF.............C.......................................%..%....)).%756.2>-)0.;!....C...........,...,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,......F.\|.."........................................B..........................!..12AQq..."5su...#$Bat..36Rc...%4Sb...............................!.......................1A...!.2............?..U.b..E..\|...1.f.N........\z..n2.)(......p.x..Wv5...F~.Q..tX.Y.m=......s..:...nf&......?......7K.2....q..\.G...........n...?~......}mZ.....n...j.G.<..5....t...id...$.}...?X......g..[c...mT...ic.......p.Ik.Y..0.t.w/.'PY.....nhN.5.1..&.c..S;.....3.....s.KD...c.h."..X..lb.k.z..a.4.......kEra...i.<Q.)Q..-'9....g...(<....[.h?.'.......';5..~?..z$....<)1.M1/6.o...rvG.a$x........fc...'`.?79Lf........e....4....@...Sd..,{\:..G./...].ph.`...jpo...Xv...U....".....Ef..9/ZG.>KK...?.....etn~......*.Wf....n..y..A.b...h[a.......F.G.Z.);+.."....RKV.PiK..226..y9.K;./:q...?)^...588..W.j.8.........._......}..u.#.......?.....F.&m=

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20641)
Category:	downloaded
Size (bytes):	252360
Entropy (8bit):	5.400953394312655
Encrypted:	false
SSDEEP:	3072:OQH7dnQpa2oDXkl6BhxaHNRHa0CMBx6/8WcxGK3FHnHs7IJuB:XQpaDa6B3aHfa0BbxGsFHHa2K
MD5:	AC683AC26CD4630070880F7027464700
SHA1:	7FEACEB2B8CA453B188A1B4D5A4762A39D8B58CD
SHA-256:	C6C86DDCD7F73EDFFA4C1091BF3975F07DB4F0449A0A44A9B8A630E991691AF4
SHA-512:	CF801120BF544204DE737DEFF98F3A2B66BCAD6A8554978994FB57C950037667C1E487C15D1A8D3A2AADB72CECC746C0AA78C3FF1147189F9E5E8C1A946E96E5
Malicious:	false
Reputation:	low
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/web-components_super-cards_dist_cards_super-sd-card_core-sd-card_register_js.8126ba465c1ab3787566.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["web-components_super-cards_dist_cards_super-sd-card_core-sd-card_register_js"],{25642:function(t,e,i){"use strict";i.d(e,{I:function(){return n}});const n="8px"},26682:function(t,e,i){"use strict";i.d(e,{Fv:function(){return n}});class n{constructor(){this.supports3DContent=!1}attemptNavItemChange(t){return!!this.superNavChangeCallback&&(this.superNavChangeCallback(t),!0)}disconnectSuperNav(){this.superNavChangeCallback=void 0}getForceSelectedNavItemId(){return this.forceSelectedNavItemId}getSupports3DContent(){return this.supports3DContent}static getInstance(t){return n.instance\|\|(n.instance=new n),t&&(n.instance.superNavChangeCallback=t),n.instance}registerForceSelectedNavItemId(t){this.forceSelectedNavItemId=t}registerSupports3DContent(t){this.supports3DContent=t}}},66857:function(t,e,i){"use strict";let n;i.d(e,{k:function(){return o}});const o=t=>{n&&t&&n.observe(t)}},75938:functi

Target ID:	0
Start time:	22:10:31
Start date:	19/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	22:10:33
Start date:	19/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1992,i,11304834377449891159,15558873975835861540,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	22:10:35
Start date:	19/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://nimblethumb.world/ad88e0364e2c172b62811cb705409770"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	22:10:50
Start date:	19/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4104 --field-trial-handle=1992,i,11304834377449891159,15558873975835861540,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://nimblethumb.world/ad88e0364e2c172b62811cb705409770

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 1000

Chrome Cache Entry: 1001

Chrome Cache Entry: 1002

Chrome Cache Entry: 1003

Chrome Cache Entry: 1004

Chrome Cache Entry: 1005

Chrome Cache Entry: 1006

Chrome Cache Entry: 1007

Chrome Cache Entry: 1008

Chrome Cache Entry: 1009

Chrome Cache Entry: 1010

Chrome Cache Entry: 1011

Chrome Cache Entry: 1012

Chrome Cache Entry: 1013

Chrome Cache Entry: 1014

Chrome Cache Entry: 1015

Chrome Cache Entry: 1016

Chrome Cache Entry: 1017

Chrome Cache Entry: 1018

Chrome Cache Entry: 1019

Chrome Cache Entry: 1020

Chrome Cache Entry: 1021

Chrome Cache Entry: 1022

Chrome Cache Entry: 1023

Chrome Cache Entry: 1024

Chrome Cache Entry: 1025

Chrome Cache Entry: 1026

Windows Analysis Report
https://nimblethumb.world/ad88e0364e2c172b62811cb705409770