Edit tour

Windows Analysis Report
https://url.us.m.mimecastprotect.com/s/qfbjCOY674iMrZ7sEflHGWtli?domain=lp.05nissa.site

Overview

General Information

Sample URL:	https://url.us.m.mimecastprotect.com/s/qfbjCOY674iMrZ7sEflHGWtli?domain=lp.05nissa.site
Analysis ID:	1564483

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish54

AI detected suspicious URL

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 3980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1924,i,8358111970566542821,7116288234873693145,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6616 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.us.m.mimecastprotect.com/s/qfbjCOY674iMrZ7sEflHGWtli?domain=lp.05nissa.site" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.11.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.10.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.18.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.11.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.12.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.14.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.16.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 2 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'lp.05nissa.site' does not match the legitimate domain for Microsoft., The domain '05nissa.site' is unusual and not associated with Microsoft., The use of a subdomain 'lp' and a non-standard domain name is a common tactic in phishing attempts., The presence of input fields for sensitive information like Email, phone, or Skype on an unverified domain increases the risk of phishing. DOM: 2.14.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 0.11.id.script.csv, type: HTML
Source: Yara match	File source: 1.10.pages.csv, type: HTML
Source: Yara match	File source: 0.18.id.script.csv, type: HTML
Source: Yara match	File source: 2.11.pages.csv, type: HTML
Source: Yara match	File source: 2.12.pages.csv, type: HTML
Source: Yara match	File source: 2.14.pages.csv, type: HTML
Source: Yara match	File source: 2.16.pages.csv, type: HTML

AI detected suspicious URL

Source: Email	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://lp.05nissa.site
Source: Email	Joe Sandbox AI: AI detected Typosquatting in URL: https://lp.05nissa.site
Source: Email	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://05nissa.site
Source: Email	Joe Sandbox AI: AI detected Typosquatting in URL: https://05nissa.site

Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true

HTTP Parser: Number of links: 0

Source: https://lp.05nissa.site/?w0A1Q9=N2

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 88px; height: 31px; overflow: hidden; position: relative;"]

Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: Iframe src: https://f44e56aa-522bcf86.05nissa.site/Prefetch/Prefetch.aspx
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: Iframe src: https://f44e56aa-522bcf86.05nissa.site/Prefetch/Prefetch.aspx
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: Iframe src: https://f44e56aa-522bcf86.05nissa.site/Prefetch/Prefetch.aspx
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: Iframe src: https://81a9ffde-522bcf86.05nissa.site/?session_id=42607d98-8a23-4ba8-b0ce-4a49829f62e9&instanceid=9e21cb52-25cc-4c73-b853-e8d4ae325369&assessment=asmtaadeu&requestid=d3f66f8f-7c72-41eb-90b1-c92c51569100

Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true

HTTP Parser: <input type="password" .../> found

Source: https://lp.05nissa.site/?w0A1Q9=N2	HTTP Parser: No favicon
Source: https://lp.05nissa.site/?w0A1Q9=N2	HTTP Parser: No favicon
Source: https://lp.05nissa.site/?w0A1Q9=N2	HTTP Parser: No favicon
Source: https://lp.05nissa.site/?w0A1Q9=N2	HTTP Parser: No favicon
Source: https://lp.05nissa.site/?w0A1Q9=N2	HTTP Parser: No favicon
Source: https://lp.05nissa.site/?w0A1Q9=N2	HTTP Parser: No favicon
Source: https://lp.05nissa.site/?w0A1Q9=N2	HTTP Parser: No favicon
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: No favicon
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: No favicon
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: No favicon
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: No favicon
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: No favicon
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: No favicon
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: No favicon

Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.72:443 -> 192.168.2.17:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49752 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197

Source: global traffic	DNS traffic detected: DNS query: url.us.m.mimecastprotect.com
Source: global traffic	DNS traffic detected: DNS query: lp.05nissa.site
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 3b7cbebb-522bcf86.05nissa.site
Source: global traffic	DNS traffic detected: DNS query: 44dd7308-522bcf86.05nissa.site
Source: global traffic	DNS traffic detected: DNS query: 5fa47d26-522bcf86.05nissa.site
Source: global traffic	DNS traffic detected: DNS query: l1ve.05nissa.site
Source: global traffic	DNS traffic detected: DNS query: f44e56aa-522bcf86.05nissa.site
Source: global traffic	DNS traffic detected: DNS query: 81a9ffde-522bcf86.05nissa.site
Source: global traffic	DNS traffic detected: DNS query: a6cd8606-522bcf86.05nissa.site
Source: global traffic	DNS traffic detected: DNS query: bbc95e37-522bcf86.05nissa.site

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.72:443 -> 192.168.2.17:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49752 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@19/39@38/169

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1924,i,8358111970566542821,7116288234873693145,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.us.m.mimecastprotect.com/s/qfbjCOY674iMrZ7sEflHGWtli?domain=lp.05nissa.site"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1924,i,8358111970566542821,7116288234873693145,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
https://url.us.m.mimecastprotect.com/s/qfbjCOY674iMrZ7sEflHGWtli?domain=lp.05nissa.site	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
5fa47d26-522bcf86.05nissa.site	170.64.219.79	true	false	unknown
bbc95e37-522bcf86.05nissa.site	170.64.219.79	true	false	unknown
url.us.m.mimecastprotect.com	207.211.31.106	true	false	high
f44e56aa-522bcf86.05nissa.site	170.64.219.79	true	false	unknown
44dd7308-522bcf86.05nissa.site	170.64.219.79	true	false	unknown
81a9ffde-522bcf86.05nissa.site	170.64.219.79	true	false	unknown
3b7cbebb-522bcf86.05nissa.site	170.64.219.79	true	false	unknown
www.google.com	142.250.181.68	true	false	high
lp.05nissa.site	170.64.219.79	true	true	unknown
a6cd8606-522bcf86.05nissa.site	170.64.219.79	true	false	unknown
l1ve.05nissa.site	170.64.219.79	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true	true		unknown
https://lp.05nissa.site/?w0A1Q9=N2	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.227	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.17.78	unknown	United States	15169	GOOGLEUS	false
207.211.31.106	url.us.m.mimecastprotect.com	United States	14135	NAVISITE-EAST-2US	false
172.217.17.46	unknown	United States	15169	GOOGLEUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
142.250.181.106	unknown	United States	15169	GOOGLEUS	false
74.125.205.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
172.217.21.36	unknown	United States	15169	GOOGLEUS	false
142.250.181.99	unknown	United States	15169	GOOGLEUS	false
172.217.17.42	unknown	United States	15169	GOOGLEUS	false
170.64.219.79	5fa47d26-522bcf86.05nissa.site	United States	16761	FEDMOG-ASN-01US	true

Private

IP
192.168.2.17
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564483
Start date and time:	2024-11-28 11:17:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://url.us.m.mimecastprotect.com/s/qfbjCOY674iMrZ7sEflHGWtli?domain=lp.05nissa.site
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@19/39@38/169

Warnings

Exclude process from analysis (whitelisted): TextInputHost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.17.46, 74.125.205.84, 34.104.35.123, 192.229.221.95, 142.250.181.99
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, ocsp.digicert.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, clientservices.googleapis.com, clients.l.google.com, www.gstatic.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://url.us.m.mimecastprotect.com/s/qfbjCOY674iMrZ7sEflHGWtli?domain=lp.05nissa.site

LLM Input / Output

Input	Output
URL: https://url.us.m.mimecastprotect.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": true, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://url.us.m.mimecastprotect.com
URL: https://lp.05nissa.site Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://lp.05nissa.site
URL: https://lp.05nissa.site/?w0A1Q9=N2 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "I'm not a robot", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://lp.05nissa.site/?w0A1Q9=N2 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "I'm not a robot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://lp.05nissa.site/?w0A1Q9=N2 Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://lp.05nissa.site/?w0A1Q9=N2 Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://lp.05nissa.site/?w0A1Q9=N2 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "I'm not a robot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://lp.05nissa.site/?w0A1Q9=N2 Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://lp.05nissa.site/?w0A1Q9=N2 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "SKIP", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://lp.05nissa.site/?w0A1Q9=N2 Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://lp.05nissa.site/?w0A1Q9=N2 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "motorcycles", "prominent_button_name": "VERIFY", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://lp.05nissa.site/?w0A1Q9=N2 Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in", "prominent_button_name": "Next", "text_input_field_labels": [ "Email, phone, or Skype" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.", "The URL 'lp.05nissa.site' does not match the legitimate domain for Microsoft.", "The domain '05nissa.site' is unusual and not associated with Microsoft.", "The use of a subdomain 'lp' and a non-standard domain name is a common tactic in phishing attempts.", "The presence of input fields for sensitive information like Email, phone, or Skype on an unverified domain increases the risk of phishing." ], "riskscore": 9} Google indexed: False
URL: lp.05nissa.site Brands: Microsoft Input Fields: Email, phone, or Skype
URL: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in", "prominent_button_name": "Next", "text_input_field_labels": [ "isdh" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in", "prominent_button_name": "Next", "text_input_field_labels": [ "isdnhfisdhfi@microsoft.com" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Taking you to your organization's sign-in page", "prominent_button_name": "Cancel", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://lp.05nissa.site/?w0A1Q9=N2&sso_reload=true Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://05nissa.site Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://05nissa.site

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 28 09:18:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9868414647508263
Encrypted:	false
SSDEEP:
MD5:	82F155D06CC36736035AED7AE7A1D473
SHA1:	5342E93FAFB844B6F8D85D8B881FAC063E3E2DBC
SHA-256:	70C0C2EA4E1B9D902AE07EEED3F19E38C6EA33C257462BBD9AF1720EC55392E7
SHA-512:	3C3C76F51D3F903B8E2FD4CBD76823E2B1E8572C5301841A090163EBC4C9AD2171867CE07F2C462DFC85D4396201D858667424605EE3754296C87231549B891E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......\.~A......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|YCR....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|YKR....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|YKR....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|YKR...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\|YLR...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........-.(0.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 28 09:18:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.000820031148875
Encrypted:	false
SSDEEP:
MD5:	601830DA37E6EE646728FA4E92BBB3CE
SHA1:	5AF774AEB1E17FAE0FD06DE7AA9544C368ECEF3B
SHA-256:	227EBED69B87044EBAD4FFD7752464F42AA7B7DD4F5A54049004F107C739155E
SHA-512:	5A1A5FD105307D2E3A940689AD135F67EC3F870BE5EAFFFF0D67AC623522BE22D0289D59CF7D0E739B9681CA2A358074D2BD7DF1D80523A062B770744D2DA5A2
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......P.~A......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|YCR....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|YKR....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|YKR....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|YKR...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\|YLR...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........-.(0.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.014935152158812
Encrypted:	false
SSDEEP:
MD5:	630003DE195CFE3C73F2370BDFFD1F55
SHA1:	494CF7968482FA90982D4A042F0FCC6F45DF9AF5
SHA-256:	14D90C780461E29CEF71CD684C4951FB13A2112BFF84E1F51280F020CFB35441
SHA-512:	200F4D8F1024DE3D4CA5775D33D06BCCADB0945CAB6D21A071533ED9DC6FC2F551B08228AD85875AE4CDCA777052A7FBED3D0A63AC1C555C93B746DD1BC3B357
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|YCR....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|YKR....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|YKR....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|YKR...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........-.(0.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 28 09:18:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.003523782577305
Encrypted:	false
SSDEEP:
MD5:	67B5CD6FC1CB40242D773D2288FF3C07
SHA1:	D7C647BF988A433B1AFAC8CB26CF3A17DF095A22
SHA-256:	BD2BDA5D25EBC9C45C9BB52BFBC46BF3DBFD734816A8C1E704F12D109798C9E5
SHA-512:	8E3FC60BBF5A15E39637F83E9A4F2C2ADD9B7F37C57A0B13AB6B4CFE86C21ABCFFEAFCA048881894769E9D5E85DF80D0F6C2CE4FA45AA8CD3263B74C9393F918
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......J.~A......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|YCR....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|YKR....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|YKR....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|YKR...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\|YLR...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........-.(0.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 28 09:18:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.988399896716534
Encrypted:	false
SSDEEP:
MD5:	E022C797FD5D539BE1E1322CCBB8A213
SHA1:	D77B0705FC2D4E79897C03BFFADA790341F60CED
SHA-256:	1287D750225FFA34BC9B2B7839D0AB27FB029611B71A5014D4628B54008CA264
SHA-512:	306E3C0CF711E26E6F71BE66A33B826A980FC5931B6047DD5CFC60513946C95D7C0D3FE8163746BDB18FB098FE3B69F6FC735DBDD2990205FCAC5491B6AF1980
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....U~W.~A......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|YCR....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|YKR....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|YKR....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|YKR...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\|YLR...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........-.(0.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 28 09:18:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9994722255023825
Encrypted:	false
SSDEEP:
MD5:	1DBFE55CECA8385A904A1D2CD340A4B9
SHA1:	BA5322DB5CB9DEA06A8F7832D9263D3BDE7DD8E2
SHA-256:	E9F6FB1558DF89C009DECDEE0F02BF4F7F528972233D6E9C4AD013D200A343FB
SHA-512:	724A7A34FABECC39D83DDEC91855EFF8558577DA24702AE84827CDC69D080FF7C904C9AD052F61EBE46D36511338EE0B21343F17A414DBAD40375C02121EEB1F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....K^A.~A......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\|YCR....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|YKR....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\|YKR....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\|YKR...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\|YLR...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........-.(0.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 450x450, components 3
Category:	dropped
Size (bytes):	27365
Entropy (8bit):	7.958669299164133
Encrypted:	false
SSDEEP:
MD5:	C3BFAD9943F61B8D432BA572002E4968
SHA1:	94B7C5D6462D971A550A8A4F0B5699AB70EA69D0
SHA-256:	C133A91ADB1E027392F63E807C2809EF6A5B540E5CA5070A4DF717A3C95F83B9
SHA-512:	7245B86D6009EC5756CC77643F879640B3E1F42A5481BEF787287677FCF6D9D856E52EE9266EE7C20E5CF7A5EEBB529BFD1DC4DC94DC3A94382AC6DB6AD97A5E
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C..............................................!........."$".$.......C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..SLs.O...E2@.J.D=.H.:T..63....+J8.S..A.UyW..`%l...L.BIR..;<.. ....1....".2.p1P....)...7....d....$..Z.14e[..R.......@..c.H.&.J..rjt....F.q...O....C..~..pf.G.....E#.Fh...I.jUl..*8"....Rb,.I....)C.#&..Qa........Bzb....@.....!..[q.;....h. 8.W4...Y.r.zU1.y.V.i.......D.b1.....O..k.{T...1...d`U.#.+......Sr....Z{....Ht..Tv.v......mx_q...^..?...'.l.....W.so=...

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6584200238076905
Encrypted:	false
SSDEEP:
MD5:	2D2CBA7D7DC75F3BA9DC756738D41A6E
SHA1:	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC
SHA-256:	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
SHA-512:	46F17658CA247C02F612213025350390D8F62179C8DE26725EB17F5CCFAFDD63F2149DA1765D3C2F3A12FE85EF29CAC58457B0D5C2F8DA8DED6E1231A35F199D
Malicious:	false
Reputation:	unknown
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.860223690068481
Encrypted:	false
SSDEEP:
MD5:	DF6A7721C242813411CC6950DF40F9B3
SHA1:	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4
SHA-256:	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
SHA-512:	CDCFB686649F2061FE13A58841EB6A4E17F40951BA0C440C568B248E6128B6E0C4E79F95DC3EAB81286C103ED2A966F7058D22066466ADED482BF9ECAA6EA3CB
Malicious:	false
Reputation:	unknown
URL:	https://5fa47d26-522bcf86.05nissa.site/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 449913
Category:	dropped
Size (bytes):	122333
Entropy (8bit):	7.997627835273116
Encrypted:	true
SSDEEP:
MD5:	C61A2DCB08D0072179BBADAB181BA68C
SHA1:	FBAE133CFF31BDAFDC0BBCCEECCEC5F6868505BB
SHA-256:	278FA54F352C2570CDA1C6CB6D70D9ED3ADDCFB1BF256A038D8988AB2BEF1593
SHA-512:	B7960D05708FD169A59D29FF777FC560F250A2113A9FA7A11F9F01225B7B0A65A01060E67B67377CCDBB3D40A6A513BC3F7C9EF30BF483E222FA4ED96154E59B
Malicious:	false
Reputation:	unknown
Preview:	...........{W.8.....{_&.L:.....t...C.g...,.V......;.\|._UI.....u...G.K.W.T..J.~...J?.v..?..u..48)].>.:]..?K...............4.\|V..#;fn).JaT..'.fad',.M.....8....fQ.'s...{q..F...Ke..rK.v...N/+U..Am.......^..CR...sX..\... f.y....9..s..8.'..9.{.F.9...Kv.J1KJ.0J.x?..!B.Zcj....8t..s..1.....z!vq6.Ac.0._.J'....>......E..x...x.....g.A...Ts.Y.]..R..Q...c.K.e....Z.Dv.(.......)........Mg....^bq..f......U%..J..aP..........vkF.g=$.,6?\|.x..\|T.../..j.%...'.....G.........1/y.f...#.J.(..^ ..T..47..r..0......-....2.u.ak<...X.U..w)(...F.'.fA....nkwz...;=.j.c.......I....T<+.......O.. .....>...9....PU.."(.W..o...m.:...e..V:..j...h..U...HO..2.M....P.......wdO+N5~..I.R.,....R..E.i..).BD.7.{..]%b.<.J.....+2...&Y...t..2t.i...}Q.a!.c"....+..[[.,my"z..z....[9.zQd..1.J}C.K.b..&..-...1-.J......s..R.....m......N..&.+1...Si....T\.8`{.3.B...DL}4..u........`?....W`Z".S.S..<= ....Z...n."..*}..K.{0...._..A%..L...I)UX...)y..P.......G.....z{K?',9............@Z..2.(.

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	600
Entropy (8bit):	7.391634169810707
Encrypted:	false
SSDEEP:
MD5:	0F2A4639B8A4CB30C76E8333C00D30A6
SHA1:	57E273A270BB864970D747C74B3F0A7C8E515B13
SHA-256:	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
SHA-512:	3EA72C7E8702D2E9D94B0FAA6FA095A33AB8BC6EC2891F8B3165CE29A9CCF2114FAEF424FA03FD4B9D06785326284C1BB2087CE05E249CCAC65418361BFA7C51
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/recaptcha/api2/refresh_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..M+.Q.....&/....&......6...\|.I..).o.I.X..#.@.bb.D.'5....m...=..y........{....<.P..;.H......f...3l...M.I...j2.....3..1x..S......9..<m...E.'F'.. ...M.j...C..c.5.-..F..3H./F!.."V.e.i.}.Y....../.rw...@...].rp...`CQo(.....J...u.".!E...$.^$...k....b....@.^.;.u5........H/Q{..$..'..........w...r.+xS.uR..J.......GD.O./.. G7..l...J.t.3.S...N.7...e..s.-Jlj)..5E....E.;8w4.k..=.li.G...1.c....p,T6;....1.oW.%.2,..Z..a...*m.s}T1F....Hr.1......<x0.....-.i......IEND.B`.

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 3505
Category:	downloaded
Size (bytes):	1418
Entropy (8bit):	7.868973950726795
Encrypted:	false
SSDEEP:
MD5:	342B499DC2BADFE7DA31C2A6C7916F4D
SHA1:	8CC6C746CDD3802719100DDC81FF3888D2CAF505
SHA-256:	B1885EC033729DE2E6ADB7A923362D5B9F0A528BDD886C5F9651CD6E09AECDCC
SHA-512:	B180AEBA3C4D2F32F559B784752A4879270F3CD1C1F1249899D4F6929A8A502B442E35989C2806E68B3AB489686801F4304106C49B078954F5D8C46F88416B73
Malicious:	false
Reputation:	unknown
URL:	https://l1ve.05nissa.site/Me.htm?v=3
Preview:	...........W..8.~._.V..._6..a....S..m..t.4'..._....b.........}.%.g>..xf.nt.Dfz.[.)2......XeE.Oz.x+C#Ri...>N..c..{B.86..P..r..&.3...=nI.....2........._.T.=+..-Lt_.}ND.I..,..w.Y.j..%.%.."H..1\|..h.i..7...... ..)...E.p.....hn..RV..N...M.")...Wf=.7r6.h.r..PJM-.......b.(..7^=.M.Y... .`.(........g.m.%.Xh.0..".n...1.........x...[..\|.Y...0\|R..$.K.n=.Oz.......s@......w .74...Km..+....#..FQd..R...4IM#.....A...Ee...(.&.....O..M..#......S...\|[.El,.I_4..RK..l...-u..2.Z...'(1...^d..Si...YH.Z..\.e..eP...6.!"...<.K...y.;.B....M.P...&.....0....b.S.1.HD.F.......z...G...4..7.W...,.......R.k...n.~L?..x......5.....C.+.M..7TH.E.:.N.Rks...GV.`]UX.c.I..+........4.........PP...sUd...[..BL..<...@..-BV7......S%VB..cG.0l.}.p..wo.U.....a......s..ax.....ar6...07.p].j..MZ...].bJ.q....]..4..}..H7Y*....RUx5..^....X.....b.).7.I-....=.p.WZhslZ3.T...a..<'.....+....`!T."..#..l5Wo..[.....T.&.I1p...o7.$.~.X..]...fIZL.X...N..........u.U....}.3.%ewe.!9Y?......Q.=.....,.q.0....Yp$..

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAm8L8SXrfLCpRIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
Category:	downloaded
Size (bytes):	15552
Entropy (8bit):	7.983966851275127
Encrypted:	false
SSDEEP:
MD5:	285467176F7FE6BB6A9C6873B3DAD2CC
SHA1:	EA04E4FF5142DDD69307C183DEF721A160E0A64E
SHA-256:	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
SHA-512:	5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......\|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v..7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....\|...H....Fk.-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..\|..d...\|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 23738
Category:	downloaded
Size (bytes):	10216
Entropy (8bit):	7.976048185595134
Encrypted:	false
SSDEEP:
MD5:	6B624F07EFCCD662E514AB8FCF5CFB30
SHA1:	D2B1DF0AD32E7CE193E73F1E9251E1FBF2695496
SHA-256:	3F1444FBDE19368CCBCD22DEB0B7CECB5E89209831FE40A92F7039775CB800C1
SHA-512:	CE71ED7974E97B2F1E2C3D5A1A6F11BAC9353320138AF3A78A6F4E866572DD5483C0C9B7711B863C2FA5FA92B244ADF6C51A11A29A13655707C46152D1D38B06
Malicious:	false
Reputation:	unknown
URL:	https://81a9ffde-522bcf86.05nissa.site/?session_id=42607d98-8a23-4ba8-b0ce-4a49829f62e9&instanceid=9e21cb52-25cc-4c73-b853-e8d4ae325369&assessment=asmtaadeu&requestid=d3f66f8f-7c72-41eb-90b1-c92c51569100
Preview:	...........\|{s....[......&.&.. .Jo.WD.........-.`.A..R..<&.<.R.d.;3.q.$3.;I.O2.o....Wp......a... .....8...{...=.../.Z?Xk>:.Hu..u....%.M].,.S.........._...+......#p`....?K..[.....7j.t.........]....a.z.0{@]...a.Y.,.-.U.mz...L..-..o...47....]..Ku...K..,.-....Vo..J...r5M..J-..k.t.+i.zM......l..z...^.WJ....Z].-.&Ph.\...9.Z..Jz....Z)'..^m.%.].-j....m_[...t..=.....vae{...../...{.J...s..wqQ..\l..*_..\.[.W.....z....+.....%m.6.w.O.My.._.....=..i....].C.u..>.v..N.x..x......]~Z\|...J..v..\....~w.io].>j.>\|.-......5W..7..+.;..au..J.7.........T6.=Z)_.).cy......m....../..ty.....:.?y...6x.u...c.....<.8...a...7..:.....G.[....4..?}.z....e...y{;...m..X;.....~..qw.X.W.Tl.?.E..Ug....rN..:.U-.Z.r1.j....@...1..1...y=_..,..l..F.b.\U....Z.z.%......r.........]....c...Ll..M5H.D.....i.\..m..vl...e....{...$..C....D7.L.Z...e.\.UE.?.....s....}f....6z..sz.;.Y......}..3.....^.hM. .....S.........iS._2....xa.m."..........r..B..:.}fX....$...u.#...k..Y......

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 2985
Category:	dropped
Size (bytes):	1414
Entropy (8bit):	7.8512412489621655
Encrypted:	false
SSDEEP:
MD5:	EFF5BBEAE1F4C916964233AA0682BEDF
SHA1:	1AABC3A8484CE29277B163B165938167C3894B5D
SHA-256:	87A0A970C8910643C665BB7DA443CB1431CE5C4D49B3BC0AA3BF755EB1BA1123
SHA-512:	7D48BDD1537EF3EE8F1768180A19C15861D121CE7DF304EA8FD44495ADAA09487AEF71F1AAF2322FEB56CD8D2E9E0B6FDB6FCC208FAF5CDC6866B733CA497F8E
Malicious:	false
Reputation:	unknown
Preview:	...........VmO.H..._1...{..hi.I]....%.N.E..$^pv..uB...o.C...!...g.g.x...^A..?..........g.#.......vx.\|......a`,R.:G.`.J.. $W:S.Y40...,..VS..B...rk ....S5...t......:~H.Hhb"$Is.-...TVp.&..-..i.r...y"x...ke..F.bFJLN.m..0.`..Xi..v..s.+TS.)5...........$..r&f99.d.L...k0g..`.,T.....!'@q..B..?..q.m..A=s&.)(b.P..8...2b0..&.I..J.%.M4....(xX... ...Rx......S...\|...U....%.....~s.m.yPo...UbmfZ..D.$....).a......')3...%/.......)%........8RS&d.......4t.4\R.._h..Q.....6q}.x......8....J..'h..W.~..&......A...8...a`.....%6...H:.~.....E.......>.#.v.k.Jy..3H...nW...J...Kx....D.aQS..Y.hz.q..XPK..:%..H.e,U5...i.f.,......3.........aI.".i>r.\|EPj..#tK...8R...H.i...6..%.Oi...........F....7..6........ Z'._...m..M.F.k....].h....q&9....T.\<E..b..^........3.r./..1.D.4ePRY..?<...{..p.....6...H.MoH.#-.....A...D.VB..E..3Y....T...S...S.l.TUS.u..T.-..STq....x.A.,"jV..4.._..>......!W.LI....c.v..j....S...J.>...{w\....,.<."j...>u.YH.h%).........vG..oO..C.d%K?9.......b....)x{

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.6770058072183405
Encrypted:	false
SSDEEP:
MD5:	ECC8894D3791BEDDB4E0226F8DAB065A
SHA1:	6510EB51E76A49746C526E432455549B50DE5AF1
SHA-256:	64C8C0A9EFBC27AD86EAEC90465B75C52AE8CD68F7E76FC9431DC6AE66072AC3
SHA-512:	02B20BE98C22EBF7886FE68008C4ED42E3F8FF6ADC8DD7BC1A43A8C4F6FD56CC932EFC5500249A4FAA5024574A841AD10FC8DDB8221CB7226E0E16DEA63F7052
Malicious:	false
Reputation:	unknown
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	665
Entropy (8bit):	7.42832670119013
Encrypted:	false
SSDEEP:
MD5:	07BF314AAB04047B9E9A959EE6F63DA3
SHA1:	17BEF6602672E2FD9956381E01356245144003E5
SHA-256:	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
SHA-512:	2A1D4EBC7FBA6951881FD1DDA745480B504E14E3ADAC3B27EC5CF4045DE14FF030D45DDA99DC056285C7980446BA0FC37F489B7534BE46107B21BD43CEE87BA0
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/recaptcha/api2/info_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..W..DA.=.6O...H.,E.............b.....C.1...1..EbLPI.W......H..s.z5.:..._.d.0.u.......j.x.R..._.v..R...1..ir..`.yn..R..j.h./y..l......(`..5....l.E..0......B^......F.....F....Y\|p..._,p.............(3^.r.P.O......;<....z.,..yF....N..x.MS...Q.C%......D8G.+......oOk...)T..}\|..e...G.....'.R..G.Z.T}7(...&..@...G....$PGYv...A.c.]d....N..'.4b...R.%..)2Yd..b.M..^@.M....^.:h.N(dP*t..RQ%.o...{.vGH..S._".@./...g.....]...?..h..E.,r.m.%."."W.6G..t...->....q\.Kc.t"^......Kj~{l..C..).y..><@\|yB....=c.............!...<....IEND.B`.

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 407071
Category:	dropped
Size (bytes):	116418
Entropy (8bit):	7.997103074777364
Encrypted:	true
SSDEEP:
MD5:	AC2CE63EA39912D0725C7F56A3005C18
SHA1:	8D64E133BFC930D302A6C3B87516EF60C2BFCC53
SHA-256:	03B7BEF5C25262C48ABDD0794D32A6A3E06D4625BB8D0F735D561EBC5C407577
SHA-512:	225DE3ECB02362497ED7DAA85E589EBFC2D011FE1251F1D6CCD02B0B426B95F7F0F186F853528EA07CF37B587B16349443B31520F0A029F3524B3087AE6AE398
Malicious:	false
Reputation:	unknown
Preview:	...........k[.H.(.}..[..-..c.0DFxHBz.I......O.a...#yt......k...J..&...........^.~...._..j...W;.8<.....]....m...~.}<.8~s.~=.(....qm.Oy.~....jaP......h.F^......\|oZ.G.M-...,...a..~..GW\|...L....N.(y...Z-..Cm......p.......?.5/.QmS..b^K...jw..8.}..Q.....!.o..8...&X.x-.Im.F.D..U;.....-.T.:...1........8Ka..M.L.ZZ'....>........x....v.S;.<...0J.I.0.G.....B.F..c.k.~....C.:...r..,.w.q~....q......#42V.q..f\|.kK...1o.mP.}.......N..n.w6.%^M.d.;...~2I.Z...c..........a..o0..._.O>n\|....9.....R{..x~..=....j.N`.T....:(G....c..d..;?.....W3o..0U3...\|~9.Z.4....{.v.E....e..a.+a^..`.c4..Yd=.zQ-p#.c.......b..X.?v...\AMT)..~.<.`..Iaeo..h.N.k~<.%-..p.b7oO..].0,r....xl..3...6.O"..QP[....x...?.I.0..{..'..$nE.!.i....b...X,jK....y.).:...J`+_<....w-.d.......u.:..Z?.%.................+X"G.{.....{.4.xE....}.7].a..._..Lyd...]0.M....P\|..=]laY.(...h..2..X.(.X...2.VL.....}..~..6..[C..obz.#.....37h.W......P{..7!....b..\R.]U....."..@5.o....7S.piCG../.px..j.%r2.....v...m

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	78685
Entropy (8bit):	6.02034924964464
Encrypted:	false
SSDEEP:
MD5:	C8BC74B65A8A31D4C7AF2526B0C75A62
SHA1:	DD1524CA86EB241B31724A9614285A2845880604
SHA-256:	3B457E0ACFB1D231461936C78086C9EA63DE3397CBB019C4FE0182A645D67717
SHA-512:	4D7214AC44475CB4D9D848D71CAEE30A3872CAB3957FBB26A0ACA13DB1933CDA1E9799938BA1460581483123DD6F81C3193BBC80989CBA7E555F308C212841AE
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/recaptcha/releases/pPK749sccDmVW_9DSeTMVvh2/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGYktHRAD/AP8A/6C9p5MAAHq9SURBVHja7Z15fFTl9f/fd9ZM9n1PgCyEXSSRNYKCgAuiIipuVSuudavV1tq6W/WrtnWrrZbWDZUqUqUoCoIEQhBI2JesELKvM9mTWe7c3x83d5xAlkky8fv92ft5vfKC19znOWfuZ571POc5B1SoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKHifwGCRqsTNFrdj6VPq9XqtNofT9+wvutQyEyad8t9IaPPntFUd

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 113801
Category:	dropped
Size (bytes):	35195
Entropy (8bit):	7.993774545262612
Encrypted:	true
SSDEEP:
MD5:	663CA044EBAC62F3703711E217473650
SHA1:	B70DDE283218F1A75825E96B99680C65D3BA11D6
SHA-256:	BA22939804D65E18E744611F01D44C8273905D1843F19D97A48EBED65EF8B356
SHA-512:	C457646E8F96210664451E8CB848BB6D56F890AAC350A4A962739C7A1C8D4178A0F412C28B040632E7366391D37783839C2CD7AD278634B915202084EAB7183E
Malicious:	false
Reputation:	unknown
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p..3..<..."....I..0...F9....7?o..s..L.....!..v..x.;}+..3.o.4..i...."........2.u....7.\|.lu...Ax.7 .b..v..v.m-...~v...:....r..._......V.,...A..3.....:..z.>.y..u.....N...^..S.......z~@..;...n...K........x..A]....F.8X&Em..P.s......t6K. .d...<.l.Z...#.....:P?Q..."..........,.D...I<._.'..-..=..;.>.C_..#.....D[0.Y..*...M.....{.YT,...x..TQ/......N<`....._.k.....0)......+.Z..4...M. ...i...`.ml..-X.E.....d.. .}.e4.{6hz^..}....@....W.1...g8...>.@.....(.'[..`..A..?...yL.\|..QTF...-.='S@.Q.sM.`...}.t..$..y^..0J.kC.S.

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 113378
Category:	downloaded
Size (bytes):	20400
Entropy (8bit):	7.980283616044888
Encrypted:	false
SSDEEP:
MD5:	D5B89CEEC2B024C565802C0E51607044
SHA1:	74696825D59F384D3D874638537BB4920FDB60CB
SHA-256:	05DC99C6E0751D3A98E970F628C8426A967CF068A4BD681BDBAF6F627D54C7E2
SHA-512:	BB683A290B2F506A413BAADCA020A9716299221746B3E6A0D4C9F4BA481B3605F2911C1011F60F0D38D155F8086C3AF51F21D8C0164ECCB911B4531983C544E7
Malicious:	false
Reputation:	unknown
URL:	https://5fa47d26-522bcf86.05nissa.site/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css
Preview:	...........}k..6..w...R..J.H=GSI..x.9...}T.....)Q..f<...~.F.h..x..{+.-.....h..n....</v.ev......W.,.bU..rW.I...0x...C..2...6]..W_......../x.........~.z.}.\|.#x......AgO.\|XgU...4 .^'U...mP.A.].Z.U.!..Y.......:.ve.?.!..d.N...xJ...mR......0.@p...lKr/...E.-. .....\|l.4.o.i.......L.iF..T{.n....2....VEY.y=..=..T+V./.b....\....7.sH.w{.h.....!.."F.k.!.......d...mS.rh.&G.../..h&..RE"!.A/.......A....L...8.q.M...t[...R...>.6;R..^.Vu..9.[F........>A.:HT}w]......2........p......'T.^]}.^..yJ>.<..pq..h.\|..j....j.x..-...c...f...=".)..U.X'.M..l.]ZVtl\.I..}.0.~B0Y'.N...E.4.Xd..e...a.........."..9+d.&..l.$E..R.u.g.Q..w&...~I. .y..D.4;..'.."-.....b...)k.n.M...,3J.z_..&2f.h;.&.R.y..P..X.....\P.....r...B.$........<....H5.M.."'#.6mQl..mQ5.=.\...O.....^..jM..u.F..Oh.lNI..j..T..u...I..._........{.\...{..._\|..={O..z..>......x..5Q.D7?{...^...^.......o.=.z......v......z.C...Gtw...0!..M@....^...^.x..G....W...{...)..y.<c3...^>{......7._..'d__...;R.

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	unknown
URL:	https://5fa47d26-522bcf86.05nissa.site/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	downloaded
Size (bytes):	2279
Entropy (8bit):	7.354295352983905
Encrypted:	false
SSDEEP:
MD5:	7E0D59593F3377B72C29435C4B43954A
SHA1:	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2
SHA-256:	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
SHA-512:	397416A6A96A39F46F22E906A60E56067E5B7B11FB0597A733F862FC077C88D5ED31F51A82709A56F6082FB1F2F72F9A0FE0849E3DD493BB4240C265B546AAD3
Malicious:	false
Reputation:	unknown
URL:	https://5fa47d26-522bcf86.05nissa.site/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	............ .....f......... .$...\|... .... .5.......00.... .j.......@@.... .....?......... .....2....PNG........IHDR................a....IDATx..1NCA.C..D@."-en.!.h..8@..9h..".....5M....h..-..l..L..P.Y.^luw...r.(.........w...B({....&.F......N.f%..........^&.x}Zu........g..7m......n?..U`....@.M8.g.-..\|..S.K.!....].%.I......&.I..`...F \|o;....{S....\|..VL...E....IEND.B`..PNG........IHDR..............w=.....IDATx..AJ.A.E_.5...D..$'....<.g.\...!.].!..Y....4...B.......4U...Q..J(...y....%..[t;..>\...~....O....r......e...F....8.d9....4.x.xW..e...c...~W..P2.........[.....r<..,..>....q.\...U...v.'......!.1.....9..:8............I.I.d.......IEND.B`..PNG........IHDR... ... .....szz.....IDATx..AJC1.E.{..... .;..>\..q+.. ..N.j....."8k.P..IF...M..{.8..F..Z.q...~.y}...0.f..U....Z...@yd...4......DT.B..)......v.8.....)..Lq.[....]_jrG$...3.%......i.vU...C...h0.....rz^.].....9..5.....mU~.E..GMF.X....?..Y.U..\|.c.k.v>..@.h..........Nh.u......IEND.B`..PNG........IHDR...

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15340, version 1.0
Category:	downloaded
Size (bytes):	15340
Entropy (8bit):	7.983406336508752
Encrypted:	false
SSDEEP:
MD5:	19B7A0ADFDD4F808B53AF7E2CE2AD4E5
SHA1:	81D5D4C7B5035AD10CCE63CF7100295E0C51FDDA
SHA-256:	C912A9CE0C3122D4B2B29AD26BFE06B0390D1A5BDAA5D6128692C0BEFD1DFBBD
SHA-512:	49DA16000687AC81FC4CA9E9112BDCA850BB9F32E0AF2FE751ABC57A8E9C3382451B50998CEB9DE56FC4196F1DC7EF46BBA47933FC47EB4538124870B7630036
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Preview:	wOF2......;........d..;..........................d..z..J.`..L.Z..<.....\..`..^...x.6.$..6. ..\|. ..8..z%......Q.{..q...FF.kd .8.(..d..).!C...Y.JA...r. ..GH8F......nW...".2&....2<..+C...p...b..SC.......J......z.-..Q..#6&1zUe../\...l.....<.....9s...E~.]B-..B.wY..o......Q..A.F..1j.......-.`P% .. ,..@1.0..~.....WWW.d.u<c{..^.R.+..w....&.........A......+C....(.N.....0.~..0.J.;.Nu..7....]..m.H.....[h.GL3....?)....c.H...2.3.}y........SXI\|..iVN'%E.D.W....r..<`....i....6;E$.....U.$j.@...._.......R2....WS...k.vz.R.'a9!^...N....h.._.....c.%."..S.2.16B...o.2}.pmU[.\|.LI....2.....OWQLO1-....s..8.(...".\|6...6R.. ..M-.zO.}w)..v..mXxX...c..3#.+.v....F`.Z;.zQ.......r,....Yo.....g.h....+.....O.3Y..)Y.8.!....elX......._.3.}k~u.{ C..H.z..FP........@...d..)T.R...L.H.J.j.@..............$...E......y...3.b...I.h u.+%.HA.\..9..8..X.!....gx...].:..V..C...._..X..!....6..)...GM:E.....O.Z.}k.;.T.k..D.k.O..D5.r..."......?..T.Q.A...CF...3g.5.Dn<.QPy..G..1.9..Q..0..

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057605
Encrypted:	false
SSDEEP:
MD5:	9F9FA94F28FE0DE82BC8FD039A7BDB24
SHA1:	6FE91F82974BD5B101782941064BCB2AFDEB17D8
SHA-256:	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
SHA-512:	34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSFwmwSxZl_nN-XRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChIKBw3RW1FSGgAKBw1Xevf9GgA=

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1434), with no line terminators
Category:	dropped
Size (bytes):	1434
Entropy (8bit):	5.766466434975035
Encrypted:	false
SSDEEP:
MD5:	9CC048508CA799E21AABA9E16E422C2A
SHA1:	6AFE4651C8EADA7CA6B1543ABA3E099633C4712E
SHA-256:	B2522C89AFA883BEF0AF1E6041EDC46545C40C83ECBF6315FFB46F1C4D6E54BD
SHA-512:	AC56BB358B09A2B454A39D0FA059408615F3AF8DDD0ABE6A4AD6AA84BFF39B3025AECB4E804B815E6358CFC11AF04FC0F62BD92F68B2CB0A715D730DF116EC96
Malicious:	false
Reputation:	unknown
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true; po.charset='utf-8';var v=w.navigator,m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='A/kargTFyk8MR5ueravczef/wIlTkbVk1qXQesp39nV+xNECPdLBVeYffxrM8TmZT6RArWGQVCJ0LRivD7glcAUAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.getValue().then(function(l){if(l!=='treatment_1.1'&&l!=='treatment_1.2'&&l!=='control_1.1'){d.head.prepend(m)

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	102
Entropy (8bit):	4.772957725108534
Encrypted:	false
SSDEEP:
MD5:	F56BC8F23C3B3A667E0F3096F87DD792
SHA1:	9C064BF7E19A1DA889286CF59E260C3E7C61BB5A
SHA-256:	0474C582AF94690BCA87DCE1B9DC2C42D26C4AA831BC03A1E11EE1A169B211E4
SHA-512:	3200CF8A5C4622369F1B0BCB0B35CA875F41BFAA7399DCDFC33CC690C921E978D9B3BAABEF615D34B7D599D4131D40E374D1914F493CEF70F59CF90C772E60A2
Malicious:	false
Reputation:	unknown
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/pPK749sccDmVW_9DSeTMVvh2/recaptcha__en.js');

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 190247
Category:	dropped
Size (bytes):	61139
Entropy (8bit):	7.994935032457051
Encrypted:	true
SSDEEP:
MD5:	7283A834C13F2DF80391FAF3147AB5A5
SHA1:	3CF73E7547A452E740FEB7542CCA1CEAA499B7A8
SHA-256:	DABEA7DF0B362D31B670D03BC683392E1BB796D09A0CE63EB9D1DC6E0F981304
SHA-512:	088451DBDA241BDD905D14F841638884D78701F4F30A065B5849101987D3120C76A015C1377DE3A354C7E28774B2FD741E3FB60D3AFFCCC365FBACC92CFADF42
Malicious:	false
Reputation:	unknown
Preview:	...........iw.F.0.....'W..`...8..^Y.m&.%NF..@`K.M...J.H..OU........'..4......Z.8..7.M......;.....4..K....z..<.rON.O..../.IT.i.2.......Y..N?ign..I{....k8......wU6..c.<KZY.-<.;.fI...,.n...2.>..8.,.!...(.#....xl.o.f.$./..\|3......s..j.}6..M...()X.......%.5..E..Y:cYq{t;k.xd.9...8.....<...x>aYm.M#...a..E.........E.....&...<....I.../.6.........)....6.s'N6..$a..,Na.k..T12..(.`r.X.+.6..o+./.4/.h;.l.....qry.........e...Z...eS..ZU........\|d.YC.gV#..x.:.V.s.z.,g2...X...p^.k...2E...7L....vR_...Kod]....M.%G)`{.6..Y..l.^.....8G..O.y...z..."NX....o-...d..=.'7.\...M".bC..V%{._XT....s....h....aQ..U.R;h..v....2..4... .?..~....1r.._......5..I.a.?,..?..U....?L..wlh$.a.....6.Q.O. ....5...X..Y.6....fYZO....y..Or..z]B..y..;o.....o.rS..HG.{K...Y&P...........#.x'.5..m.......s.6....6...."z...fM.6.......4@...%+.."6C.%./6'...2<.7...J5..l7.p9......(..WM...T}...:..o..9l.MX...-.i....a.)..[.09S .K)...e6i?.....x.9.0.7...V...\|.........u..g...n..mk-^..e.O/6...

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 2525
Category:	downloaded
Size (bytes):	1943
Entropy (8bit):	7.899017687644087
Encrypted:	false
SSDEEP:
MD5:	47BF65B269141F8E0C333BEC9331C5BF
SHA1:	9006322004BCCFA8BC50EA18E305B37818E1F616
SHA-256:	5F704D5E414262FA57415DE1778231E1860C11D22C700092C267E153FA8927AC
SHA-512:	58171C22604D9C80B3BD59EFDAD88B8221D5D06DD00B577641E73356FD14F887A19F5BA04332B3E79960300C067B5882A01BE08450AFD0D32FFB93346EAABE23
Malicious:	false
Reputation:	unknown
URL:	https://81a9ffde-522bcf86.05nissa.site/Images/Clear.PNG?ctx=jscb1.0&session_id=42607d98-8a23-4ba8-b0ce-4a49829f62e9&CustomerId=9e21cb52-25cc-4c73-b853-e8d4ae325369&esi=YnVhPU1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTcuMC4wLjAgU2FmYXJpLzUzNy4zNiZvcz1XaW4zMiZscHJvYz00Jm9sPXRydWUmcnR0PTgwMCZjaHJtPXRydWUmcHJvc3ViPTIwMDMwMTA3JmV2YWw9MzMmYXBwdj01LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2JmxzPXRydWUmZG09OCZtdHA9MCZuYz03NCZwcj0xJnNyPTEyODB4MTAyNCZzY2Q9MjQmYXNyPTEyODB4OTg0JnR6PS0zMDAmZHN0PTYwJnR6bz0tMzAwJmJsPWVuLVVTJm10aD0yN2Y1MWQzMTQ5ZTZiZjIwOWI2NmJkMzg3YjBhZjNjNCZtdG49MiZwbj01JnBoPWYzYWMyMmFjNTljNmRjYjg3NDEwOWQwOTNjNTI1NWU4JnA9cGx1Z2luX2ZsYXNoJTNEZmFsc2UlMjZwbHVnaW5fd2luZG93c19tZWRpYV9wbGF5ZXIlM0RmYWxzZSUyNnBsdWdpbl9hZG9iZV9hY3JvYmF0JTNEZmFsc2UlMjZwbHVnaW5fc2lsdmVybGlnaHQlM0RmYWxzZSUyNnBsdWdpbl9xdWlja3RpbWUlM0RmYWxzZSUyNnBsdWdpbl9zaG9ja3dhdmUlM0RmYWxzZSUyNnBsdWdpbl9yZWFscGxheWVyJTNEZmFsc2UlMjZwbHVnaW5fdmxjX3BsYXllciUzRGZhbHNlJTI2cGx1Z2luX2RldmFsdnIlM0RmYWxzZSUyNnBsdWdpbl9zdmdfdmlld2VyJTNEZmFsc2UlMjZwbHVnaW5famF2YSUzRGZhbHNlJmZoPTJhMjk4NDlhZjA3ZGQxNjFkZGM3MzA0MGJlMjVmM2YwJmZuPTExMiZsaD1odHRwcyUzQSUyRiUyRjgxYTlmZmRlLTUyMmJjZjg2LjA1bmlzc2Euc2l0ZSUyRiUzRnNlc3Npb25faWQlM0Q0MjYwN2Q5OC04YTIzLTRiYTgtYjBjZS00YTQ5ODI5ZjYyZTklMjZpbnN0YW5jZWlkJTNEOWUyMWNiNTItMjVjYy00YzczLWI4NTMtZThkNGFlMzI1MzY5JTI2YXNzZXNzbWVudCUzRGFzbXRhYWRldSUyNnJlcXVlc3RpZCUzRGQzZjY2ZjhmLTdjNzItNDFlYi05MGIxLWM5MmM1MTU2OTEwMCZkcj1odHRwcyUzQSUyRiUyRmxwLjA1bmlzc2Euc2l0ZSUyRiZ3PThERDBGOTY0MDlBQUM5MiZpZD1hNTgyNTA5ZC0yNzg2LTRjNjYtOGZhNC0xMjg2YzdiMjRhZDMmYT0mYz1iMGVhZGI5MzQxNjZiNjk2MDdiODI1OTIyMzM2MTc2ZA==&eci=eyJ1dmRyIjoiR29vZ2xlIEluYy4gKEdvb2dsZSkiLCJ1cmRyIjoiQU5HTEUgKEdvb2dsZSwgVnVsa2FuIDEuMy4wIChTd2lmdFNoYWRlciBEZXZpY2UgKFN1Ynplcm8pICgweDAwMDBDMERFKSksIFN3aWZ0U2hhZGVyIGRyaXZlcikiLCJ2ZHIiOiJXZWJLaXQiLCJyZHIiOiJXZWJLaXQgV2ViR0wiLCJpZHVoIjoiMTViNmNhNDcyNjliZTQyODc1Njg1MDY5MzdlOTkxN2MifQ==&u1=&u3=10.0.0&u4=x86&u5=64&u2=(Google%20Chrome%2C117.0.5938.149)%2C(Not%3BA%3DBrand%2C8.0.0.0)%2C(Chromium%2C117.0.5938.149)&assessment=asmtaadeu%2fd3f66f8f-7c72-41eb-90b1-c92c51569100
Preview:	..........5.5....W./3.33..+33{.y)RN=.ST...Wi21o.V..Hn5V..Q..3z..6.p..x..r{.)<.r7...Y..NT.nd,.7..`.....\|~..x.......y..Y.~&+...`9+.r.D..x4...?+...a,...#.......gE..i}j..(......ab........[\|..!%.~/."...E...=4.^."hM%...]:....7..HBsy"e.O...R.}yT.1..O.l.m..X......<.9n.:a.UP.9C......./2q_......7[......K...n.............V.1.....xa.^..W..yr_"E.=...t?..fne..6F..$.z....d....U.R'...........fQc.E..x..y..c..$.g.^j ....$o..N#W7>.N....oY...1..bD...EXV,~..d,.r[...P.."...@CM.].Q....U...d...t.&.3..jP.u...2.%..o..+..k$.YV.v.%R7..3a...1......,.\|.....g.nm...'..?..c-...qu..30..$.7.p...a0D..@@.B...x3...x....q...X.]..4.C3}~.<..^...l.P....0...F.A.A.E...;Q...av);......n(..c...B._..6.x.............>..iK.a.o.m.?pI6.1n.'S.uk.Nl4..DFP....I.0...KT.\q0r......L....N..I.KQ....9`.L....5...Y..."G..A<.G..l/;...K..... .S.........BD".. vS.....E..LJ@..J..Q..!.S.e.sBe..j....;.-.."Ly...B...D.PT .$..q...ad.....a@5.. ..=v..4z.t4.....8...,.J...Z..M..v.EH/........P.>

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18272)
Category:	downloaded
Size (bytes):	18892
Entropy (8bit):	5.689021534684866
Encrypted:	false
SSDEEP:
MD5:	A8084433CE6D5D920972E3890A776AAB
SHA1:	9732D59DF28E5D82D2F762A31F537A520BE00140
SHA-256:	8808917420E2CBC70DFB32902AD3EE864FB2A914F5432622F2FCB50C0F9C689A
SHA-512:	EA4107E248C1941B920B2BB413A706506AEF196CC2FB8DEC336529C0CD76D3CBBDB76527CDBDA2EE7E4CAC406EFE8B905199C6DF38F89E7BE0D8852139AD6E34
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/js/bg/iAiRdCDiy8cN-zKQKtPuhk-yqRT1QyYi8vy1DA-caJo.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var w=function(B){return B},E=this\|\|self,N=function(B,p){if((B=(p=null,E).trustedTypes,!B)\|\|!B.createPolicy)return p;try{p=B.createPolicy("bg",{createHTML:w,createScript:w,createScriptURL:w})}catch(A){E.console&&E.console.error(A.message)}return p};(0,eval)(function(B,p){return(p=N())&&B.eval(p.createScript("1"))===1?function(A){return p.createScript(A)}:function(A){return""+A}}(E)(Array(Math.random()7824\|0).join("\n")+['(function(){/',.'',.' Copyright Google LLC',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var e=function(p,B,w,N,q,D,E,P){if(B.o=(q=(D=(E=(p\|\|B.J++,B.X>0&&B.H&&B.Qp)&&B.A<=1&&!B.L&&!B.V&&(!p\|\|B.Df-N>1)&&document.hidden==0,P=B.J==4)\|\|E?B.v():B.g,D)-B.g,B.s+=q>>14>0,B.j&&(B.j^=(B.s+1>>2)*(q<<2)),B.s+1>>2!=0)\|\|B.o,P\|\|E)B.J=0,B.g=D;if(!E)return false;if(D-B.I<B.X-((B.X>B.i&&(B.i=B.X),w)?255:p?5:2))return false;return((B.Df=N,w=G(p?9:285,B),V)(B,285,B.D),B.h.push([pF,w,

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 57510
Category:	dropped
Size (bytes):	16345
Entropy (8bit):	7.98961401355024
Encrypted:	false
SSDEEP:
MD5:	1BB2645B377E0429225D33E4E2CC6E3F
SHA1:	A40797795C77CDFF574080B506BAB17DB38494B5
SHA-256:	B3B869875C7655F97500FBA0BCE74BCE7CC1DEE31D7CE5B93EA5D6457E07F08E
SHA-512:	49C98F20572C7488FEDB8AAF6C3D1D004904536524B79FA44CAABC5B91C8BA1A192B10F1FBE28112CC324E17600160E5BAA5E30261E5D63858C16376219DD3FE
Malicious:	false
Reputation:	unknown
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo..................?........w!......=.G...P.../......8z....q._5....g..}g..31......l*...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.p>.....7.....4....Z,&c.)n.[.pcQp...4...&...i.............CkL=.....g..m&vG..p... ....:N`y...ea.,....[......^.../D#(y.....l4.n..,.=_.p2P.....A,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j......?.)..t.z.-..m.]..3y...3@...'.)...Aa..1.kQ.....l+.....-q..n.p..{^...$..{/...=a..A...4.VH}..SBwju......S..hN.P..-..O,..S7.J,.....p.iLU.6W.....eO.7 ..C...{.E.Z...1...5s.!uY...@^. ,D".N.E......5.NE..\...VQa.A7..X.B..{.q..Ra..S....x(x7.Cp.#.#..:.......D..`,!IGr.. ...z.?.._0O.......;..0.z.h....5.../...q..5.\|..B.OY..k...].Sw.>.".@..!.9.V\|...=.dv.3!sr.....#...X8s.w.\|7..O/....!.."...3.."D..)...[........!^....3(..{...F2'..q.....x........

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 2809
Category:	downloaded
Size (bytes):	1437
Entropy (8bit):	7.885824439567186
Encrypted:	false
SSDEEP:
MD5:	DDDF6408FCA873E29F48168C45420779
SHA1:	614EA93EBFD2C4940A8281975BCD109E70A87FFB
SHA-256:	085D666CBFA9B4E4299BCE00CDC756DF1B62F9E144A36C1019454F6BDC9E91CA
SHA-512:	0D51FDBC2E683B9D1F8BF31417191B7731D9FE1C493E80BD93E0FE191D95554A6EB384E3BE30EE688DB40CF4C417B6095E0A12019AE8314EB74A73AE355650D0
Malicious:	false
Reputation:	unknown
URL:	https://81a9ffde-522bcf86.05nissa.site/Clear.HTML?ctx=Ls1.0&wl=False&session_id=42607d98-8a23-4ba8-b0ce-4a49829f62e9&id=a582509d-2786-4c66-8fa4-1286c7b24ad3&w=8DD0F96409AAC92&tkt=taBcrIH61PuCVH7eNCyH0AHEYHVht29NHm46S5qgUjYsww9wvwFN86Z%252bKBznUDzmxYSEANm6kxNl1HLTkLpjsF2MedWlthGocARqGKgSmogaH0%252bYgKPzHr1gIg3xrOsD4NXNOgc2q3VbleDA7TCPNTB79n7NhDqmD2hYbLXqh59RswB31zxeTAUKSxN6BI7Szy7HVA9t2EtSHXL4sGAEo6FzYA5xK%252fU2ybuOMQhbJLodeDiqt33Vh%252fXv%252fGU9jW5DCvVGUr0cUrSEDtOXvoLByy99HMy2XovVNnBjYKbE3ynTFfXUqYBkFQ7x9XossMIKdTHn8SCOlP0SmNdg%252fgQ6nA%253d%253d&CustomerId=9e21cb52-25cc-4c73-b853-e8d4ae325369
Preview:	............io.8..J...HS.-.$...vF.{Z(-....$...Ac..;..........H....'.....a.B...o..q".h.{.;U\.._..$I.......j..J.(..`...~N8...vRH.@,d..fGt......4...fd..Ps...]...#.FxN.X/......%..!5...&......i.#.....6'...z.s..c...~..=F.c.;C...G1Q..!...Wn...I.}...I.&/1a\..O..Ju..X.8...8.../..Z..4....:....A;d.1.....#....'Q/E..9.>h..jjP..#.k.#...{.8..]....$.V.8..2..Ai..AK./8...I..X..#.....".....Os..AEz.xx.&$j@....$.}....V-...!...i....Q.Z K...@....EA?...=....J T.PDx..H..5..m}3.?.N.S..I...(..Cn.{..l....&........y.^.....q..8.fix_i.=e.....V......r.Dl.r.n%.QT..`g...x<Tr2.[o...5qFP.w....B'.Q...Z.....a.z.t..A...(.i?@.l.m..O....v.C.5.:...G...BR@.kT.n...."....1..E....b.C.....e....Gt.s.V"[..V.....p$..H.h....Ykx.9p....5......{..QS.,..%.^.?..Z.>..=.....D........H..:.m.:.`.T..r....B.mL.....:.2....jB4. 7C.S9Vt..;/.....g..l..o....Fd.Yz......m(o.0Tx...\...Kf....X.eL,kb.'Ve....>..'.).zY.....W/...2...L%.7w,.x.Z@..z.&..V..=;._#.nOM..0m..lWJG.Y:"U..I.0KVM..O8+U..^8.m..,M.".A.v...

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 142302
Category:	downloaded
Size (bytes):	49913
Entropy (8bit):	7.99524825195543
Encrypted:	true
SSDEEP:
MD5:	3B66BA14E2271AD003187AD1D1AB6F46
SHA1:	92A6F286DA87F2419148FA6E68D842B220FD442A
SHA-256:	6B5ABE9776E215A3B2FEEF0A9EA159D950D3F7F965BC424AD43B07CBB9B4B004
SHA-512:	89CFD2DC9761332A8836FAAB22CD7A0393F2BAA4E31628E807059CE3873208BB910BDF30556B7AFD973B9E0489432A52AD939EA405F4EC37246768F7ED699912
Malicious:	false
Reputation:	unknown
URL:	https://3b7cbebb-522bcf86.05nissa.site/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js
Preview:	...........m[.8.0........OL....;w.....a.L...\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De....q.W.~.@......T.y.S7J...f...P....Pz.......a.E..<.m./A,*...Q.....U..q...$.Db,...H<...'....J,..$..;nG.2DHYkL../......=.pB....A?.&...i,......2lo...$.<.s...?~p[......L..&x.qR.u3...6q:....U.Y1.."... .>Un#7@.........."H,@.......?..P....p6.S.[...E].A..G.....q..j4w6......YwI2....[?.......c..............Ko....d.K.1....\|.M...........p...S5............r.......d...aUa>..JRM.-...nT.....qm....b.a...N..OEp..u.Z...2...#d.:.A.&O3Q.s..c.(.........Z....^F.....l..U...bZ..4:..h..?T.k.PeU\....L.a..>..t.......jV...B.i7....>b..T....D2...>.^.!...v0.y....kMKf..EG..X.....V`e../Sg...->.Vh}.....R..^..OZF.<i.(..#..1... P8!>3....\ .+..".........\M.'..!...(...T.j.;...$D%N .)..#?.V...'r\.... ...&....J\|."Nd%D:uw6.>U.+...H&.Z...T=.&U.v....J.t.0%+...U..3M....y...L......p='.....?%...x:woO.{Q5..0....D).(

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (545)
Category:	downloaded
Size (bytes):	560083
Entropy (8bit):	5.670807885144341
Encrypted:	false
SSDEEP:
MD5:	81697E6CDD98E37117D7BDDCECF07576
SHA1:	0EA9EFEB29EFC158CD175BB05B72C8516DBAA965
SHA-256:	73DD640564004EC8730E7F3433B9DFAA6876AC3A27E6964A17834F07F6D56116
SHA-512:	FC29D4A1FD39A7C78B7F57B221596ACEE9B805A133CE2D6FF4BC497A7B3584AB10E3D4FFDE30C86884F1ABEAC7D521598EBDA6E0B01FC92525986C98250FA3F8
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/recaptcha/releases/pPK749sccDmVW_9DSeTMVvh2/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var T=function(){return[function(r,d,h,V,R,K,Y,S,N,D,F,E,l,B,C,m){return(r\|32)==(((C=["fr","flat",2],r)-C[2]>>4\|\|(m=new Promise(function(P){window.addEventListener("visibilitychange",P,{once:!0}),document.hidden\|\|P()})),r-7>>4)\|\|(E=[2654435761,0,"1"],Y.wb=K===void 0?!1:K,B=b[38](26,Y,V),N=g[16](55,B),Y[C[0]]=N.next().value,Y.C=N.next().value,Y.rI=N.next().value,Y.Zf=N.next().value,F=Y.R()[C[1]](Infinity),S=F.findIndex(function(P){return P instanceof dy&&k[17](15,P,h)==d}),l=g[9](5,F[S],lj,3,p[12](77)),.D=[n[48](22,Y[C[0]]),A[43](38,Y.rI,U[9](11,Y[C[0]]),E[0]),A[10](27,3,Y.rI,U[9](19,Y.rI),E[1]),A[10](28,3,Y.Zf,U[9

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	530
Entropy (8bit):	7.2576396280117494
Encrypted:	false
SSDEEP:
MD5:	88E0F42C9FA4F94AA8BCD54D1685C180
SHA1:	5AD9D47A49B82718BAA3BE88550A0B3350270C42
SHA-256:	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
SHA-512:	FAFF842E9FF4CC838EC3C724E95EEE6D36B2F8C768DC23E48669E28FC5C19AA24B1B34CF1DBCBE877B3537D6A325B4C35AF440C2B6D58F6A77A04A208D9296F8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX...JBA.....E-R... (#..-*$.}.%.Kt.A..Dx.I...AF.Q.4.......-.6..?.m:.,.......Q..D.L..e4..2.D..8)j4:......&>.s......p?......9.o5>.][H.}...&L.%.xh{~K.J\|.b..N..HMp....f.}dd..S..4%...$dK..!..Z..NNs.W&g..Fn....p...w..Ut...E\.e.......6......M.F...X.L......em.....R#'..%....j$/..-......@.l."..M.\|....OtW.H.,.-.~W`Z.s8..W...B...C-.8"H....6......9...A..aO.1`.M..A..eA.{...-...U.,.W........IEND.B`.

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	unknown
URL:	https://5fa47d26-522bcf86.05nissa.site/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Static File Info

⊘No static file info

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://url.us.m.mimecastprotect.com/s/qfbjCOY674iMrZ7sEflHGWtli?domain=lp.05nissa.site

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 119

Chrome Cache Entry: 121

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 133

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 143

Chrome Cache Entry: 145

Chrome Cache Entry: 147

Windows Analysis Report
https://url.us.m.mimecastprotect.com/s/qfbjCOY674iMrZ7sEflHGWtli?domain=lp.05nissa.site